Credential Phishing and ₹42 Lakh Transfer: First-Hour Response
At 10:15 a.m. a relationship manager at a mid-sized cooperative bank receives an email that appears to be from NPCI, asking him to validate a new settlement file. He clicks the link, lands on a lookalike page, and enters his corporate internet-banking credentials. At 10:40 a.m. three RTGS/NEFT transfers totalling ₹42 lakh leave the bank's correspondent account to two beneficiaries at other banks. The branch manager learns of the transfers at 11:05 a.m. when the beneficiary banks call for confirmation. The bank's core banking system is working normally, but the relationship manager's laptop is still logged in and the email is still in his inbox. The bank has a board-approved cyber-crisis policy, an incident-response retainer, and cyber-insurance. The RBI's local office and CERT-In have not yet been informed.
1. Set out the first 60 minutes of containment in sequence, naming who does what. Distinguish what can be stopped from what can only be requested.
Read the worked answer
0–10 minutes: the branch manager isolates the laptop from the network without deleting the email, disables the relationship manager's credentials, revokes active sessions and VPN tokens, and blocks the lookalike URL and sender at the mail gateway. 10–20 minutes: the CISO and incident-response retainer are alerted; the bank freezes or places a hold on the two beneficiary accounts through the beneficiary banks and asks NPCI/correspondent bank to stop any unsettled transfer. 20–30 minutes: the fraud team requests recall of settled RTGS/NEFT transfers through the beneficiary banks. RTGS cannot be reversed unilaterally once settled; NEFT return depends on the beneficiary bank and account holder. 30–45 minutes: logs and forensic images are preserved, and the MD, board cyber committee, legal and insurer are informed. 45–60 minutes: the incident is reported to RBI within its prescribed window, to CERT-In within 6 hours, and an FIR is filed. Customer communication and root-cause work follow.
2. Which evidence must be preserved, and how should the bank avoid destroying or contaminating it?
Read the worked answer
Preserve the original phishing email with full headers, the URL, browser history and downloads, the laptop memory image, EDR and antivirus logs, proxy and mail-gateway logs, VPN and authentication logs, core-banking and maker-checker logs, and the transaction records for the three transfers. Also preserve helpdesk tickets, CCTV where relevant, and the relationship manager's written statement. Do not power off or rebuild the laptop before a forensic copy is taken. Use a write-blocked copy, record a hash value, maintain a chain-of-custody register, and restrict access to the evidence. The incident-response retainer should handle imaging. Deleting the email or resetting the machine without capture would destroy the sender and header evidence needed for recovery and regulatory reporting.
3. The cyber-insurance policy requires notification within six hours. The manager wants to wait for the internal root-cause analysis before notifying the insurer. Advise the bank.
Read the worked answer
The bank should notify the insurer immediately or within the six-hour clause, without waiting for root-cause analysis. A notification is not an admission of liability; it preserves the bank's rights under the policy. The bank should give the known facts, the estimated ₹42 lakh exposure, the containment steps, and the name of the incident-response firm. Waiting could allow the insurer to deny or reduce the claim. At the same time, the bank must follow the policy's approved-vendor and consent conditions, keep legal privilege over the investigation where possible, and coordinate the insurer's notification with the RBI and CERT-In reports so that the statements are consistent.