Systemic failures enabled Rs 657-crore fraud in Haryana government accounts
The Central Bureau of Investigation (CBI) has uncovered a massive banking fraud amounting to Rs 657 crore that exploited critical gaps in the private banking systems of IDFC First Bank and AU Small Finance Bank. The scam, masterminded by Ribhav Rishi, branch manager of IDFC First Bank's Sector 32, Chandigarh branch, involved collusion between bank officials and IAS officers, according to the CBI's investigation papers.
The accused bank officials, including Ribhav Rishi and relationship manager Abhay Kumar, along with four others, resorted to forged debit notes and cheques bearing forged signatures, as well as unauthorised debits without any cheque. These transactions were processed and approved through the bank's internal 'Maker-Checker' workflow, where the bank officials induced the banking system to act upon forged instruments. Even call confirmation with authorised signatories of the government bank accounts turned out to be a farce, as no call recordings were maintained by the banks.
Forged documents and altered account details used to siphon funds
To present the fraudulent transactions as genuine, the accused bank officials prepared forged fixed deposit receipts (FDRs), bank account statements, and interest certificates, and submitted them to government departments. They altered the mobile numbers and email IDs linked to the bank accounts in the account-opening forms and banking records, subsequently substituting them with those they controlled and operated.
For instance, Rs 50 crore was debited from the IDFC First Bank account of the Haryana Power Generation Corporation Limited (HPGCL) on May 5, 2025, through Cheque No. 3. However, this cheque was never issued by HPGCL. The 'Maker' Anuj Kaushal and 'Checker' Seema Dhiman are accused in the scam, while mastermind Ribhav Rishi conducted the call verification. They allowed the fraud without a cheque, and the call was made for some other purpose.
Technical faults and missing records facilitated fraud
Another transfer of Rs 5 crore was made on May 19, 2025. The bank failed to produce Cheque No. 9 on the basis of which the transaction was made. As the fund was transferred through the bank's General Ledger, no SMS alert was sent to the authorised signatory due to a technical fault in IDFC First Bank's system.
In a case involving a Rs 25 crore debit from the HPGCL Pension Fund Trust account in AU Small Finance Bank via a cheque made on December 29, 2025, the branch manager of the bank's Mohali branch, Charanjit Singh Randhawa, allegedly made the call confirmation through the mobile phone of Abhay Kumar, another mastermind of the scam. It was Abhay Kumar who had brought the cheque. The cheque bore only the authorised signatories' signatures; Randhawa filled in the body of the cheque, including the amount, date, and beneficiary's name. The amount went to Swastik Desh Projects, a firm floated by the accused for siphoning off the funds. The call detail record (CDR) did not log any record of a call between Abhay Kumar and Balwant Singh, Senior Accounts Officer of HPGCL, whose number was linked with the account. Balwant Singh later committed suicide and levelled allegations against a co-accused.
High-value transactions bypassed approval protocols
Another example of lapses on the bank's end is of a Rs 10-crore fraudulent debit from the Haryana State Agriculture Marketing Board's account at IDFC First Bank on January 14, 2026. Area head Shamim Dar, an accused in the case, claimed to have made the call confirmation, but as per the Standard Operating Procedure (SOP) of the bank, a branch operations staff member, such as the branch manager, or the maker or checker, should have made the call. As the funds were first transferred to the bank's General Ledger, no SMS alert was generated due to a technical fault of IDFC First Bank. These funds were then transferred to two shell entities.
For high-value transactions, approval was to be obtained from the cluster head, regional head, zonal head, and country head depending on the value, as per the bank's SOP. It turned out that Ribhav Rishi forged emails to his seniors to make it appear that transactions had been approved by country head Sachin Mehta, zonal head Vishesh Soni, regional head Dhirendera Pratap Singh, and cluster head Harjot Singh Gill, for debits from the Haryana School Shiksha Pariyojana Parishad (HSSPP). There were 101 fraudulent debit entries and 33 fraudulent credit entries in the account. The call records reflect that no telephonic confirmation was made or SMS was generated. Accused bank officials had forged the debit notes.
Widespread fraud across multiple government departments
In the case of the Haryana State Pollution Control Board's account, several cheques/debit notes could not be found in the records. From the Municipal Corporation, Panchkula, bank account, there were 22 fraudulent debit transactions. No SMS was generated, nor was any call confirmation made. The amount was first credited to the branch's General Ledger account, and no such debit message was sent to the linked mobile number due to a technical fault in IDFC First Bank's system, found the CBI.
In the scam involving 12 accounts across eight departments of the Haryana Government, there were 236 fraudulent debit transactions worth Rs 818 crore and 84 fraudulent credit transactions worth Rs 214 crore, resulting in a loss of Rs 504.36 crore. The CBI investigation highlights systemic failures in the private banking system that allowed such large-scale fraud to occur undetected for months.
