Mobile-number change, UPI fraud and event classification
A scheduled commercial bank with 1,200 branches and 4.8 million customers receives 37 complaints on a Monday morning. Customers report UPI debits they did not authorise, totalling INR 6.2 million. All 37 accounts had their registered mobile numbers changed at two branches during the previous 10 days. The bank's cyber team finds no compromise of the core banking system; the transactions were initiated through a third-party UPI application and settled normally. The fraud team suspects SIM-swap or social engineering, but the investigation is incomplete. The bank's operational risk committee must decide how to classify and scope the event, whether it is a fraud, cyber, or operational risk loss, which controls failed, and what customer redress and regulatory reporting should follow. The bank also has a pending application to expand digital onboarding, so the committee is worried about reputational and supervisory consequences.
1. How should the committee classify and scope this event? Explain your reasoning and identify any overlapping risk types.
Read the worked answer
Classify it as an operational risk event with two overlapping sub-risks: external fraud and information security/cyber. It is not a credit loss because no borrower has defaulted, and not market risk. The fact that the core banking system was not compromised does not remove operational risk; external fraud and customer-facing payment channel failures are squarely within operational risk.
Scope should include all 37 accounts, the two branches that changed mobile numbers, the third-party UPI app interface, and any similar accounts with recent mobile-number changes. Treat the INR 6.2 million as gross loss before recovery, with possible additions for compensation, legal costs and investigation. Because root cause is unresolved, record it as a fraud/cyber incident with a provisional cause, not as customer negligence. If the bank later finds staff collusion or a control failure, the classification may add an internal fraud/execution dimension. Report through the operational risk, fraud and cyber incident channels so the event is not split into small complaints and lost from aggregate loss data.
2. Which controls failed or need testing, and what preventive actions would you prioritise in the next 30 days?
Read the worked answer
Prioritise controls around contact-data changes and payment authorisation. The two-branch cluster suggests branch verification failed: require in-person or video verification, maker-checker, a cooling period before UPI activation, and an alert to the old number. At the app layer, test device binding, SIM-swap detection, velocity rules and step-up authentication. Re-screen all accounts whose mobile number changed in the last 30 days and sample branch records for forged documents or staff override.
Because the third-party app initiated transactions, obtain its authentication and device logs; do not accept a vendor statement that settlement was normal. Set a temporary cap on high-risk accounts and monitor them. Assign owners and dates, and report completion to the operational risk committee. These are preventive and detective controls, not just customer awareness. The pending digital onboarding expansion should be paused or made conditional on closure of the contact-data and device-control gaps.
3. What customer redress and regulatory or law-enforcement handling should the committee approve, and what should it avoid saying publicly?
Read the worked answer
Approve provisional refunds or credits for affected customers subject to investigation, with clear terms that do not admit liability before root cause is known. Preserve logs, device IDs, call recordings and branch records. File a suspicious transaction report where the bank's policy and applicable rules require it, and report the incident to regulators and law enforcement within the bank's stated timelines.
Communicate facts, the complaint route and expected timelines. Avoid blaming SIM-swap or customer negligence publicly while the investigation is open. Do not say the bank is 'fully secure' or that all accounts are unaffected. Track complaints and refunds as part of the event loss. The committee should also consider whether branch staff followed the mobile-number change procedure and whether the third-party app's controls meet the bank's standards.