Cyber Crimes and Fraud Risk Management
What the exam tests
Cyber Crimes and Fraud Risk Management tests whether you can classify cyber-enabled frauds, apply the RBI fraud-reporting discipline, and connect a customer loss to the correct liability and reporting route.
Core rules
- Typologies include phishing, vishing, smishing, SIM-swap, OTP interception, UPI collect-request fraud, QR-code substitution, ATM skimming, BIN attack and account takeover.
- RBI's Master Direction on Fraud Classification and Reporting (July 2024) requires a board-approved fraud risk management policy, early warning signals (EWS), red-flagged accounts (RFA), reporting to CRILC and a Fraud Monitoring Return to RBI. Fraud is classified on detection, not on NPA recognition.
- Victims report cyber fraud on NCRP (cybercrime.gov.in / 1930); banks use CFCFRMS to trace and freeze funds; I4C coordinates nationally.
- Liability follows RBI's 2017 customer-protection circular: zero liability where the customer is not negligent and reports within three working days; limited liability on a graduated scale after that; negligence can shift loss to the customer.
Worked example
A customer approves a UPI collect request for ₹9,999 believing it is a refund, then reports on day four. Because the customer authorised the collect request, negligence is arguable, so zero liability is not automatic. The bank must log the case, attempt recovery through CFCFRMS, and check whether the beneficiary account is mule-operated. The root cause is customer awareness plus controls on collect-request velocity.
Traps
Do not confuse NCRP (victim reporting) with CFCFRMS (bank-side freezing). Do not treat every unauthorised transaction as zero-liability. Do not ignore attempted frauds, and do not miss the 21-day fraud-reporting discipline under the 2024 Master Direction.