Parliamentary panel rejects govt response on cyber fraud, says it fails to plug key gaps
New Delhi, August 13
A Parliamentary Standing Committee on Finance has rejected the government's response on tackling cyber-enabled financial fraud, saying the measures outlined by the Department of Financial Services remain largely procedural and fail to address critical operational gaps, particularly in preventing fraudulent funds from being siphoned through mule accounts.
In its 44th Report on action taken by the government on its earlier recommendations concerning the Department of Financial Services, the committee said cyber-enabled financial crimes have become increasingly sophisticated, including digital arrest scams, phishing and investment frauds.
The committee had earlier called for stronger accountability of banks, real-time coordination between banks and enforcement agencies and technology-led measures to stop fraudulent transactions.
The Department of Financial Services, in its response, highlighted several measures already in place to combat such frauds. These include banks' use of Artificial Intelligence and Machine Learning tools, the Reserve Bank of India's 'MuleHunter' system to identify suspected mule accounts, NPCI's fraud monitoring solution for UPI transactions, as well as the National Cyber Crime Reporting Portal and the 1930 helpline.
However, the Parliamentary panel was not satisfied with the response.
"The Committee, however, are constrained to observe that the Department's reply remains largely procedural and fails to offer effective solutions to plug critical operational gaps," the report said.
A key concern raised by the panel is the lack of direct accountability for banks where mule accounts are maintained.
The committee noted that under the proposed compensation framework, 65 per cent of compensation payouts would be assigned to the RBI while beneficiary banks would bear only a 10 per cent burden.
According to the panel, this creates a "severe moral hazard" and does not adequately hold receiving institutions accountable when they host mule accounts.
The panel also flagged the failure to address the so-called "Golden Hour" in cyber fraud cases -- the critical three-to-four-hour window during which fraudulent funds can potentially be frozen and recovered.
It said the Golden Hour is "frequently lost" because victims may delay reporting fraud and local law enforcement agencies, particularly at the district level, often lack the technological capability and specialised training required to coordinate with banks and stop transactions in real time.
The committee further observed that retrospective Suspicious Transaction Reports (STRs) and broad advisories issued to banks do not solve the Golden Hour problem or create sufficient deterrence against negligent KYC verification at the branch level.
The panel has therefore called for a recalibration of the proposed liability framework to impose a substantial loss-sharing burden on banks found to be harbouring mule accounts.
It recommended that the Department of Financial Services and RBI establish a "Penal Framework for Negligent Branches", under which banks hosting multiple mule accounts would be penalised and held accountable for KYC lapses.
— ANI
Reader Comments
The "Golden Hour" concept is interesting but seems impractical. If the victim doesn't report within 3-4 hours, which most people don't because they're in shock, how exactly do you expect banks to freeze funds? The real issue here is the lack of 24/7 coordination between law enforcement and banks, especially in smaller towns. More awareness campaigns needed.
As someone who works in a bank, I can tell you the ground reality is messy. Branch managers are scared to freeze accounts without proper legal backing, and by the time all the paperwork is done, money is gone. The committee is right about the moral hazard - if banks aren't penalised for negligence, what's the incentive to improve KYC? We need faster courts for these cases too.
Meanwhile my 70-year-old neighbour almost fell for a "digital arrest" scam last month. These fraudsters are getting so sophisticated, they even know your Aadhaar details. The committee should also look at why India Post Payments Bank branches don't have proper cybersecurity training. Every district needs at least 2-3 specially trained cyber crime officers, not just in metro cities.
The 65% burden on RBI seems odd to me. Isn't RBI the regulator, not the one who opens accounts? The accountability should be on the banks that actually allowed the mule accounts to exist. Also, why isn't there a mandatory 2-hour response SLA for all banks in the network? This "Golden Hour" approach needs teeth.
I appreciate the committee's stance,
We welcome thoughtful discussions from our readers. Please keep comments respectful and on-topic.