Articles on fraud and investigations.

Key takeaway

A fraud risk management framework is the governance structure that ties fraud risk assessment, prevention, detection, investigation and monitoring into one accountable programme.

Key takeaway

The DPDP Act allows employers to process employee personal data without consent for employment purposes and to protect the business from loss or liability, under s. 7(i).

Key takeaway

The FCPA can reach Indian companies that are US issuers, that act within US territory, or that act as agents or partners of US companies.

Key takeaway

Since 26 July 2018, s. 9 of the Prevention of Corruption Act makes a commercial organisation liable when an associated person bribes a public servant to obtain or retain business for it.

Key takeaway

Account takeover happens when a criminal gains control of a legitimate account, and SIM swaps are a common way to intercept the one-time passwords that protect it.

Key takeaway

There is no such thing as a ‘digital arrest’ in Indian law; police, CBI, ED, customs and judges do not arrest or question people over video calls.

Key takeaway

Business email compromise uses a compromised or spoofed email account to trick staff into paying money or changing bank details, and it accounted for over USD 3 billion of losses reported to the FBI's IC3 in 2025.

Key takeaway

Digital evidence should be preserved before anyone is interviewed or confronted, because logs roll over, devices are wiped and accounts are deleted quickly.

Key takeaway

India has no US-style discovery, but the substituted Order XI applying to commercial suits requires parties to disclose all relevant documents in their power, possession, control or custody, including adverse ones and electronic records.

Key takeaway

Section 63 of the Bharatiya Sakshya Adhiniyam 2023 replaced s. 65B of the Indian Evidence Act 1872 from 1 July 2024 and governs the admissibility of computer output.

Key takeaway

Fraud classification follows a defined path under the RBI's 2026 Directions: early warning signal, red flag, audit, show-cause notice with at least 21 days to reply, and a reasoned order.

Key takeaway

On 31 July 2026 the RBI issued entity-wise Fraud Risk Management Directions, 2026, which replaced the three Master Directions of 15 July 2024 with immediate effect.

Key takeaway

Section 66(1) targets anyone knowingly party to carrying on business with intent to defraud creditors, while section 66(2) targets directors and partners who continued trading without minimising creditor losses once insolvency was unavoidable.

Key takeaway

Resolution professionals must form an opinion on preferential, undervalued, extortionate and fraudulent transactions within the regulation 35A timelines, and most commission a transaction or forensic audit to do so, although no regulation makes one mandatory.

Key takeaway

Winning a case and recovering money are different outcomes; pre-litigation asset searches test whether a defendant has reachable assets before costs are committed.

Key takeaway

Asset tracing in India combines public records, financial analysis and field intelligence to identify what a person or company owns, where it is and who holds it on their behalf.

Key takeaway

Most third-party problems in India are visible in public records before the contract is signed, if someone checks.

Key takeaway

Financial and legal due diligence verify what the target discloses, while integrity due diligence looks for what it does not disclose about its owners, managers and conduct.

Key takeaway

A conflict of interest becomes a fraud risk when it is undisclosed and the conflicted person influences decisions that benefit the hidden interest.

Key takeaway

Procurement fraud can occur at every stage of the procure-to-pay cycle, so red flags must be monitored from needs definition through to payment.

Key takeaway

Fraud analytics tests whole populations of transactions, so it finds patterns that sample-based audits can miss.

Key takeaway

A statutory audit gives reasonable assurance that financial statements are free from material misstatement; it is not designed to find every fraud.

Key takeaway

Section 177(9) of the Companies Act 2013 and Rule 7 require a vigil mechanism in listed companies, companies accepting public deposits and companies that have borrowed more than INR 50 crore from banks and public financial institutions.

Key takeaway

Triage every complaint within days, decide who owns it, and record why, because the Audit Committee is accountable for the vigil mechanism.