Frauds and Cybersecurity in Banking

In one line

Bank fraud is committed by outsiders, by borrowers and by the bank's own staff, and the law answers it with reporting duties, a classification that carries serious consequences, and a customer liability framework that puts the loss where it can be prevented.

In the wording a student can write in an exam: the Reserve Bank's Master Directions on Frauds, issued under section 35A of the Banking Regulation Act, 1949, require banks to classify frauds by category and to report them to the Reserve Bank and to the investigating agencies; classification as a fraud debars the borrower from raising bank finance for five years, and in State Bank of India v. Rajesh Agarwal, decided on 27 March 2023, the Supreme Court held that the rule of audi alteram partem must be read into those Directions before an account is so classified.

Three kinds of fraud, and why the distinction decides the law

An answer that treats fraud as one subject will not do, because the legal response to each kind is quite different.

Fraud on the customer by an outsider. Somebody obtains the customer's credentials and takes his money. The question is who bears the loss between the bank and the customer, and chapter 600's customer liability framework of 6 July 2017 answers it.

Fraud on the bank by a borrower. The borrower obtains credit by misrepresentation, diverts the funds, fabricates the stock statements chapter 490 describes, or sells the hypothecated security. The question is classification and its consequences, which chapter 530 works and Rajesh Agarwal controls.

Fraud on the bank from inside. An employee misuses his access, colludes with a borrower, or issues instruments without authority. The question is internal control, audit and supervision, and it is the category that produces the largest single losses.

And the common legal thread, which is the point to make, is the one chapter 450 established through Canara Bank v. Canara Sales Corporation, (1987) 2 SCC 666: the bank may debit its customer only on a mandate, and a forged signature is no mandate. Every fraud question in this subject is ultimately a question about authority.

The reporting and classification regime

Its source. The Reserve Bank's Master Directions on Frauds, issued under section 35A of the Banking Regulation Act, so they are binding directions and their breach is a contravention, exactly as chapter 530 records for the prudential norms.

Classification by category. Banks classify frauds under heads broadly following the penal law: misappropriation and criminal breach of trust; fraudulent encashment through forged instruments, manipulation of books of account or through fictitious accounts and conversion of property; unauthorised credit facilities extended for reward or for illegal gratification; negligence and cash shortages; cheating and forgery; irregularities in foreign exchange transactions; and any other type of fraud not coming under the specific heads.