The unabated rise of cyber fraud and “digital arrests” in Delhi has exposed a disturbing weakness in the fight against financial crime. While the police chase fraudsters across jurisdictions and dismantle their digital networks, the banking channels through which the stolen money flows often appear to escape the same level of scrutiny.
The question is no longer merely how cybercriminals manage to dupe unsuspecting citizens. It is also how they are able to open, operate and repeatedly use bank accounts through which lakhs and, in many cases, crores of rupees are siphoned off without triggering adequate safeguards.
A recent case from Dwarka illustrates the sophistication and audacity of the fraudsters. A 74-year-old retired Indian Railways employee and his wife were allegedly subjected to a seven-day “digital arrest” by men posing as officials of the National Investigation Agency and the Anti-Terrorism Squad. The victims were made to believe that they were implicated in a serious criminal case and were kept under virtual surveillance while the fraudsters extracted money from them.
Such cases are no longer isolated incidents. But behind every successful digital arrest is another, less visible infrastructure that is the financial network that allows the money to move. This is where the role of banks deserves much closer examination.
In several cyber fraud cases, investigators have found that the money transferred by victims does not disappear into some sophisticated, untraceable digital wallet. It frequently passes through ordinary bank accounts. Many of these are “mule accounts” meaning accounts opened or controlled by individuals who allow criminals to use them for receiving and transferring illicit funds.
The obvious question is how are such accounts being opened in the first place? There can, of course, be legitimate reasons why a newly opened account receives an unusually large transaction. But when an account belonging to an individual with limited financial activity suddenly receives multiple high-value transfers from unrelated persons and immediately moves the money onward, it should raise red flags. If the same account becomes part of a chain involving several fraud complaints, the warning signs become even stronger.
This raises questions about the effectiveness of bank’s Know Your Customer procedures, transaction monitoring and systems for identifying suspicious patterns. It also raises a more uncomfortable possibility of in some cases, bank officials being negligent or may be in active connivance. The distinction is crucial.
It’s true a bank cannot be held responsible for every fraudulent transaction passing through its systems. Cybercriminals are constantly evolving their methods and financial institutions process millions of transactions every day. But repeated use of the same accounts for suspected criminal activity, particularly where there are obvious inconsistencies in account activity, should invite scrutiny.
Delhi Police has specialised units dealing with cybercrime and financial fraud. These units have undoubtedly achieved successes in tracing digital footprints and apprehending members of organised fraud networks. Yet the scale of the problem suggests that the current strategy needs to evolve.
Breaking the bridges used by fraudsters cannot mean merely arresting the people standing at the end of the bridge. The financial bridges themselves have to be dismantled. If a particular bank account repeatedly appears in cyber fraud investigations, as in the Dwarka case, investigators should be asking not only who operated the account but also how it was opened, who conducted the KYC verification, what transaction alerts were generated, whether those alerts were acted upon and whether the account had previously been associated with suspicious activity.
These initiatives do not mean banks should be treated as accomplices by default. It means that banks must become an integral part of the investigative architecture against cybercrime rather than merely the custodians of accounts through which the crime occurs.
The fight against cyber fraud cannot be won by issuing repeated public advisories asking citizens not to share OTPs or transfer money to strangers. Prevention requires disrupting the financial infrastructure of fraud. The Delhi Police now needs to answer a fundamental as to why are the financial bridges that enable these frauds still standing?
Sidharth Mishra
Author and president, Centre for Reforms, Development & Justice