Knowledge base
The language of fraud and forensics, explained.
Plain-English answers to the terms boards, auditors and lawyers encounter in investigations, due diligence and regulatory matters. Written for India, relevant everywhere.
A
- Cyber fraudAccount Takeover (ATO)Account takeover (ATO) fraud is when a criminal gains control of a legitimate user's account, such as a bank, UPI, email, social media or corporate system account, using stolen credentials, OTPs or a swapped SIM, and then uses it to move money, make purchases, steal data or launch further fraud while appearing to be the genuine user.
- Fraud investigationAsset MisappropriationAsset misappropriation is a type of occupational fraud in which an employee, manager or director steals or misuses the organisation's resources. It covers theft of cash before or after it is recorded, fraudulent payments such as fake invoices, payroll or expense claims, and theft or misuse of inventory, equipment, data or other assets.
- Asset tracingAsset TracingAsset tracing is the investigative process of identifying, locating and documenting assets owned or controlled by a person or company, including assets hidden through relatives, nominees, shell companies or overseas structures. It follows the money from a known loss or debt to its current form, so that creditors, victims or courts can freeze and recover it.
- RegulationAuditor Fraud Reporting under Section 143(12) and CARO 2020Section 143(12) of the Companies Act 2013 requires a company's auditor who has reason to believe that officers or employees are committing, or have committed, fraud against the company to report it. Frauds of INR 1 crore or more go to the Central Government on Form ADT-4; smaller frauds go to the audit committee or board.
- InsolvencyAvoidance Transactions under IBC (PUFE)Avoidance transactions are dealings by a corporate debtor before insolvency that the Insolvency and Bankruptcy Code 2016 allows the NCLT to reverse: preferential (s. 43), undervalued (s. 45), transactions defrauding creditors (s. 49) and extortionate credit (s. 50). Together with fraudulent or wrongful trading under s. 66, they are commonly called PUFE transactions.
B
- Due diligenceBackground VerificationBackground verification is the process of confirming that the information a person provides about themselves is true and checking for relevant risks. In employment it typically covers identity, education, previous employment, address, references, litigation and criminal records, and is used to prevent fraud, protect the organisation and support fair, consistent hiring decisions.
- Anti-money launderingBeneficial OwnershipBeneficial ownership refers to the natural person who ultimately owns or controls an entity or asset, or on whose behalf a transaction is carried out, even when legal title sits with someone else. In India it is governed mainly by s. 90 of the Companies Act 2013 and the PML Rules 2005, both using a 10% threshold for companies.
- Fraud investigationBid RiggingBid rigging is collusion between bidders, sometimes with help from an insider, to fix the outcome of a tender in advance instead of competing genuinely. Bidders agree who will win and at what price, using tactics such as cover bids, bid suppression and bid rotation. In India it is presumed anti-competitive under the Competition Act 2002.
- Cyber fraudBusiness Email Compromise (BEC)Business email compromise (BEC) is a fraud in which criminals use a hacked or spoofed business email account to impersonate an executive, employee or supplier and trick the organisation into paying money or releasing sensitive data. Typical schemes change a vendor's bank details or send an urgent payment request that appears to come from senior management.
C
D
- Cyber fraudDigital Arrest ScamA digital arrest scam is a cyber fraud in which callers pose as police, CBI, customs, ED or court officials, usually over video call, falsely accuse the victim of a crime and keep them in 'virtual custody' until they pay to 'clear their name'. Indian law has no concept of digital arrest; genuine agencies never arrest anyone by video call.
- Digital forensicsDigital ForensicsDigital forensics is the identification, preservation, collection, examination and reporting of data from computers, phones, servers, cloud accounts and other digital sources in a way that keeps the evidence reliable. It is used in fraud investigations, employee misconduct cases, cyber incidents and litigation, where findings may need to stand up in court.
- Due diligenceDue DiligenceDue diligence is a structured investigation of a company, person or asset carried out before a decision such as an acquisition, investment, loan, partnership or appointment. It verifies facts and identifies financial, legal, commercial, integrity and regulatory risks so that the decision-maker can price, mitigate or walk away from them.
E
- Fraud investigationEmbezzlementEmbezzlement is the dishonest misappropriation or conversion of money or property by a person who was lawfully entrusted with it, such as an employee, director, agent or trustee. Indian law does not use the word as an offence; such conduct is prosecuted mainly as criminal breach of trust under s. 316 of the Bharatiya Nyaya Sanhita 2023.
- Digital forensicseDiscoveryeDiscovery, or electronic discovery, is the process of identifying, preserving, collecting, processing, reviewing and producing electronically stored information such as emails, chats, documents and databases for a legal matter, regulatory inquiry or internal investigation. It combines legal judgement with technology so that large data volumes can be searched defensibly.
F
- Forensic accountingFinancial Statement FraudFinancial statement fraud is the deliberate misstatement or omission of amounts or disclosures in an organisation's financial statements to deceive users such as investors, lenders, regulators or acquirers. Common methods include fictitious revenue, manipulating the timing of income and expenses, overvaluing assets, concealing liabilities and hiding related-party transactions.
- Anti-bribery & corruptionForeign Corrupt Practices Act (FCPA)The Foreign Corrupt Practices Act is a United States law that prohibits corruptly giving anything of value to a foreign official to obtain or retain business. It also requires US-listed issuers to keep accurate books and records and maintain internal accounting controls. It can reach Indian companies, subsidiaries and individuals with US connections.
- InsolvencyForensic (Transaction) Audit in CIRPA forensic or transaction audit in a CIRP is a review of a corporate debtor's past transactions, commissioned by the resolution professional, to identify preferential, undervalued, fraudulent, extortionate and fraudulent or wrongful trading transactions. It supports the opinion and determination the resolution professional must form under regulation 35A of the CIRP Regulations before applying to the NCLT.
- Forensic accountingForensic AccountingForensic accounting is the application of accounting, auditing and investigative skills to matters that may end up in a dispute, investigation or court. It covers fraud investigations and forensic audits, but also loss and damages quantification, reconstruction of accounts, tracing of funds and expert opinion in commercial, insolvency, insurance and family disputes.
- Forensic accountingForensic AuditA forensic audit is a targeted examination of an organisation's financial records, transactions and supporting evidence to establish whether fraud, misappropriation, diversion of funds or misstatement has occurred, who was involved and how much was lost. Its findings are gathered and documented to a standard that can support disciplinary, civil, regulatory or criminal proceedings.
- Digital forensicsForensic Imaging (data imaging)Forensic imaging is the process of creating an exact, bit-for-bit copy of a storage device or data source, such as a hard drive, phone or cloud mailbox, without altering the original. The copy is verified with hash values so investigators can examine it while the original evidence stays preserved and its integrity can be proved.
- Governance & controlsFraud Risk AssessmentA fraud risk assessment is a structured process for identifying how fraud could be committed against or by an organisation, estimating the likelihood and impact of each scheme, mapping the existing controls that address it, and prioritising the residual risks that need stronger prevention or detection. It should be repeated regularly and whenever the business changes significantly.
- Fraud investigationFraud TriangleThe fraud triangle is a model that explains why otherwise ordinary people commit fraud. It holds that three conditions are usually present together: a pressure or incentive, such as debt or targets; an opportunity, typically weak or overridden controls; and a rationalisation that lets the person justify the act to themselves.
H
I
- Cyber fraudInsider ThreatAn insider threat is the risk that someone with legitimate access to an organisation's systems, data or premises, such as an employee, contractor, vendor or former staff member, misuses that access, deliberately or carelessly, to steal data or funds, commit fraud, sabotage systems or help outside attackers. Because insiders are trusted, their actions often evade perimeter security.
- Due diligenceIntegrity Due DiligenceIntegrity due diligence (IDD) is an investigation into the ownership, background, reputation and conduct of a company and the people behind it, carried out before a transaction or relationship. It looks for undisclosed owners, related parties, fraud, bribery, litigation, regulatory action, sanctions and political links that financial and legal due diligence may not reveal.
- Governance & controlsInternal ControlsInternal controls are the policies, procedures, systems and oversight that an organisation's board and management put in place to give reasonable assurance that operations are effective and efficient, financial reporting is reliable, assets are safeguarded, fraud and errors are prevented or detected, and laws and regulations are complied with.
K
- Anti-bribery & corruptionKickbackA kickback is a secret payment or benefit given to an employee, official or agent by a supplier, contractor or customer in return for favourable treatment, such as awarding a contract, approving inflated invoices or overlooking poor delivery. It is usually funded by overcharging the victim organisation and is a form of bribery and corruption.
- Anti-money launderingKnow Your Customer (KYC)Know Your Customer (KYC) is the set of procedures a regulated entity uses to identify and verify its customers and their beneficial owners, understand the purpose of the relationship, assess risk and monitor transactions. In India, KYC rests on s. 12 of the PMLA 2002 and, for commercial banks, the RBI (Commercial Banks – Know Your Customer) Directions 2025.
M
O
- Fraud investigationOccupational FraudOccupational fraud is fraud committed by a person against the organisation that employs them, by deliberately misusing or misapplying its resources or assets for personal gain. It includes employees, managers, directors and owners, and falls into three broad categories: asset misappropriation, corruption and financial statement fraud.
- Due diligenceOpen-Source Intelligence (OSINT)Open-source intelligence (OSINT) is information collected from publicly available sources and analysed to answer a specific question. Sources include company registries, court records, regulatory orders, property records, news archives, websites and social media. In investigations and due diligence, OSINT is used to identify people, map ownership and relationships, trace assets and corroborate evidence lawfully.
P
- Governance & controlsPOSH Act 2013The POSH Act is India's Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act 2013. It requires employers with ten or more employees to constitute an Internal Committee, sets time limits for complaints and inquiries, imposes duties on employers to prevent harassment, and penalises non-compliance with fines and possible licence cancellation.
- Cyber fraudPhishingPhishing is a form of social engineering in which a fraudster impersonates a trusted person or organisation, by email, SMS, phone call, messaging app or fake website, to trick the victim into revealing credentials or payment details, installing malware, or authorising a payment. It is the most common entry point for cyber fraud and account compromise.
- Anti-money launderingPolitically Exposed Person (PEP)A politically exposed person (PEP) is an individual who holds or has held a prominent public function, such as a head of state, senior politician, senior official, judge, military officer or state-enterprise executive. Because of bribery and laundering risk, PEPs, their family members and close associates attract enhanced due diligence, usually alongside sanctions screening.
- Anti-bribery & corruptionPrevention of Corruption Act 1988 (bribery & corruption in India)The Prevention of Corruption Act 1988 is India's principal anti-bribery law. As amended in 2018, it punishes public servants who accept undue advantage, makes giving or promising a bribe a standalone offence, and holds commercial organisations liable when associated persons bribe public servants, unless they had adequate procedures to prevent it.
- Anti-money launderingPrevention of Money Laundering Act 2002 (PMLA)The Prevention of Money-laundering Act 2002 (PMLA) is India's principal anti-money laundering law. It makes laundering the proceeds of scheduled offences a crime, gives the Directorate of Enforcement power to attach, search, seize and arrest, and requires banks and other reporting entities to verify customers, keep records and report transactions to FIU-IND.
- Fraud investigationProcurement FraudProcurement fraud is any dishonest act that manipulates how an organisation identifies needs, selects suppliers, awards contracts, receives goods or services, or pays for them. It may be committed by insiders, suppliers or both acting together, and includes kickbacks, bid rigging, fictitious vendors, conflicts of interest, inflated invoices and substitution of inferior goods.
R
- Banking fraudRed-Flagged Account (RFA)A red-flagged account (RFA) is a loan account that a bank has marked as suspected of fraud because warning signals suggest possible fraud. Under the RBI Fraud Risk Management Directions, 2026, the bank reports the RFA on CRILC within seven days, investigates it, and ordinarily either classifies it as fraud or removes the flag within 180 days.
- Anti-money launderingRound-TrippingRound-tripping is the circular movement of money, goods or transactions so that funds return to their source disguised as something else. Common forms include routing Indian money abroad and back as foreign investment, circular sales between related entities to inflate revenue, and arrangements built mainly to obtain a tax benefit or hide illicit funds.
S
- Digital forensicsSection 63 Certificate (electronic evidence, Bharatiya Sakshya Adhiniyam 2023)A Section 63 certificate is the statutory certificate that must accompany an electronic record each time it is submitted as evidence under s. 63 of the Bharatiya Sakshya Adhiniyam 2023. Signed by the person in charge of the device and an expert, it identifies the record and device, confirms the statutory conditions and records hash values.
- Governance & controlsSegregation of DutiesSegregation of duties (SoD) is an internal control principle that divides the key steps of a transaction, namely authorising it, recording it, holding custody of the related asset and reconciling it, among different people, so that no single individual can both commit and conceal an error or fraud without another person's involvement.
- Anti-money launderingShell CompanyA shell company is a legally registered entity with little or no real business operations, employees or assets of its own. Shells can have legitimate uses, such as holding investments or preparing for a transaction, but they are also used to hide ownership, move or layer illicit funds, inflate revenue and route fictitious transactions.
- InsolvencyStressed AssetA stressed asset is a loan or credit exposure whose repayment is at risk because the borrower is in financial difficulty. In India it typically covers accounts flagged as special mention accounts (SMA), non-performing assets (NPA) and restructured loans. Lenders must recognise stress early and pursue resolution through restructuring, recovery, sale or insolvency.
U
V
- Due diligenceVendor Due DiligenceVendor due diligence is the structured checking of a supplier or service provider before onboarding and at intervals afterwards. It confirms the vendor is real, identifies its owners and related parties, and tests its financial standing, legal and regulatory record, integrity and capacity, so an organisation can manage fraud, bribery, supply and reputational risk.
- Fraud investigationVendor FraudVendor fraud is any scheme in which a supplier, a fake supplier or an insider colluding with a supplier deceives an organisation through its purchasing and payments cycle. Typical forms include fictitious vendors, inflated or duplicate invoices, short or substandard delivery, and kickbacks paid to employees who approve orders or release payments.
- WhistleblowingVigil MechanismA vigil mechanism is the formal channel through which directors and employees of an Indian company can report genuine concerns about misconduct, fraud or unethical behaviour. It is required by s. 177(9) of the Companies Act 2013 and SEBI LODR Regulation 22, and must protect users against victimisation and allow direct access to the Audit Committee chair.
W
- WhistleblowingWhistleblowerA whistleblower is a person, usually an employee, director, vendor or other insider, who reports suspected fraud, corruption, illegal conduct or serious ethical breaches to someone able to act on it. Reports may go to internal channels such as a company's vigil mechanism, or to external bodies such as regulators and law enforcement agencies.
- Banking fraudWilful DefaulterA wilful defaulter is a borrower or guarantor, with at least INR 25 lakh outstanding, whom a lender has declared to have defaulted deliberately: despite having the capacity to pay, by diverting or siphoning funds, by disposing of secured assets without the lender's knowledge, or by promoters failing to bring in promised equity. Promoters and directors can be named.