Ninety-six remittances before dawn, a phishing page and a spreadsheet sent to Gmail
On a Saturday morning the security operations centre notices that three employees at a Coimbatore branch approved 96 outward remittances totalling ₹27.4 lakh from 96 different customer accounts between 02:10 and 04:40, all to two beneficiary accounts at another bank. The investigation shows a phishing page cloned the bank's intranet login and one employee's captured credentials were used from an unrecognised IP address. Three days earlier a spreadsheet containing 96 customer names, account numbers and mobile numbers was emailed from a branch terminal to an external Gmail address. Two teller machines had a free screen-sharing tool installed after a caller posing as a vendor 'helped' staff resolve a printer fault. Customers begin calling the branch at 09:30. The bank's Chief Information Security Officer wants to know what gets reported, to whom, and in what order.
1. Set out the reporting matrix for this incident: which regulators, which timelines, and why each obligation is separate.
Read the worked answer
Several clocks start at confirmation, and none substitutes for another.
- Reserve Bank of India. A cyber incident of this nature is reportable under the Cyber Security Framework in Banks within 2 to 4 hours of detection, followed by a formal incident report and root cause analysis. Delay because 'the facts are still unclear' is not a defence; the framework expects early notification and updating.
- CERT-In. Under the 2022 directions, report within 6 hours of noticing the incident, covering unauthorised access, identity theft and phishing. Preserve all logs for 180 days, stored within India, and do not wipe the affected machines.
- FIU-IND. The 96 debits moving through two mule-beneficiary accounts are a suspicious transaction; the STR is due within seven days of the branch concluding suspicion. It is a separate filing from the cyber report, on a separate form, with a different narrative - the cyber report describes the intrusion, the STR describes the money.
- Data Protection Board and data principals. The exported spreadsheet is a personal data breach. As Data Fiduciary the bank must notify the Board and each affected individual without delay, describing the nature and extent of the breach, the likely consequences and the mitigation, and must maintain a record of the breach.
- Police. An FIR for unauthorised access, phishing and cheating.
Sequence: contain first - block the two beneficiary accounts, disable the three credentials, terminate live sessions, isolate rather than wipe the teller machines, image them for forensics - then notify, then remediate. Reporting obligations run in parallel, and the incident log should timestamp each notification.
2. The bank must now remediate 96 customers. What is the correct approach, and what root causes and controls would you put to the IT Strategy Committee?
Read the worked answer
Customer remediation. Reverse and credit the 96 debits within the ten-working-day standard for unauthorised electronic transactions, and do not run the 'OTP was used' defence: the OTP was harvested through a compromised bank channel, so the bank's own platform was the vector and liability sits with the bank. Write to each customer, in the language they bank in, confirming the reversal, the action taken and a contact point; issue fresh credentials; and watch the accounts for repeat attempts. Handle the affected customers' calls through a single scripted desk rather than leaving each branch to improvise.
Root causes, each tied to a control.
- Free screen-sharing tool on teller machines - a breach of endpoint and application policy. Remedy: application allow-listing, blocked installs, and periodic asset scanning.
- No alert on 96 remittances in 150 minutes to two beneficiaries - the monitoring thresholds are set per transaction, not per beneficiary concentration. Remedy: velocity and concentration rules, plus a cooling period for newly added beneficiaries.
- Customer data exported and emailed to Gmail - no data loss prevention, and no restriction on external mail from branch terminals. Remedy: DLP, allow-listed recipients, USB and mail controls, and data minimisation so a branch does not hold a 96-record extract in the first place.
- Phishing domain not detected - no domain monitoring or takedown process. Remedy: brand-domain monitoring, takedown SLA, and simulated phishing for staff.
Report to the IT Strategy Committee and the Audit Committee with a dated action plan, an owner per item, and a lessons-learnt note; also lodge the cyber insurance claim within the policy's notification window and preserve the forensic report.