Daybreak - What a cyber criminal told us about KYC frauds

Episode Date: March 19, 2024

More than 70% of fraudulent banking transfers in India are KYC-linked scams. A senior official at the Financial Intelligence Unit, a national agency responsible for analysing data on suspect financial transactions informed The Ken that KYC frauds amount to over Rs 900 crore ($108 million) per year.One such fraudster who spoke to us on the condition of anonymity said, ““KYC is an easy trick to pull off. People have heard about banks freezing accounts due to non-compliance with KYC norms. So they get convinced, particularly those in smaller towns and cities.” In a span four years, this fraudster’s gang has stolen nearly Rs 50 lakh.But the whole point of banks carrying out the elaborate KYC process is to protect their customers from fraud. How is then that this very process accounts for nearly two-thirds of fraudulent banking transfers in India?Tune in.

Hi, this is Rohan Dharma Kumar. If you've heard any of the Ken's podcasts, you've probably heard me, my interruptions, my analogies, and my contrarian takes on most topics. And you might rightly be wondering why am I interrupting this episode too. It's for a special announcement. For the last few months, I and Sita Ramon, Ganesh, my colleague and the Ken's deputy editor, have been working on an ambitious new podcast. It's called Intermission.

We want to tell the Sita Ramancahans, my colleague. secret sauce stories of India's greatest companies. Stories of how they were born, how they fought to survive, how they build their organizations and culture, how they managed to innovate and thrive over decades, and most importantly, how they're poised today. To do that, Sita and I have been reading books, poring over reports, going through financial statements, digging up archives, and talking to dozens of people. And if that wasn't enough, we also decided to throw in video into.

to the mix. Yes, you heard that right. Intermission has also had to find its footing in the world of multi-camera shoots in professional studios, laborious editing, and extensive post-production. Sita and I are still reeling from the intensity of our first studio recording. Intermission launches on March 23rd. To get an alert, as soon as we release our first episode, please follow Intermission on Spotify and Apple Podcast. or subscribe to the Ken's YouTube channel. You can find all of the links at the ken.com slash I am. With that, back to your episode.

Prakash is a 27-year-old man and he is saving money to go to Kota. Now, you might think, all right, he probably wants to go there to prepare for some entrance exam. After all, the city in Rajasthan is called the Coaching Capital of India. But, you're wrong. Prakash wants to go to Kota because he wants to. wants to upskill his financial fraud game. Yes, you heard that right. Kota, aside of being the hub for entrance exam preparations,

happens to be a great place to train in cyber fraud. Right now, though, Prakash is like a rolling stone. One day he is selling milk in Mathura, and another day he is working at a food joint in Bharatpur. And soon, he is going to be in Haryana's new doing God knows what. The point is, all of these changing professions, are just his covers. His actual job at which he is sufficiently proficient

is stealing money from bank customers under the pretext of updating their New York customer details or KYC. The irony, as you can see, is far from lost. Because the whole point of banks carrying out that elaborate KYC process is to protect their customers from fraud. And banks take it very seriously because the RBI or the Reserve Bank of India is constantly watching them with the eyes of a hawk. Even a tiny mistake can cost the bank's hefty fines.

Ask Access Bank, City Bank, or for that matter, even fintech companies like P.T.M. and Amazon Pay. So how is it then that this very process is responsible for over 70% of fraudulent banking transfers in India? To the tune of 900 crore rupees every year. Welcome to Daybreak, a business podcast from The Ken. I'm your host, Nick Dar Sharma, and I Don't Chase News Cycle. Instead, thrice a week on Mondays, Wednesdays and Fridays, I will come to you with one business story that is worth understanding and worth your time. Today is Wednesday, the 20th of March.

For this story, one of my colleagues at the Ken tracked all the KYC-driven fishing messages pretending to be from various financial institutions between November 2020. and February 2023. And they found 15 such attempts. And my colleague, the Ken reporter, Ronak Kumar Gunjan, actually spoke to Prakash over phone. Obviously, Prakash is not his real name. But he did tell Ronak in great detail

about how he steals people's money using KYC. You see, KYC is associated with the emotion of fear. Fear that if you don't complete it, your bank account will be blocked. or frozen. And this holds too, especially for those who live in smaller cities, towns and villages, those who are not very financially literate. Now, unfortunately, they are the main target for fraudsters like Prakash. Prakash is a part of a 12-member gang that calls victims pretending to be bank executives and tricks them into giving out all their sensitive financial information.

In a span of four years, this gang has stolen nearly 50 lakh rupees. Prakash says, and I'm quoting, KYC is an easy trick to pull off. People have heard about banks freezing accounts due to non-compliance with KYC norms. So they get convinced, particularly those in small towns and cities, end quote. And it is understandable because there are so many instances of big banks like SBI freezing accounts on the basis of non-completion of KV. Just in the last three years alone, the RBI itself has come up with six KYC related regulations, and it is dead serious about them.

It has slapped some seriously heavy penalties on some banks and payment processing companies. So actually, what these fraudsters are doing is just weaponizing and benefiting from the fuel that the banks themselves have ended up creating. To get a sense of the scale of KYC linked scams, the Ken spoke with a senior official at the Financial Intelligence Unit, which is a national agency responsible for analyzing data on suspicious financial transactions. The official told us that on an average, cyber departments across the country get calls to block fraudulently transfer amounts that adds up to nearly three to four crore rupees every single day. And almost two-thirds of these frauds are KYC scams.

And these are just the recorded cases. Now, thanks to increased vigilance lately on part of banks and the police, Prokasha's gang has not been making as much this year. So they are thinking of a new, horrifying but common fraud idea. Sex-Tortion. But Prakash thinks it's too tedious, which is why he wants to save up to educate and upscale himself so he can commit more sophisticated cyber frauds. His plan is to join a syndicate that runs emails and SMS fishing rackets.

If he's successful, Prakash's plan will introduce him to a far more organized and well-funded machinery that relies on technology to cheat. And for this, Kota is the place to be. A Haryana cop told again that the fee for cybercrime training starts at 15,000 rupees and goes up to as much as 2 lakh. The duration of the course varies from three months to a whole year. And the trainers? They include people from large call centers, data analysts, coders from well-established companies. So you can imagine how difficult it is for banks to identify fake applications despite having anti-fraudy.

And a part of this is because of the nature of the identity documents that we use. Except for the passport, all Indian IDs are self-declared. There is no physical verification involved. Which is why, for scammers, it is pretty easy to forge documents and get past the KYC restrictions of lenders. So to wrap it all up, if you think about the whole thing for a second, it all comes down to fear. The bank's fear of the RBI and the customer's fear of the BORBI and the customer's fear of the

bank. It is a trickle-down effect. So maybe the RBI should start asking banks to stop the threat of freezing or closing a bank account due to KYC lapses. The good news is that a panel has actually already made this suggestion to the RBI. Daybreak is produced from the Newsroom of the Ken India's first subscriber-focused business news platform. What you're listening to is just a small sample of our subscriber-only offerings. A full subscription unlocks daily long-form feature stories, newsletters, subscriber-only apps and podcast extras. Head to the ken.com and click on the red subscribe button on the top of the website. I am Snidtharma, your host and today's episode was edited by my colleague Rajiv Sien.