A fraud unravelling in Punjab and
Kerala has exposed a secret fear the country's banking system has been
living under for more than a year. Fraudsters appear to have stolen
crores of rupees from several Indian banks, cleverly exploiting a design
flaw in their automated teller machines (ATMs) and their networked
nature.
While several banks have executed design changes in their cash
machines to combat it, many of India's one-lakh plus cash machines still
remain vulnerable to this so-called 'transaction reversal' fraud.
The technique employed in the fraud is simple and involves withdrawing money from an
ATM machine,
taking out a part of the currency notes it throws up and letting the
machine swallow the rest. Since the machine cannot count the retracted
notes, some banks credit back the entire amount to the account.
So if a customer withdraws Rs 10,000, pockets Rs 9,000 and lets the
machine retract Rs 1,000, some banks record the transaction as null and
the entire Rs 10,000 remains in the account. Most ATMs are designed to
retract the cash if the customer does not pull it out within 42 seconds.
Kerala-based
Federal Bank
has lost Rs 75 lakh to a Punjab gang that attacked its ATMs across the
country using this method. Police in Kerala and Punjab made the first
arrests in such cases in the country this week. "The surge of such fraud
occurred in late March and April.
That is when it came to our attention. We have subsequently
scrutinised all transactions and filed more than 30 police cases across
the country," said TS Jagadeesan, chief general manager of Federal Bank.
Apart from various police stations in Kerala and Punjab, the bank has
filed criminal complaints in Coimbatore, Bangalore, Mumbai, Chandigarh,
Gurgaon and Panipat.
Police in Kerala and Punjab
have arrested six men from the north Indian state. Officials said the
accused had confessed to extracting Rs 2 crore using this method. This
means another bank or other banks together have lost as much as Federal
Bank just to this one gang.
The
gang, headed by one Sumit Gupta of Punjab, predominantly used ATM cards
procured from a leading private sector bank using forged documents, one
Kerala police official said. Cards of banks such as ICICI Bank,
HDFC Bank and
State Bank of India have been used by the gang, the official said.
The rise of
transaction reversal fraud
had caused so much concern that in January, National Payments
Corporation of India (NPCI), the intermediary for inter-bank
transactions, asked all member banks of the National Financial Switch to
disable the cash retraction facility from their ATMs.
The move was discussed and approved by the Reserve Bank of India.
The circular asked banks to comply by March 31. NCPI operates the
National Financial Switch that connects India's nearly Rs 1 lakh ATMs
(Rs 99,200 as of May; Rs 1,500 added each month).
NCPI Chief Executive AK Hota said the first such fraud was reported at an
ICICI Bank ATM in 2010. But the matter became more serious in 2011, when
Andhra Bank lost Rs 17-18 lakh to this method of fraud. Much of this was later recovered.
Subsequent to the Andhra Bank episode, a steering committee of the
National Financial Switch recommended in April last year that the cash
retraction feature in ATMs be deactivated.
During periodic cash
reconciliations in ATMs, banks were unable to ascertain whether the
shortage was due to ATM error, transaction reversal fraud, or fraud by
employees loading the cash. So a pilot study was undertaken and
disabling of cash retraction was found to be an effective way of
countering the fraud.
Even though NPCI asked all banks to comply by March, Hota said some
banks are yet to complete the exercise. The change involves upgrading
backend servers as well as changes in individual machines.
Depending
on the vendor and number of ATM machines owned by a bank, the cost of
this process worked out to Rs 800 to Rs Rs 2,500 per ATM. The ATM market
in India is dominated by American firms NCR and DieBold, as well as
Germany's
Wincor Nixdorf.