Sixty-Two New Accounts, Night-Time Cash-Out and a Fourteen-Month STR Gap
On 14 June the analytics team of a mid-sized private bank runs an ad hoc query after a customer complaint and finds 62 accounts opened in the previous 90 days across three branches sharing an unusual pattern: credits of Rs 15,000 to Rs 22,000 arrive from five payment aggregator settlement accounts, and 85-95% of each credit is withdrawn in cash at ATMs or business correspondent points within 40 minutes, mostly between 22:00 and 01:00. Aggregate inflow is Rs 1.11 crore. All 62 accounts were opened using Aadhaar-based e-KYC; 4 show the same device ID at onboarding and 11 share three mobile numbers. The transaction-monitoring rule flags 'high velocity, low value' only above Rs 50,000 per day, so none of these generated an alert. One account belongs to the brother-in-law of a branch employee; the branch manager describes all 62 customers as small traders and asks that the accounts not be frozen during a local festival. No STR has been filed by the bank in the last 14 months.
1. What is the likely scheme, and what evidence would confirm or refute it before you freeze 62 accounts?
Read the worked answer
Likely scheme: mule accounts layering the proceeds of cyber fraud. The signature is the shape of the money, not the amount: credits from aggregator settlement accounts (so the original payer is hidden behind a merchant ID), 85-95% leaving within 40 minutes as cash (fast, and cash breaks the trail), at night when genuine retail deposits are unusual, across 62 accounts opened in 90 days (a recruitment campaign, not organic growth). Shared device ID on four accounts and three shared mobile numbers across eleven are the strongest single indicators - genuine small traders do not onboard on each other's phones.
Evidence to gather first:
- Full statements for all 62, with the source of each aggregator credit and its merchant/PA reference; request the underlying payer records from the five payment aggregators.
- Onboarding artefacts: device ID, IP, geolocation, e-KYC liveness images, PAN-Aadhaar demographic consistency, selfie match.
- Cash-out locations and timestamps, and whether the same ATMs or BC points recur.
- Whether any account has a genuine trading footprint - GST registration, shop address, recurring utility payments, regular supplier credits.
- A control group of 200 accounts of similar vintage and profile that were not flagged, to test whether the pattern discriminates or merely describes poor customers.
What would refute it: a legitimate cash-heavy business with daytime, steady withdrawals and verifiable trade references. Night-time near-total cash-out is inconsistent with that, but the control group is how you avoid freezing 62 vegetable vendors on a hunch.
2. Freeze or not? Set out the decision framework, customer-impact safeguards and internal escalation, including the staff link.
Read the worked answer
Freezing all 62 immediately is a big hammer and the wrong first move. A freeze is visible to the customer, generates grievances and creates liability if wrong; a lien or a block on further credits achieves most of the protection with less collateral damage.
Risk-based tiers:
- Tier 1 - lien/freeze: the 4 sharing a device ID, the 11 sharing mobile numbers, and any where the aggregator confirms a fraud-reported payer source. These are almost certainly mules.
- Tier 2 - block new credits, monitor: behavioural pattern but no hard link. Block inflows rather than the balance, so genuine balances are not stranded.
- Tier 3 - watch: the remainder, with daily review for 30 days.
PMLA obligations, where candidates go wrong: an STR is required on suspicion regardless of amount; there is no Rs 10 lakh threshold for suspicion (that is the cash transaction report threshold). File promptly per the bank's AML policy and current FIU-IND guidance on timelines.
Do not tip off. Section 66 PMLA prohibits disclosure; the branch manager must not be told why, only what to do, and must not contact the account holders.
Staff link: the brother-in-law account goes immediately to vigilance/disciplinary handled outside the branch, with evidence preserved. Do not let the branch manager 'handle it locally'.
Festival pressure is not a factor in the decision, but it is a factor in the communication plan: Tier 2 customers need an explanation and a grievance channel.
3. What were the root causes, and how would you redesign onboarding, monitoring and staff accountability?
Read the worked answer
Three failures, in order of severity:
- The monitoring rule was designed around amount, not behaviour. A Rs 50,000 per day threshold misses mule activity entirely because mules keep amounts small deliberately. Rebuild on: cash-out ratio (over 80% within two hours), time of day, account age under 90 days, concentration of inflow sources, and device/mobile reuse across accounts. Link accounts by device, mobile and beneficiary, not only by customer.
- Onboarding did not use the data it already held. Aadhaar e-KYC returns demographic and device data; four accounts on one device at onboarding is a hard stop that should have been a rule. Add one-device-to-many-accounts velocity, mobile-number reuse, IP reputation, and liveness re-check on high-risk profiles.
- The STR gap is a compliance failure, not a data gap. Fourteen months with no STR in a bank of this size is implausible and will be the regulator's first question. Review STR quality and volume, back-test 12 months of alerts, and report to the audit committee.
Governance: quarterly mule typology review across fraud and AML teams; alert triage SLA and false-positive measurement; board fraud committee MIS covering detection, loss and recovery; and a confidential route for staff approached to open or rent accounts - the brother-in-law case suggests recruitment has already reached inside the perimeter.
One line for the board: the bank detected this through a customer complaint, not through monitoring. That is the finding.