An RMAI Risk analysis of the Punjab National Bank Greater Noida fraud investigation, examining operational risk, fixed deposit controls, employee access, early warning indicators, concurrent audit and RBI’s 2026 fraud risk management framework.
1. What Happened at Punjab National Bank’s Greater Noida Branch?
The Central Bureau of Investigation (CBI) has registered a case concerning alleged unauthorised transfers from customers’ savings accounts and fixed deposits at Punjab National Bank’s Sector Pi branch in Greater Noida, Uttar Pradesh.
According to media reports published on 30–31 October 2026, the bank’s complaint identified approximately ₹10.24 crore in suspected unauthorised debits. The irregularities may have continued for nearly three years before being detected.
The complaint reportedly alleges that a branch employee misused Core Banking Solution (CBS) user IDs and passwords belonging to other officials to perform unauthorised banking transactions.
Preliminary findings also indicated suspected manipulation of fixed deposit records, premature closure of deposits, changes to customer account details and diversion of funds to beneficiary accounts.
The case is being investigated by the CBI, and the final amount involved has not yet been determined.
Incident Snapshot
| Particulars | Reported information |
|---|---|
| Bank | Punjab National Bank |
| Branch | Sector Pi, Greater Noida |
| Reported irregularities | Approximately 2023–2026 |
| Amount identified in bank complaint | ₹10.24 crore |
| Accounts affected | Customer savings and fixed deposits |
| Suspected methods | Credential misuse, account manipulation, unauthorised transfers |
| Investigation | CBI Anti-Corruption Branch, Ghaziabad |
| Customer claims settled | 3 claims totalling ₹43 lakh |
| Final financial impact | Under investigation |
Earlier customer allegations involved substantially larger amounts. Separate media reports referred to complaints exceeding ₹11.24 crore and local estimates approaching ₹35 crore.
These figures arise from different reports and stages of the investigation and should not be treated as interchangeable.
The ₹10.24 crore figure represents the amount identified in the bank’s complaint as reported by the CBI case coverage, not a final judicially established loss.
2. How Was the Alleged Fraud Discovered?
One of the most important aspects of this case is the reported sequence of detection.
According to the complaint cited in media reports, the suspected irregularities came to light after a customer approached the branch head on 16 September 2026 concerning three doubtful debit transactions.
The matter prompted further examination of banking records, user activity and related transactions.
The subsequent review reportedly identified multiple unauthorised transactions involving the use of CBS credentials assigned to different branch officials.
Reported Sequence of Events
| Period | Development |
|---|---|
| Approximately 2023–2026 | Period during which the suspected irregularities may have occurred |
| 16 September 2026 | Customer complaint concerning three suspicious debits |
| September–October 2026 | Review of transactions, CBS user records and affected accounts |
| 23 October 2026 | Written complaint reportedly sent to CBI by PNB’s Noida Circle |
| 29 October 2026 | CBI registers FIR; PNB publicly addresses customer claims |
| 30–31 October 2026 | Further details emerge regarding suspected credential misuse and FD manipulation |
The Critical Risk Management Question
Why did the reported irregularities apparently require a customer complaint to trigger wider detection?
A customer complaint is an important fraud-detection channel, but it should not be the only mechanism available to a financial institution.
Banks also rely on automated transaction monitoring, exception reports, branch supervision, reconciliations, internal audit and suspicious activity reviews.
The reported detection timeline therefore warrants examination of whether earlier unusual transactions generated alerts, whether those alerts were reviewed and whether any control exceptions were escalated.
It does not, by itself, establish that those controls were absent or deliberately ignored.
3. Understanding the Alleged Modus Operandi
Based on the bank’s complaint as reported publicly, the suspected activities involved several distinct banking processes.
A. Misuse of Core Banking Credentials
The complaint reportedly indicates that the user IDs and passwords of multiple banking officials were used to execute transactions.
Every employee using a CBS platform should have a unique identity, clearly defined permissions and an auditable record of activities performed.
Where credentials are shared, stolen or otherwise misused, the reliability of user-level accountability becomes weaker.
The bank must then establish whether a transaction was genuinely authorised by the assigned official or executed by another person using that official’s credentials.
Control questions:
- Were CBS access rights limited to approved responsibilities?
- Were transactions linked to verified individual users?
- Could credentials be used from unexpected workstations?
- Did the system identify unusual account access patterns?
- Were privileged activities independently monitored?
The available information does not establish exactly how the credentials were obtained or whether the relevant access controls were circumvented.
B. Fixed Deposit Record Manipulation
Reports of the complaint describe suspicious modifications to fixed deposit information.
These allegedly included adding or changing account holders, altering the destination account for maturity proceeds and prematurely closing fixed deposits.
Such activities are particularly sensitive because fixed deposits may remain untouched by customers for extended periods.
A bank should therefore treat changes to fixed deposit ownership, settlement instructions and premature closure arrangements as high-risk events requiring appropriate verification.
C. Diversion Through Beneficiary Accounts
The alleged movement of proceeds to accounts linked to suspects introduces an additional risk: funds may be transferred through accounts that appear operationally legitimate but have no authorised economic relationship with the original depositor.
Monitoring should consider unusual beneficiary relationships, transaction frequency, common destination accounts and rapid onward transfers.
D. Reported Modification of Customer Alerts
Media reports also describe allegations that mobile transaction notifications were disabled or altered for certain customers.
Transaction alerts are an important customer-facing detective control.
If alert settings can be modified without effective customer verification, an additional warning mechanism may become ineffective.
However, the investigation must establish how any changes were made, by whom and whether established verification procedures were followed.
4. Five Internal Control Risks Highlighted by the Case
This incident illustrates the importance of examining banking controls as an integrated system rather than reviewing each process independently.
Risk 1: Identity and Access Management
A banking user’s credentials should not automatically be treated as proof that the assigned employee performed a transaction.
Appropriate safeguards include individual credentials, role-based access, secure authentication, session monitoring and periodic reviews of access rights.
Banks should pay particular attention to sensitive transactions performed outside an employee’s normal duties.
Risk 2: Segregation of Duties and Maker-Checker Controls
The maker-checker principle separates transaction initiation from independent verification and approval.
For high-risk activities, it is important to ensure that the approving official is genuinely independent and that the approval is supported by evidence.
An effective review should test the complete approval chain rather than merely checking whether two different user IDs appear in system records.
Key question: Can the bank demonstrate that the maker and checker were two independently authenticated and authorised individuals?
Risk 3: Fixed Deposit Administration
Changes to fixed deposit ownership, maturity instructions and premature closure arrangements should be supported by appropriate customer requests and approved documentation.
Banks should independently monitor unusual patterns, including repeated premature closures, changes to joint holders and redirection of proceeds.
Risk 4: Customer Contact and Alert Controls
Changes to registered mobile numbers, notification preferences and customer contact details should trigger appropriate verification.
Where practical and consistent with security requirements, banks should maintain an independently controlled notification or confirmation mechanism for sensitive changes.
Risk 5: Continuous Fraud Monitoring
A transaction may be individually within an employee’s authority while still forming part of an unusual pattern.
Banks therefore need monitoring that considers cumulative behaviour across customers, employees, branches and beneficiary accounts.
Understand Internal Controls and SOX Compliance through our certificate course.
5. Fraud Risk Indicators Banks Should Monitor
The reported allegations suggest several useful Early Warning Signals (EWS) for deposit and branch operations.
The following indicators are proposed for professional risk assessment and are not established findings about PNB’s actual monitoring systems.
| Early warning signal | Potential risk indicated |
|---|---|
| One employee accesses unusually large numbers of unrelated customer accounts | Possible inappropriate account access |
| Repeated transactions using credentials of different officials from the same workstation | Potential credential misuse |
| Frequent premature closure of high-value fixed deposits | Unusual deposit activity |
| Change in FD settlement account shortly before closure | Possible redirection of proceeds |
| Addition of joint holders followed by substantial withdrawals | Potential account manipulation |
| Transaction alert settings modified before large debits | Possible interference with customer notifications |
| Multiple unrelated customer accounts transferring to common beneficiaries | Potential fund diversion or linked activity |
| Transactions with incomplete supporting vouchers or approvals | Documentation and authorisation risk |
| Repeated high-risk actions concentrated among a small group of users | Possible concentration of operational control |
| Unresolved exceptions recurring over several reporting periods | Possible monitoring or escalation deficiencies |
These indicators should be assessed together with the bank’s transaction volumes, customer profiles and operational processes.
The purpose of an EWS framework is to identify unusual activity requiring investigation, not to automatically classify every exception as fraud.
6. What Should Concurrent Auditors Have Been Testing?
Concurrent audit is particularly relevant because it is intended to reduce the interval between a banking transaction and its independent examination.
The RBI’s Commercial Banks – Concurrent Audit Directions, 2026, issued on 31 July 2026, identify areas such as transaction monitoring, customer accounts, reconciliation, employee conduct, regulatory compliance and internal controls for risk-based audit coverage.
The framework also requires important audit deficiencies to be escalated and fraudulent transactions detected during concurrent audit to be reported promptly.
A. Fixed Deposit Audit
A risk-based audit should examine:
- Premature closure of high-value or long-standing deposits.
- Changes to deposit ownership and settlement instructions.
- Supporting customer requests and authorisation documents.
- Whether proceeds were credited to appropriate accounts.
- Repeated closures involving common employees or beneficiaries.
B. CBS User Activity Audit
An audit of CBS user activity should include:
- Access rights granted to individual employees.
- Transactions performed under privileged or sensitive user roles.
- Suspicious workstation or session activity.
- Unusual combinations of transaction initiation and approval.
- System access inconsistent with assigned responsibilities.
C. Customer Information Modification Audit
Auditors should assess whether changes to customer information were supported by valid requests.
Particular attention should be given to changes in mobile numbers, account-holder details and payment instructions shortly before substantial transfers.
D. Transaction Voucher and Documentation Audit
A transaction should be supported by appropriate underlying documentation and authorisation.
Auditors should investigate discrepancies between system records and physical or electronic vouchers, including missing evidence, retrospective approvals and unusual correction entries.
Practical Audit Testing Matrix
| Audit area | Suggested test | Evidence to examine |
|---|---|---|
| CBS credential controls | Identify unusual logins and activities across user IDs | Authentication logs, access records, workstation details |
| Maker-checker controls | Reconstruct initiation and approval of sensitive transactions | CBS audit trails, approvals, transaction timestamps |
| Fixed deposit closure | Review high-risk premature closures | FD records, customer instructions, approval evidence |
| Customer details | Identify changes preceding large fund transfers | Master-data change logs and supporting documents |
| Beneficiary transactions | Identify common beneficiaries receiving funds from unrelated customers | Transfer records and beneficiary account details |
| Customer alerts | Review changes to contact and alert settings | Customer master records and notification logs |
| Exception reporting | Verify whether unusual activity generated and resolved alerts | EWS reports, case records and escalation logs |
For significant suspected fraud, transaction reconstruction may require a full-population review of relevant accounts and activities rather than reliance on a small audit sample.
7. Why Risk-Based Internal Audit Is Important
Traditional branch audits often concentrate on identifying individual irregular transactions.
A risk-based audit approach goes further by examining whether the institution’s control environment can prevent and detect material risks consistently.
RBI’s Commercial Banks – Internal Audit Function Directions, 2026 require a Risk-Based Internal Audit (RBIA) framework that assesses risk management systems and internal controls in addition to selective transaction testing.
What Should RBIA Examine After an Incident of This Nature?
Control design: Are procedures capable of preventing unauthorised changes to sensitive deposit accounts?
Control operation: Were those procedures actually performed and supported by evidence?
Technology assurance: Are CBS logs sufficiently complete and reliable to reconstruct transaction activity?
Fraud monitoring: Are relevant employee behaviours, account changes and unusual transfers included in monitoring systems?
Audit follow-up: Were recurring observations escalated and resolved effectively?
An institution should also assess whether its branch audit risk scoring incorporates past fraud incidents, control overrides, unresolved discrepancies and sensitive customer transactions.
An apparently low-risk branch may still have significant exposure if employee-level access and deposit transaction controls are inadequately monitored.
8. RBI Fraud Risk Management Directions, 2026: Regulatory Lessons
The RBI (Commercial Banks – Fraud Risk Management) Directions, 2026, issued on 31 July 2026, provide a directly relevant regulatory framework.
Several provisions are particularly important for evaluating the wider lessons of this incident.
A. Board-Approved Fraud Risk Management Policy
Paragraph 5 requires banks to maintain a Board-approved policy covering fraud prevention, early detection, investigation, staff accountability, monitoring, recovery and reporting.
Fraud risk management therefore extends beyond investigating cases after losses occur.
B. Board-Level Fraud Oversight
Paragraph 8 addresses the Special Committee of the Board for Monitoring and Follow-up of Cases of Frauds.
The committee’s responsibilities include reviewing fraud trends, root causes, detection delays and measures needed to strengthen controls.
C. Early Warning Signals for Non-Credit Transactions
Paragraphs 23–25 are particularly relevant.
Banks are expected to strengthen EWS systems for other banking and non-credit-related transactions, including monitoring unusual activity and identifying possible fraudulent transactions.
This is important because operational fraud monitoring must cover deposits, payments and other banking activities, not only loan accounts.
D. Internal Audit of Fraud Risk Management
Paragraph 64 requires internal audit coverage of controls and processes relating to fraud prevention, detection, monitoring, reporting and related critical weaknesses.
This creates an important connection between fraud risk management and independent assurance.
E. Staff Accountability
The Directions also address examination of staff accountability in fraud cases.
For public sector banks, the applicable framework includes additional requirements involving the Central Vigilance Commission and the Advisory Board for Banking and Financial Frauds in specified circumstances.
Regulatory interpretation: These 2026 Directions provide a relevant framework for current control reviews. Their issuance does not, by itself, establish that transactions allegedly occurring in earlier years breached every provision now contained in the consolidated Directions.
Learn Fraud Risk Management through our Certificate Course on Fraud Risk.
● Module 1 – Introduction to Fraud Risk Management
● Module 2 – Fraud Detection Techniques and Tools
● Module 3 – Fraud Prevention and Response Strategies
● Module 4 – Global Insights and Research Reports
● Module 5 – Historical Landmark Cases
9. Operational Risk Analysis: Applying the Three Lines Model
The alleged fraud provides an opportunity to examine the different responsibilities involved in banking risk management.
First Line: Branch Operations and Business Management
The first line is responsible for operating banking processes and applying controls during everyday transactions.
Relevant responsibilities include customer verification, transaction authorisation, account maintenance, segregation of duties and resolving operational exceptions.
Second Line: Operational Risk, Fraud Risk and Compliance
The second line should independently challenge and monitor the effectiveness of the control environment.
Its responsibilities include fraud risk assessments, EWS design, control monitoring, operational risk reporting and the identification of emerging risk concentrations.
Third Line: Internal Audit
Internal Audit provides independent assurance over the adequacy and effectiveness of governance, risk management and internal controls.
The third line should examine whether first-line controls are operating properly and whether second-line monitoring is effective.
The central governance principle is that responsibility for fraud prevention cannot rest with a single function.
Branch management, Operational Risk, Fraud Risk, Information Security and Internal Audit must work through clearly defined accountability and escalation arrangements.
10. Illustrative Operational Risk Scenario: How Could a Similar Pattern Be Detected?
Consider a hypothetical branch where an employee is involved in 12 premature fixed deposit closures over two months.
Of these transactions:
- Seven involve changes to settlement-account instructions.
- Five involve transfers to two common beneficiary accounts.
- Three follow recent modifications to registered customer contact details.
Each transaction may appear to have passed standard processing checks.
However, when analysed together, the pattern may warrant immediate examination.
A monitoring system should identify the connection between employee activity, deposit changes, beneficiary concentration and customer master-data modifications.
An independent team should then verify transaction authority and supporting evidence.
The lesson is that suspicious activity may become visible only when transactions are analysed collectively rather than individually.
This scenario is illustrative and does not describe the actual transaction pattern in the PNB investigation.
11. Practical Remediation Priorities for Banks
Banks can use the case to strengthen their own deposit operations and fraud risk controls.
| Priority | Recommended action | Responsible functions |
|---|---|---|
| 1. Credential Security | Review CBS user access, authentication controls and privileged activity | IT, Information Security, Operations |
| 2. Sensitive Transaction Controls | Revalidate maker-checker controls for FD closures and account changes | Branch Operations, Operations Risk |
| 3. Customer Verification | Strengthen verification of beneficiary, ownership and contact-detail changes | Operations, Customer Service |
| 4. Fraud Monitoring | Introduce correlation-based alerts covering employees, beneficiaries and account modifications | Fraud Risk, Analytics, Operational Risk |
| 5. Concurrent Audit | Test high-risk deposit and account-maintenance transactions | Concurrent Audit, Internal Audit |
| 6. Audit Follow-Up | Escalate and track recurring high-risk control exceptions | Internal Audit, Senior Management |
| 7. Incident Response | Establish coordinated investigation, evidence preservation and recovery procedures | Fraud Investigation, Legal, Operations |
| 8. Governance Reporting | Report material fraud indicators and remediation status to appropriate committees | CRO, Fraud Risk, Board Committees |
Implementation should be risk-based and proportionate to the institution’s operations.
12. What Should the Board and Risk Management Committee Review?
A fraud incident involving alleged employee credential misuse should prompt a broader review of operational control effectiveness.
Key questions include:
Access Control Assurance
Can the institution reliably identify who performed, approved and modified each sensitive banking transaction?
Deposit Transaction Monitoring
Are unusual fixed deposit changes and premature closures monitored centrally?
Fraud Detection Effectiveness
How frequently are suspicious transactions identified through internal monitoring compared with customer complaints or external reports?
Audit Coverage
Do concurrent and risk-based internal audits adequately cover the most sensitive deposit and account-maintenance processes?
Escalation and Accountability
Are serious control exceptions promptly reported to independent functions and relevant management committees?
Customer Protection
Can the bank identify potentially affected customers, investigate claims objectively and provide timely redress?
The objective of Board oversight should be to establish whether controls operate effectively in practice, not merely whether written policies and procedures exist.
13. What Banking Professionals Can Learn from the PNB Case
The Greater Noida case highlights a fundamental distinction between transaction processing controls and fraud risk management effectiveness.
A bank may have documented processes, approved user roles and system-generated transaction records. However, effective risk management requires confidence that those controls are operating as intended and that suspicious patterns are detected promptly.
The reported allegations demonstrate why professionals need practical capabilities in:
- Risk and Control Self-Assessments (RCSA).
- Fraud risk identification and early warning indicators.
- IT access and CBS transaction controls.
- Operational risk event recording and analysis.
- Control testing and internal audit.
- Root-cause analysis and incident management.
- Operational risk dashboards and Board reporting.
These capabilities are essential for Operational Risk Managers, Fraud Risk Professionals, Internal Auditors, Compliance Officers, Branch Managers and banking operations personnel.
14. Conclusion: The Real Lesson Is About Control Effectiveness
The alleged ₹10.24 crore fraud at Punjab National Bank’s Greater Noida branch remains under investigation.
Nevertheless, the reported circumstances raise important questions about the management of sensitive banking credentials, fixed deposit transactions, customer notifications, monitoring systems and independent audit assurance.
If wrongdoing is established, investigators will need to determine not only who carried out the transactions, but also how the actions were authorised, recorded, detected and escalated over time.
For the banking industry, the wider lesson is clear.
Fraud prevention is not achieved simply by implementing internal controls. It depends on continuously verifying whether those controls are effective, whether suspicious behaviour is detected and whether independent oversight can identify weaknesses before losses escalate.
The case reinforces the importance of integrating operational risk management, fraud detection, technology controls, concurrent audit and Board-level governance within a unified risk management framework.
Sources and References
Incident Reporting
- NDTV / PTI, 31 October 2026: CBI Case in Greater Noida PNB Fraud
- India Today, 30 October 2026: Greater Noida PNB Fraud Investigation
- Business Standard / PTI, 29 October 2026: PNB Settles Customer Claims
Regulatory References
- RBI: Commercial Banks – Fraud Risk Management Directions, 2026
- RBI: Commercial Banks – Concurrent Audit Directions, 2026
- RBI: Commercial Banks – Internal Audit Function Directions, 2026
Editorial note: This case study is based on information publicly available as of 31 October 2026. Allegations, preliminary investigative findings, bank statements and recommended control practices have been distinguished. It does not constitute a conclusion regarding criminal responsibility or an independent finding of regulatory non-compliance.
