A logistics company in Gujarat’s Gandhidham has allegedly lost ₹8.46 crore after cybercriminals carried out 209 unauthorised debit transactions from its corporate bank account without triggering a single one-time password, OTP verification.

The incident has raised serious questions about corporate banking security, particularly how such a large number of transactions could reportedly be processed without the account holders receiving authentication requests.

Kutch East Cyber Crime Police have registered an FIR following a complaint by businessman Dilip Mokariya, who operates Shree Marutinandan Logistics in Mundra and Gandhidham. The company has alleged that its banking safeguards were bypassed, allowing funds to be transferred into multiple external accounts without its knowledge or authorisation.

How The Fraud Came To Light

According to the complaint, Shree Marutinandan Logistics maintained a cash credit/overdraft account with Yes Bank’s Gandhidham branch for its routine business transactions. Access to the corporate net banking facility required login credentials and OTP verification linked to the registered mobile numbers of Mokariya and his younger brother, Pravin.

The authentication arrangement was intended to ensure that financial transactions could not be completed without verification through the authorised mobile numbers.

The alleged fraud came to light on November 4, when Pravin suddenly began receiving a series of debit transaction alerts on his mobile phone. He reportedly received between 20 and 25 messages indicating that money was being withdrawn from the company’s account.

Alarmed by the unexpected transactions, the company immediately contacted its accountant to verify the account activity and determine whether the transfers had been authorised. What initially appeared to be a series of suspicious debits soon revealed a much larger financial breach, with the company discovering that crores of rupees had allegedly been transferred out of its account.

209 Transactions And An Alleged Delay In Freezing The Account

When the company’s accountant attempted to access the corporate net banking portal to investigate the suspicious debits, the session reportedly terminated unexpectedly, preventing further access to the account.

Businessman Dilip Mokariya then contacted Yes Bank branch manager Manish Chagrani and requested an immediate freeze on outgoing transactions to prevent any further withdrawals. However, according to the complaint, the account was not frozen in time, allowing additional unauthorised transfers to take place.

After regaining access to the banking portal, the company discovered that 209 debit transactions had been carried out, involving a cumulative amount of approximately ₹8.46 crore.

The money had allegedly been transferred rapidly into multiple external bank accounts, with individual transactions ranging from a few thousand rupees to as much as ₹50 lakh.

The company maintained that none of these transfers had been initiated or authorised by its representatives.

The scale and frequency of the transactions have raised questions about how the banking system permitted repeated high-value debits without flagging the activity or triggering an effective security intervention.

How Were OTP Security Checks Bypassed?

A central concern in the complaint is the alleged absence of OTP verification despite the company’s corporate banking facility requiring authentication through registered mobile numbers.

Mokariya claimed that neither his mobile number nor that of his brother received OTPs authorising the disputed transactions. Instead, debit confirmation messages reportedly began arriving only after substantial amounts had already been transferred out of the account.

This has raised questions about whether the criminals were able to bypass the bank’s authentication mechanism or compromise the company’s access to its online banking facility.

The company has reportedly raised the possibility that cybercriminals may have compromised the banking portal, diverted network traffic or SIM-related messages, or obtained unauthorised administrative access.

However, these are suspected methods rather than established findings, and the precise manner in which the transactions were executed remains unclear.

Investigators will need to establish whether the breach involved compromised login credentials, manipulation of authentication systems, unauthorised access to banking infrastructure or another form of cyber intrusion.

The absence of OTPs, if established, could become a particularly important aspect of the investigation into how the alleged fraud was carried out.

Police Register FIR As Investigation Focuses On Banking Transactions

Kutch East Cyber Crime Police have registered an FIR following Mokariya’s complaint and initiated an investigation into the alleged unauthorised transfers. Investigators will now have to trace the 209 transactions, identify the beneficiary bank accounts and establish how the money moved out of the company’s account.

The transaction records, net banking access logs and authentication data are likely to be central to determining whether the fraud involved compromised credentials, a breach of the banking system or manipulation of the OTP verification process.

The complaint also raises questions about the bank’s response after the company first reported the suspicious activity. Investigators will need to examine the sequence of communications with the branch, the timing of the freeze request and whether additional transfers could have been prevented. The precise mechanism of the alleged breach and the extent of any institutional lapse remain to be established.

India’s Banking Sector Faces A Wider Fraud Challenge

The Gandhidham incident comes amid continuing concerns over financial fraud across India’s banking sector, where the number of reported cases and the monetary value involved have not always moved in the same direction.

Data for the 2025-26 financial year indicates that public sector banks recorded more fraud incidents than private sector lenders, reversing a five-year pattern in which private banks had reported higher case volumes.

State-owned lenders have, however, consistently accounted for a larger share of the total monetary value involved in reported frauds. The shift indicates the continuing exposure of large banking institutions to financial irregularities, even as digital banking and electronic payment systems expand their reach.

A significant portion of the financial damage has historically originated from loan advances rather than routine retail banking transactions. Since 2018-19, credit-related frauds have accounted for more than 80% of the total fraud value reported across the banking system annually.

These cases typically involve irregularities in loan sanctioning, diversion of borrowed funds, misuse of credit facilities and fraudulent settlement arrangements. While incidents such as the alleged ₹8.46-crore cyber fraud in Gandhidham show vulnerabilities in digital transaction security, large-value lending irregularities continue to account for a substantial share of the banking sector’s reported financial exposure.

Internal Controls And Branch-Level Oversight Remain A Concern

Beyond large corporate loan frauds and digital banking breaches, weaknesses in internal controls have also exposed banks to unauthorised withdrawals and employee-assisted financial misconduct.

In a recent case involving Punjab National Bank’s Greater Noida branch, the Central Bureau of Investigation arrested an office assistant and a private individual over alleged unauthorised withdrawals from customer accounts.

The investigation indicated that access to internal banking operations had allegedly been misused to transfer depositor funds without their consent, bringing branch-level supervision and employee access controls under scrutiny.

Such incidents highlight the different vulnerabilities confronting India’s banking system, from sophisticated cyber intrusions targeting corporate accounts to the alleged misuse of access by employees within bank branches.

The Gandhidham fraud adds another dimension to these concerns, particularly the question of how 209 transactions involving ₹8.46 crore could reportedly be processed without the account holders receiving the expected OTPs.

While the precise mechanism remains under investigation, the incident indicates the importance of stronger transaction monitoring, authentication safeguards and timely intervention when suspicious activity is detected.

For banks, protecting customer funds increasingly requires addressing vulnerabilities both within their digital infrastructure and across their internal operational systems.