Fraud Risk Management
Fraud Risk Management tests how a bank detects, investigates, reports and prevents fraud across accounts, cards, loans and channels. Expect questions on fraud typologies, early warning signals, transaction monitoring, mule accounts, STR filing and RBI's fraud reporting directions.
Core rules
- Typologies: phishing, vishing and smishing, SIM swap, ATM skimming and shimming, card cloning, account takeover, mule accounts, KYC fraud, insider fraud and CEO fraud.
- Prevention: CDD/KYC, transaction monitoring rules and scoring, device fingerprinting, velocity checks, beneficiary cooling periods, call-back verification for high-value payments and maker-checker.
- Reporting: classify frauds and report to the Board and RBI under the fraud directions; file a suspicious transaction report to FIU-IND within seven working days of establishing suspicion; preserve records.
- Investigation: root cause analysis, staff accountability, recovery and legal action, plus feedback into controls.
- Governance: a board-level fraud risk committee, whistleblower channel and fraud risk register.
Worked example
Twelve accounts receive UPI credits from many senders and immediately withdraw cash at the same ATM; all show one device ID. The reasoned response is to treat this as a mule-account pattern: freeze operations, preserve KYC and device logs, verify beneficial ownership, file an STR within seven working days, report confirmed fraud under RBI directions, and enhance monitoring. Closing accounts alone would destroy evidence and leave the network active.
Traps
Waiting for a customer complaint before acting; treating suspicion as proof and delaying the STR; ignoring staff collusion; missing reporting timelines; focusing only on recovery and not on root cause.