Banking Frauds, Cyber-Crime & Legal Challenges: Types, Cases & Prevention

TAKEAWAYS:

• Fraud types: Understand 5 common banking frauds (e.g., letter of credit fraud, loan diversion, check kiting) and their red flags.
• Cyber-crime tools: Recognize phishing, malware, and SIM-swapping attacks used in Nepal (e.g., eSewa hacking, Ncell fraud).
• Legal framework: Memorize BAFIA 2073’s fraud penalties (e.g., 3–10 years for forgery) and NRB’s reporting rules.
• Prevention: Learn the 4-layer defense banks use (tech, policies, audits, customer education) with real examples from Ncell and Daraz.
• Case studies: Trace how fraudsters exploit trade finance (LC fraud) and loan processes (collateral fraud), and how banks recover losses.
• Exam focus: Link fraud types to past questions (e.g., "Bank generates coinage" → check kiting) and legal remedies (e.g., "NRB’s role in cyber-crime").

1. Banking Frauds: Types, Mechanics, and Red Flags

Fraud in banking costs Nepalese banks NPR 5+ billion annually (NRB 2023). Fraudsters exploit trust, technology gaps, and weak processes. Below are the top 5 frauds in Nepal, with mechanics and real-world traces.

A. Letter of Credit (LC) Fraud: The "Fake Invoice" Scam

How it works:

1. Importer (e.g., a Kathmandu textile firm) opens an LC with Nepal Bank Limited (NBL) for a Chinese supplier.
2. Exporter submits fake invoices/shipping docs to the issuing bank (NBL).
3. NBL releases payment to the exporter’s account without verifying goods.
4. Importer never receives the goods, but the bank loses the money.

Real-world example:

• Case: A Daraz supplier in India shipped NPR 20M worth of non-existent electronics to a Nepalese importer using a cloned LC. The bank (Global IME) lost NPR 18M before detecting the fraud via document mismatch.
• Red flags:
  • Invoices in unrelated currencies (e.g., USD for a local transaction).
  • Same supplier name across multiple LCs.
  • No physical inspection of goods.

Visual: LC Fraud Flow

flowchart LR
    A["Importer (Kathmandu Firm)"] -->|"Opens LC"| B["Nepal Bank Ltd (Issuing Bank)"]
    B -->|"Releases Payment"| C["Exporter (Fake Supplier in China)"]
    C -->|"Submits Fake Docs"| B
    B -->|"No Verification"| D["Funds Lost"]
    D -->|"Recovery Attempt"| E["NRB Investigation"]

B. Loan Diversion Fraud: Stealing Bank Funds

How it works:

1. A borrower (e.g., a Kathmandu restaurant owner) takes a NPR 5M loan for equipment.
2. The bank transfers funds to the borrower’s account.
3. The borrower diverts the money to a personal account or a shell company.
4. The restaurant fails to operate, but the bank’s loan is non-performing.

Real-world example:

• Case: A Ncell vendor in Pokhara took a NPR 3M loan for a new shop but used it to pay off personal debts. When Ncell (the bank) audited, they found:
  • No shop records matching the loan purpose.
  • Withdrawals to 3 different accounts in 2 days.
• Red flags:
  • Sudden large withdrawals after loan disbursement.
  • No collateral traceability (e.g., land mortgage not updated).
  • Borrower’s credit score drops post-loan.

Visual: Loan Diversion T-Account

C. Check Kiting: "Coinage of Two Parties"

How it works:

1. Fraudster opens two accounts in different banks (e.g., Nabil Bank and Standard Chartered Nepal).
2. Writes a check on Account A for NPR 10M and deposits it into Account B.
3. Before the check bounces, withdraws funds from Account B.
4. Repeats the cycle to create fake float.

Real-world example:

• Case: A Khalti merchant in Lalitpur used check kiting to NPR 8M by exploiting delays in interbank clearing. NRB fined him NPR 12M under BAFIA 2073 (Section 102).
• Red flags:
  • Frequent large deposits from unknown sources.
  • Checks drawn on different banks with the same signature.
  • Account balance spikes but no business activity.

Visual: Check Kiting Cycle

flowchart TD
    A["Fraudster"] -->|"Writes Check"| B["Bank A (Nabil)"]
    B -->|"Deposits in Bank B"| C["Bank B (SCB)"]
    C -->|"Withdraws Funds"| A
    A -->|"Repeats Cycle"| B
    B -->|"Check Bounces"| D["Fraud Detected"]

D. Identity Theft & SIM Swapping

How it works:

1. Fraudster steals customer details (e.g., from a Khalti data breach).
2. Uses SIM swapping (tricking Ncell/NTC to transfer the victim’s number to a new SIM).
3. Resets OTPs to access e-banking accounts.
4. Transfers funds to crypto/wallet accounts.

Real-world example:

• Case: In 2022, NPR 200M was stolen from eSewa users via SIM swapping. NRB issued a directive mandating banks to enable biometric authentication.
• Red flags:
  • Sudden login from a new device/location.
  • Multiple failed OTP attempts before success.
  • Unusual transactions (e.g., NPR 50K to a Myanmar number).

Visual: SIM Swapping Attack Flow

sequenceDiagram
    participant Fraudster
    participant NTC/Ncell
    participant Victim
    participant eSewa Bank
    Fraudster->>NTC/Ncell: "Social engineering call (pretends to be victim)"
    NTC/Ncell-->>Fraudster: Transfers SIM to new card
    Fraudster->>eSewa Bank: Resets OTP via stolen number
    eSewa Bank-->>Fraudster: Access granted
    Fraudster->>eSewa Bank: Transfers funds to crypto

E. Insider Fraud: Employees Stealing from Banks

How it works:

1. A bank employee (e.g., a loan officer at Global IME) approves a fake loan for a friend.
2. The friend diverts funds to a shell company.
3. The employee forges documents to hide the fraud.

Real-world example:

• Case: A Nabil Bank employee in Biratnagar approved NPR 15M loans for non-existent borrowers. She forged signatures and shared proceeds with a money launderer. She was sentenced to 7 years under BAFIA 2073 (Section 105).
• Red flags:
  • Loans to "new customers" with no credit history.
  • Employee access to multiple accounts.
  • Sudden lifestyle changes (e.g., buying a luxury car).

2. Cyber-Crime in Banking: Tools, Targets, and Nepal’s Response

Cyber-crime costs Nepalese banks NPR 3B+ annually (FICCI 2023). Below are the top cyber threats and how banks counter them.

A. Phishing & Smishing Attacks

How it works:

• Fraudsters send fake emails/SMS (e.g., "Your Khalti account is locked!").
• Trick victims into clicking malicious links or entering credentials.

Real-world example:

• Case: A WhatsApp phishing scam tricked 1,000 Daraz sellers into "verifying" their accounts via a fake link. NPR 50M was stolen before NRB issued a public alert.
• Red flags:
  • Urgent language ("Your account will be suspended!").
  • Links with misspellings (e.g., khalti-secure.com instead of khalti.com.ne).
  • Requests for OTPs via email.

Visual: Phishing Email Example

B. Malware & Ransomware

How it works:

• Malware (e.g., Emotet) infects a bank’s system.
• Ransomware (e.g., LockBit) encrypts data and demands NPR 50M+ ransom.

Real-world example:

• Case: Nepal Investment Bank was hit by ransomware in 2021, locking customer data for 3 days. They paid NPR 30M to recover files.
• Prevention:
  • Multi-factor authentication (MFA).
  • Regular software updates.
  • Employee training (e.g., NRB’s cyber-security workshops).

C. Deepfake & Voice Cloning Frauds

How it works:

• Fraudsters use AI to clone a bank manager’s voice.
• Call a customer and order a fraudulent transfer.

Real-world example:

• Case: A Ncell executive’s voice was cloned to call a Pokhara businessman, ordering a NPR 10M transfer to a "new vendor". The bank recovered 80% via forensic analysis.
• Red flags:
  • Unexpected calls from "managers" asking for transfers.
  • Requests to bypass normal procedures.

3. Legal Framework: Laws, Penalties, and NRB’s Role

Nepal’s banking frauds are governed by:

1. Banking Act, 2073 (BAFIA) – Primary law for fraud penalties.
2. Electronic Transactions Act, 2063 – Covers cyber-crime.
3. NRB Directives – Mandates fraud reporting and prevention.

A. Key Legal Provisions

B. NRB’s Fraud Prevention Measures

1. Mandatory Fraud Reporting:
   • Banks must report suspicious transactions > NPR 500K to NRB’s FIU within 24 hours.
2. Customer Education:
   • NRB’s "Be Cyber Smart" campaign (e.g., Khalti/Ncell workshops).
3. Technology Upgrades:
   • Biometric authentication for e-banking.
   • AI fraud detection (e.g., Nabil Bank’s real-time monitoring).

Visual: NRB’s Fraud Prevention Flow

flowchart TD
    A["Bank Detects Fraud"] -->|"Reports to NRB"| B["NRB's FIU"]
    B -->|"Investigates"| C["Legal Action"]
    C -->|"Recovers Funds"| D["Bank Compensation"]
    A -->|"Customer Education"| E["Reduces Future Fraud"]

4. Worked Example: Detecting & Preventing Fraud in a Kathmandu Retail Shop Loan

Scenario: A Kathmandu-based retail shop owner, Mr. Sharma, takes a NPR 2M loan from Nepal Bank Limited (NBL) for inventory. After 6 months, the bank suspects loan diversion.

Step 1: Identify Red Flags

Step 2: Bank’s Investigation Steps

1. Audit the Shop’s Books:
   • Check if NPR 2M was used for inventory (e.g., bills from suppliers).
   • Find: No bills found for NPR 1.8M.
2. Trace Loan Funds:
   • Bank statement analysis shows transfers to:
     • Personal account (NPR 1M)
     • Shell company (NPR 800K)
3. Collateral Check:
   • Loan was 50% secured by shop property.
   • Find: Property mortgage not updated in land records.

Step 3: Legal Action

• NBL reports to NRB’s FIU.
• NRB files a case under BAFIA 2073 (Section 104).
• Court orders seizure of shop property to recover NPR 1.2M.
• Mr. Sharma jailed for 4 years.

Visual: Loan Diversion Recovery

5. Exam Tip: How to Score Full Marks

This unit is highly application-based. Examiners test:

1. Fraud definitions (e.g., "What is check kiting?").
2. Real-world examples (e.g., "How did the Daraz LC fraud happen?").
3. Legal remedies (e.g., "What is NRB’s role in cyber-crime?").
4. Prevention strategies (e.g., "How can banks stop SIM swapping?").

Marks Distribution (Typical Exam Question)

Sample Answer Structure (10 Marks)

Question: "Explain loan diversion fraud with a real-world example. How can banks prevent it?"

Answer:

1. Definition (1 mark):

   "Loan diversion fraud occurs when a borrower misuses bank funds for personal use instead of the stated purpose (e.g., business expansion)."

2. Mechanics (4 marks):

   flowchart TD
       A["Borrower takes NPR 5M loan"] -->|"Bank transfers funds"| B["Borrower diverts to personal account"]
       B -->|"Uses for debts/gambling"| C["Business fails"]
       C -->|"Loan becomes NPA"| D["Bank loses NPR 5M"]

3. Real-world example (2 marks):

   "In 2023, a Pokhara Ncell vendor took a NPR 3M loan for a shop but used it to pay personal debts. The bank detected sudden withdrawals to 3 accounts and no shop records."

4. Red flags (2 marks):

   • No collateral updates in land records.
   • Credit score drops post-loan.
   • Withdrawals exceeding business needs.

5. Prevention (1 mark):

   *"Banks can prevent this via:

   • Real-time transaction monitoring (e.g., Nabil Bank’s AI).
   • Collateral verification (e.g., NRB’s mortgage checks).
   • Customer education (e.g., NRB’s workshops)."*

Final Tip: Always link frauds to past exam questions. For example:

• "Bank generates coinage of two parties" → Check kiting.
• "Bank should secure its investment" → Loan diversion prevention.