Risk Management in a Hyperconnected World: Fraud and Response

Risk management today means planning for fraud that arrives through a phone, an email or a payment link, not only through a forged signature. The same connections that let a business invoice a client in seconds also let a fraudster impersonate that client in seconds.

My early work was in fraud investigation, risk and compliance within financial services, and one lesson has held up across every case type: most losses come from a gap in process, not from clever technology. Here is how I would think about the main risks, and what to do in the first hours after something goes wrong.

The risks that matter most now

Risk	How it usually starts	The control that stops most of it
Invoice and business email fraud	An email that looks like a vendor asks you to pay into a “new” bank account	Confirm any change in bank details by phone on a number you already hold
“Digital arrest” and impersonation scams	A video call from someone posing as police, customs or a regulator, demanding money	Staff and family know that no agency arrests or collects money over a video call
Account takeover and UPI fraud	An OTP, screen-sharing app or payment request shared under pressure	Never share OTPs; use transaction limits and alerts
Insider fraud	One person controls ordering, approving and paying	Separate duties and review exceptions every month
Vendor and counterparty risk	A new supplier or partner onboarded without checks	Basic KYC and due diligence before the first payment

Invoice fraud and business email compromise

This is the fraud I see most often in businesses, and it rarely involves hacking your systems. The fraudster studies a supplier relationship, then sends a convincing email, sometimes from a look-alike domain, asking for payment to a different account. The invoice is real; only the account number is false.

The fix is a rule, not software. Any request to change a vendor’s bank details is confirmed by a call to a number already on file, never to a number in the email. Two people sign off large or first-time payments. Finance teams should feel free to slow down a payment that comes with urgency and secrecy, because those are the two signs that appear in almost every case.

“Digital arrest” and impersonation scams

In a “digital arrest” scam, a caller claims to be from the police, a central agency or a court, says a parcel or account is linked to a crime, and keeps the victim on a video call until money is transferred to “clear” their name. The Ministry of Home Affairs and its Indian Cyber Crime Coordination Centre have warned the public repeatedly that no government agency arrests anyone over a video call or asks for money to settle a case.

These scams target senior employees and family members as much as anyone else. A short internal note, repeated every few months, does more than any policy document: hang up, verify independently, and tell someone.

Insider fraud

Insider fraud is uncomfortable to discuss, which is why it lasts longer than other frauds before anyone notices. It thrives where one trusted person orders, approves and pays, or where nobody reviews exceptions such as refunds, credit notes and write-offs.

• Separate the roles of raising, approving and releasing payments.
• Rotate responsibilities where you can, and make sure people take leave.
• Review vendor master changes, manual journal entries and refunds every month.
• Give employees a safe, confidential way to raise concerns.

Know your vendors and partners

Banks run KYC on customers; businesses should run a lighter version on the parties they pay. Before the first payment, confirm the entity exists, check that the bank account is in its name, and look at who actually controls it. For larger contracts, a short due diligence on litigation, regulatory actions and financial health is cheap compared with the cost of a failed partner. Good contracts then carry the protection forward, a point I expand on in my note on contracts that drive growth and protect value.

The first hours after a fraud

Speed matters more than anything else once money has moved. Funds sent by fraud are often moved again within hours, and the chance of freezing them falls quickly.

The same speed works against you if your own account is caught in a fraud trail. If a bank account is seized or frozen during an investigation, this guide on what to do when a bank account is seized sets out the steps to have it released.

1. Report the transaction to your bank at once through its official channel, and ask it to block the instrument and attempt a recall.
2. Call 1930 or file a complaint on the National Cyber Crime Reporting Portal at cybercrime.gov.in. Early reporting helps the system flag and hold funds in the receiving accounts.
3. Preserve evidence: emails with full headers, call logs, screenshots, transaction references and the devices involved. Do not wipe or reset a compromised laptop or phone.
4. File a police complaint where the amount or facts require it, with a clear timeline and copies of the evidence.
5. Review what failed once the immediate steps are done, and fix the process, not just the person.

Your rights as a bank customer

The Reserve Bank of India’s circular on limiting customer liability in unauthorised electronic banking transactions rewards quick reporting. Where the fraud is caused by a third-party breach and you report it within three working days of the bank’s alert, your liability can be zero. Reporting in four to seven working days caps your liability, and later reports are dealt with under the bank’s board-approved policy. The bank has to credit the disputed amount to your account, as a shadow reversal, within ten working days of your report. These protections weaken if you shared an OTP or PIN, which is why the first rule of every awareness session is never to share them.

Protecting families and senior members

Fraudsters do not separate business from home. Senior family members, especially those who handle investments or property, are often targeted because they are trusting, available during working hours and less familiar with new payment apps.

• Agree a family rule that nobody transfers money because of a phone or video call, however official it sounds, without speaking to another family member first.
• Keep a short list of genuine bank, insurer and broker contact numbers at home, so that calls can be verified independently.
• Set daily transaction limits on accounts that do not need high limits, and switch on alerts for every debit.
• Be cautious with requests to install screen-sharing or “support” apps, which give a stranger a view of the phone.
• Keep property papers, share certificates and investment records organised, so that any unauthorised change is noticed early.

In my experience, families who talk openly about these scams are far less likely to fall for them. Embarrassment keeps victims silent, and silence gives the fraudster time. Making it normal to ask “is this real?” is one of the simplest protections there is.

Building risk management into daily work

Risk management works when it is part of routine rather than an annual exercise. In my experience, a small set of habits covers most of the ground:

• A one-page fraud response plan that names who calls the bank, who reports to 1930 and who preserves evidence.
• Payment controls that stay in place even when someone senior is in a hurry.
• Short, regular awareness reminders for staff and family, using real examples.
• Periodic checks of access rights, vendor details and unusual transactions.
• Updated policies that refer to the laws now in force, a topic I cover in India’s evolving regulatory landscape.

The goal is not to remove every risk. It is to make fraud harder to start, quicker to spot and easier to recover from.

Closing thought

Most frauds succeed because someone acted quickly under pressure, and most losses shrink when someone reports quickly afterwards. Building that reflex into a team is the most useful risk control a business can have. If you would like to discuss how these risks apply to your business or family, you can reach me through the contact page, or read more about my work.

Frequently asked questions