IIBF Cyber Crimes & Fraud cheat sheet

Fraud triangle: pressure (motive), opportunity, rationalisation; opportunity is the element the bank controls through controls design.

Cyber fraud classification used in Indian banking: card-not-present fraud, ATM skimming, SIM swap, phishing/vishing/smishing, account takeover, man-in-the-middle, QR-code fraud, SIM/OTP interception, and insider collusion.

Fraud risk assessment formula: inherent risk (likelihood x impact) minus control effectiveness = residual risk; residual risk above appetite must be treated or accepted by the risk committee.

Segregation-of-duties rule: the person who creates a payee, the person who authorises the payment, and the person who reconciles must be three distinct roles.

Velocity and anomaly rules are the core detective control: flag transactions deviating from a customer's 90-day baseline in amount, beneficiary, channel, geography, or time-of-day.

Customer indemnity for unauthorised electronic transactions is zero liability when the fraud is due to bank negligence (third-party breach, bank systems), and limited liability where the customer reports promptly per RBI's 2017 customer-protection circular.

Red flags of mule accounts: high-volume low-value credits, immediate withdrawal or transfer, accounts opened in bulk at one branch, KYC address clustering, and dormancy followed by sudden activity.

Social-engineering frauds usually bypass technology: the weak control is the human process, so call-back verification to a registered number is the decisive control for high-value instructions.

CIA triad: Confidentiality (encryption, access control), Integrity (hashing, digital signatures), Availability (redundancy, DDoS protection); a control is judged by which leg it protects.

Encryption at rest uses symmetric ciphers (AES); key exchange and non-repudiation use asymmetric cryptography (RSA/ECC) with a PKI-issued digital certificate.

Hashing is one-way and collision-resistant (SHA-256); it proves integrity, not confidentiality, and must be salted for password storage.

Multi-factor authentication requires factors from at least two categories: knowledge (PIN/password), possession (token/device), inherence (biometric). Two passwords are not MFA.

Phishing defence stack: SPF, DKIM and DMARC for email authenticity; URL/domain reputation filtering; and user reporting with a monitored mailbox.

Patch management rule: critical and high-severity vulnerabilities on internet-facing systems are remediated within the shortest defined window; exceptions need documented risk acceptance.

Network segmentation places the card-data environment (CDE) in a separate zone; PCI DSS scope is reduced by isolating cardholder data from the general corporate network.

Incident response lifecycle: preparation, detection and analysis, containment, eradication, recovery, post-incident lessons learned; evidence must be preserved with chain of custody.

Digital channel risk categories: unauthorised access, transaction repudiation, data leakage, availability failure, third-party/vendor failure, and API abuse.

The 'man-in-the-browser' threat defeats OTP because malware alters the transaction inside the customer's browser after the OTP is validated; out-of-band confirmation of payee and amount is the mitigation.

Third-party risk rule: the bank remains accountable for outsourced activity; contracts must carry audit rights, breach-notification timelines, data-return/destruction clauses, and sub-contracting controls.

Data protection duties under India's DPDP Act 2023: purpose limitation, consent, data minimisation, breach notification to the Data Protection Board, and erasure on withdrawal of consent.

Log retention and monitoring: security logs, audit trails and transaction logs are retained per regulatory and evidentiary needs, protected against tampering (append-only or WORM).

Change management control: no code reaches production without testing, segregation between developer and deployer, and rollback plans; most digital outages trace to uncontrolled change.

Business continuity: define RTO (maximum tolerable downtime) and RPO (maximum tolerable data loss) per critical digital service, and test recovery at least annually.

Digital lending and onboarding risks: synthetic identity, deepfake/liveness bypass, document forgery, and device spoofing; mitigate with liveness detection, device fingerprinting, and geolocation checks.

KYC is risk-based: Customer Due Diligence intensity must match the assessed risk (low, medium, high), not be applied uniformly.

CDD minimum elements: identify the customer and verify identity, identify the beneficial owner, understand the purpose and intended nature of the relationship, and conduct ongoing monitoring.

Beneficial owner threshold for legal entities/arrangements in India: identification of the natural person holding 10% or more of shares or capital or profits, or exercising control.

Enhanced Due Diligence applies to high-risk categories: PEPs, customers in high-risk jurisdictions, complex ownership structures, and non-face-to-face onboarding.

PEP rule: senior political figures, their family members and close associates require EDD and senior-management approval; the risk continues after the person leaves office.

STR/STR filing: suspicious transaction reports go to FIU-IND; the tipping-off prohibition bars disclosing the report to the customer. Cash Transaction Reports apply to cash above the prescribed threshold.

Record retention: CDD records and transaction records are retained for at least five years after the business relationship ends or the transaction is conducted.

Screening mechanics: sanctions lists (UNSC, OFAC, domestic lists) are screened at onboarding and on every list update; name matching produces false positives that need documented adjudication.

Wire-transfer rule: originator and beneficiary information must travel with the payment; missing information triggers enhanced scrutiny and possible rejection.

Preventive vigilance aims to stop fraud before loss: it works through control design, staff awareness, rotation, and early-warning signals rather than post-facto punishment.

Job rotation and mandatory leave for staff in sensitive roles (cash, treasury, credit, IT operations) break long-running frauds that depend on one person's continuous presence.

Maker-checker is effective only if the checker independently verifies; rubber-stamping by a checker who trusts the maker is a control failure, not a control.

Dormant-account controls: no debit allowed without re-KYC/reactivation, and reactivation must be authorised at a level above the branch operator.

Early-warning signals in credit fraud: sudden limit utilisation, circular transactions among related parties, stock statements inconsistent with turnover, and repeated restructuring.

Vigilance awareness: whistle-blower channels with protection, confidential reporting, and non-retaliation policy are the detection backbone for insider collusion.

Segregation of the vigilance function from the business line it monitors prevents conflict of interest in investigating staff of the same unit.

Root-cause analysis after each fraud must name the failed control (design or operation) and produce an owner and deadline for remediation.

Investigation sequence: secure and preserve evidence, establish the timeline, identify the control failure, quantify the loss, then determine accountability and reporting obligations.

Digital evidence standards: forensic imaging of devices, hash verification, documented chain of custody, and logs from authoritative sources (not screenshots alone).

Reporting duties in India: frauds are reported to RBI (Fraud Monitoring System) in the prescribed format and timeline, and to FIU-IND where money laundering is suspected; cases are also lodged with police/CBI as applicable.

Classification of a fraud as 'fraud' versus 'technical write-off' or 'operative loss' matters: fraud classification triggers reporting, provisioning and staff-accountability consequences.

Red-flagged accounts: banks maintain a caution/red-flag registry so fraud-marked borrowers cannot access fresh credit across the system.

Staff accountability proceedings must follow natural justice: notice, opportunity to reply, and reasons recorded; procedural defects can overturn disciplinary action.

Recovery and restitution: insurance claims, chargeback/liability rules for card and digital transactions, and legal recovery run in parallel with the investigation.

Regulatory compliance is evidenced by documentation: the investigation report, board/committee minutes, and closure memos are what examiners verify, not intent.