When the people entrusted with protecting the money become part of the alleged problem

A customer walks into a bank to update a passbook and discovers that money has allegedly disappeared from savings accounts and fixed deposits.

A government department approaches its bank to close an account and transfer its funds, only to discover that the balance reflected in its records does not match the balance acknowledged by the bank.

In another branch, employees allegedly manipulate banking credentials, transaction documents or authorisation procedures, while money moves through accounts belonging to other individuals and entities.

These are not imaginary banking scenarios. They are among the disturbing circumstances that have emerged from two major banking controversies involving Punjab National Bank (PNB) and IDFC First Bank during 2026.

One concerns the alleged diversion of customer savings and fixed deposits from a PNB branch in Greater Noida. The other concerns the alleged diversion of hundreds of crores of rupees belonging to Haryana government departments and other public institutions through banking arrangements involving IDFC First Bank and AU Small Finance Bank.

The financial scale is different. The victims are different. The alleged methods are not identical. The investigation into the IDFC-related case is considerably more advanced.

But the similarities are difficult to ignore.

Both cases raise questions about how bank employees allegedly became involved in transactions that customers or government departments say they never authorised, how external beneficiaries allegedly entered the picture, how documentary and transaction controls were circumvented, and why discrepancies were not identified earlier through ordinary banking supervision.

The most troubling question is perhaps the simplest:

If banking institutions cannot reliably protect the deposits recorded in their own systems, what exactly are customers and public institutions paying them to safeguard?

The problem is not merely the money allegedly diverted. It is the apparent vulnerability of the very systems that are supposed to make such diversion difficult.

PART I — UNDERSTANDING THE TWO CASES

1. The PNB Greater Noida case: An alleged ₹10.24-crore diversion from customer accounts

The PNB controversy concerns its Sector Pi/Accher branch in Greater Noida, Uttar Pradesh.

The matter came into public attention in October 2026 after customers began reporting discrepancies in their savings accounts and fixed deposits.

Several affected individuals were reportedly farmers and families who had received compensation for land acquired for the Jewar Airport project.

For many of these account holders, the deposits represented substantial portions of their life savings.

Media reports initially carried allegations of approximately ₹12 crore and, in some reports, nearly ₹35 crore in missing money. The number of complainants was reported to have reached 25.

However, an important distinction emerged when PNB submitted its complaint to the Central Bureau of Investigation.

According to the bank’s complaint, the amount of unauthorised debits identified at that stage was approximately ₹10.24 crore.

The exact amount remained under reconciliation.

The bank’s complaint led to a CBI case registered in October 2026. The CBI named a branch office assistant, Deepanshi, an account holder, Ashutosh Pathak, and unknown public and private persons as accused.

The allegations include criminal conspiracy, breach of trust, cheating, falsification of accounts and related offences under the Bharatiya Nyaya Sanhita, Prevention of Corruption Act and Information Technology Act.

The alleged modus operandi

The preliminary investigation described in the bank’s complaint raises several significant concerns.

A. Misuse of banking credentials

The complaint alleges that transactions were carried out by misusing CBS user IDs and passwords assigned to six other bank officials.

This is particularly serious.

Core Banking Solution credentials are not merely technical login details. They establish the identity and authority of employees executing financial transactions.

If an unauthorised employee can allegedly conduct transactions using the credentials assigned to multiple officials, the investigation must establish whether the credentials were shared, compromised, obtained without consent or inadequately protected.

The role of each credential holder must also be established.

B. Missing transaction vouchers

The bank reportedly discovered that supporting vouchers for some disputed transactions were missing.

The complaint alleges that vouchers relating to unauthorised transactions were destroyed because there were no genuine customer instructions or approvals supporting those transfers.

This raises questions concerning physical document custody, transaction verification, audit trails and branch-level reconciliation.

C. Manipulation of fixed deposits

The alleged fraud was not confined to ordinary savings-account debits.

The complaint describes suspected manipulation of fixed deposits, including:

• Addition of other individuals as joint holders.
• Changes to repayment-account details.
• Premature closure of fixed deposits.
• Diversion of proceeds from closed deposits into beneficiary accounts.

Such transactions require scrutiny because an FD is ordinarily expected to remain protected against unauthorised changes to ownership, repayment instructions and maturity-related arrangements.

D. Disabling or altering SMS alerts

The complaint further alleges that mobile transaction alerts associated with certain customer accounts were disabled before some unauthorised transactions.

This could have delayed customers’ discovery of the alleged diversion.

A transaction alert system is an important customer-protection mechanism. Disabling or manipulating it, where established, would undermine one of the basic safeguards against unauthorised transactions.

E. Routing through intermediary accounts

The complaint identifies multiple beneficiary accounts through which customer money was allegedly routed.

The reported transaction trail includes accounts associated with Ashutosh Pathak and several other individuals.

The investigating agencies must establish the ultimate recipients, the actual use of the money, and whether every beneficiary was aware of the alleged underlying transactions.

How was it discovered?

The case reportedly surfaced when a customer, identified in media reporting as Sangeeta, visited the branch with family members to update her passbook.

She noticed three transactions dated September 16, 2026, which she said she had not authorised.

The bank subsequently examined the transactions, and the relevant vouchers could not be located.

The complaint also records an alleged admission by the employee during internal questioning. That alleged admission must be independently tested against documentary and digital evidence.

The CBI’s registration of the case represents an important investigative development, but does not establish anyone’s guilt.

As of October 31, 2026, the reported bank-identified amount was ₹10.24 crore, while earlier customer and police estimates were higher. PNB reportedly stated that it had settled three genuine claims totalling ₹43 lakh and would honour other verified claims.

The difference between the reported estimates and the amount in the bank’s CBI complaint makes a comprehensive account-wise reconciliation essential.

2. The IDFC First Bank case: Hundreds of crores of government funds allegedly diverted

The IDFC First Bank controversy is considerably wider in its financial and institutional dimensions.

The matter first became public in February 2026 after discrepancies emerged between the balances recorded by Haryana government departments and the amounts reflected by the bank.

The controversy involved accounts maintained at IDFC First Bank’s Sector 32 branch in Chandigarh.

Haryana government departments and other public institutions had maintained funds and fixed deposits through the branch.

On February 21, 2026, IDFC First Bank disclosed to stock exchanges that its preliminary assessment had identified unauthorised and fraudulent activities involving certain employees and potentially other individuals and entities.

The initially disclosed amount under reconciliation was approximately ₹590 crore.

Four suspected bank officials were initially placed under suspension pending investigation.

The bank subsequently disclosed that preliminary findings indicated fraudulent clearing of forged instruments and payment instructions, potentially involving collusion with external parties.

The expansion of the investigation

The matter was not confined to an internal bank investigation.

The Haryana State Vigilance and Anti-Corruption Bureau registered an FIR in February 2026.

The Enforcement Directorate initiated a money-laundering investigation under the Prevention of Money Laundering Act.

The CBI subsequently took over the principal Haryana government funds investigation and began investigating associated matters involving public institutions in Chandigarh.

The case expanded to include alleged diversion of funds involving:

• Haryana government departments.
• Municipal corporations and other government bodies.
• Chandigarh Smart City Limited.
• Chandigarh Renewable Energy and Science & Technology Promotion Society (CREST).
• Accounts maintained at IDFC First Bank and AU Small Finance Bank.

It is important to distinguish these connected proceedings. They are not one undifferentiated transaction or a single loss figure attributable exclusively to IDFC First Bank.

The numbers: Why the figures require careful examination

The figures published at different stages of the investigation are not identical.

Investigation or disclosure	Reported amount
IDFC First Bank’s initial February disclosure	₹590 crore
ED’s March 2026 estimate	Approximately ₹597 crore
KPMG forensic review of IDFC-linked accounts	₹645.59 crore net principal
CBI Haryana government funds case	Approximately ₹504 crore
Broader reported cluster involving Haryana and connected Chandigarh matters	Approximately ₹657 crore

These figures relate to different investigative scopes, account populations and stages of reconciliation. They must not be added together or represented as separate losses without establishing their overlap.

The particularly important KPMG forensic report

On June 5, 2026, IDFC First Bank disclosed that it had received KPMG’s forensic review report.

This document is especially important because it provides considerably more detail about the alleged mechanism of the transactions.

The review examined 56 government banking and trust-related accounts associated with the affected Chandigarh branch.

It identified claims relating to 13 of those accounts.

The report quantified the net principal claims at ₹645.59 crore, after adjustment of available credit balances amounting to ₹94.32 crore. Interest of ₹30.60 crore was also paid on these accounts.

The affected accounts included 11 government accounts and two school accounts.

The remaining 43 accounts were approached for balance confirmation, and no additional claim was identified in the review, apart from a potential claim of approximately ₹5 crore relating to one account.

The bank stated that it had paid the quantified principal and interest.

The KPMG review period was October 1, 2024, to February 28, 2026.

Crucially, this was not a general audit of every IDFC First Bank branch. It was a targeted forensic review of the incident and the specified accounts. KPMG expressly stated that its work was not an audit or assurance engagement and that its findings were subject to stated scope and information limitations.

Nevertheless, the findings are significant.

KPMG identified alleged collusion involving certain bank employees, former employees, employees of government customers and third parties.

It also found that branch-level manual controls had been circumvented.

That is the central governance issue.

PART II — HOW THE TWO ALLEGED FRAUDS OPERATED

3. Similarity No. 1: Bank employees allegedly played a central role

The first important similarity concerns the alleged involvement of employees within the banking system.

In the PNB case, the bank’s complaint identifies an office assistant and alleges misuse of credentials belonging to other officials.

In the IDFC First Bank case, the KPMG forensic review identified collusion involving current and former employees of the affected branch, customer-side employees and external persons.

The CBI’s investigation into the broader Haryana funds case has also led to chargesheets against bank officials and public servants.

These allegations are particularly consequential because ordinary customers and institutional depositors have little visibility into the internal processes through which their money moves.

They depend on the bank’s staff, procedures, audit controls and transaction-monitoring systems.

When an allegation involves employees allegedly exploiting the very systems they are required to operate responsibly, the issue moves beyond an individual transaction.

It becomes a question of institutional control.

A bank cannot reasonably expect customers to independently monitor employee credentials, verify every internal voucher or investigate the authenticity of its own account statements.

That responsibility belongs to the institution.

4. Similarity No. 2: The alleged involvement of outsiders and external beneficiaries

Neither controversy can be understood exclusively through the conduct of bank employees.

In the PNB case, the complaint describes an alleged relationship between the branch employee, an account holder and other beneficiary accounts.

In the IDFC investigation, external individuals and entities reportedly played a major role in the movement of government money.

The KPMG review identified recipients with accounts across multiple financial institutions. Some recipients were reported to have familial or business connections with former branch employees.

The Enforcement Directorate also identified alleged beneficiary entities and searched premises connected to individuals and businesses.

These developments make beneficiary tracing particularly important.

A financial investigation cannot stop at identifying the person who allegedly initiated a transaction.

It must follow the money through each intermediary account, identify the beneficial owners and determine who ultimately obtained control of the funds.

A transaction trail that ends with the first recipient is an incomplete investigation.

5. Similarity No. 3: Manipulation of documents and authorisation processes

This is one of the strongest areas of comparison.

Both cases involve allegations that the transaction documentation or approval framework was compromised.

However, the methods differed.

PNB: Alleged credential misuse and missing vouchers

The PNB complaint refers to:

• Misuse of CBS credentials.
• Missing transaction vouchers.
• Changes to customer-account particulars.
• Alleged manipulation of fixed-deposit arrangements.
• Premature closure of FDs.
• Changes to repayment-account details.
• Alleged disabling of transaction alerts.

IDFC First Bank: Alleged forged and modified banking documents

KPMG’s review identified a different mechanism.

The report states that potentially modified or edited:

• Authorisation letters.
• Cheques, including the alleged misuse of certain cheques.
• Approval emails.

were attached to transaction vouchers by branch staff.

The report also identified signature inconsistencies.

In certain instances, non-existent Fixed Deposit Advices, edited interest certificates and modified bank statements were allegedly shared with customers.

This is a major revelation because it demonstrates how documentary processes can potentially be manipulated even when banking systems themselves maintain electronic transaction records.

The difference is critical: PNB’s complaint identifies alleged misuse of digital credentials, whereas IDFC’s forensic report describes alleged manipulation of supporting documents and circumvention of manual branch-level controls.

Both expose weaknesses in the relationship between an instruction, the supporting document, the individual authorising it and the final movement of money.

6. Similarity No. 4: Money allegedly moved through intermediary accounts

The alleged diversion of funds was not described as a single direct transfer to one beneficiary.

In the PNB case, money was reportedly routed through multiple accounts before reaching the account of the suspected principal beneficiary.

In the IDFC case, the investigations uncovered a much broader alleged network of shell companies, beneficiary entities, individuals and other bank accounts.

The ED’s March investigation identified entities such as:

• Swastik Desh Projects.
• Capco Fintech Services.
• Maa Vaibhav Laxmi Interiors.
• SRR Planning Gurus Private Limited.

The investigation subsequently examined transactions involving jewellers and other commercial entities.

The ED’s September 30 search operations reportedly focused on allegations that public funds had been routed through jewellery businesses and projected as ordinary business transactions.

The CBI’s September chargesheet in the Haryana case also described the alleged movement of funds through multiple accounts, followed by conversion into cash.

This is an important similarity.

The investigation must establish not merely where the money was first transferred, but where it ultimately went.

7. Similarity No. 5: The failures were allegedly sustained rather than isolated transactions

The duration of the suspected activity is another important commonality.

The PNB complaint states that unauthorised transactions occurred over approximately three years.

The IDFC forensic review examined the period from October 2024 to February 2026.

The broader investigation has also examined transactions and relationships dating back to 2024.

The central question is obvious:

How did repeated transactions allegedly take place over such extended periods without being identified and stopped earlier?

Banking institutions have multiple layers of control:

• Daily transaction monitoring.
• Branch-level supervision.
• Maker-checker authorisation.
• Transaction alerts.
• Customer statements.
• Reconciliation procedures.
• Internal audits.
• Concurrent audits.
• Vigilance mechanisms.
• Exception reporting.
• Risk-based monitoring.

These controls exist precisely because no bank can operate safely on the assumption that every employee will always act honestly.

The existence of monitoring procedures is not evidence of their effectiveness.

Their effectiveness must be demonstrated by the ability to detect suspicious activity promptly.

8. Similarity No. 6: External parties or customers reportedly played a role in exposing discrepancies

Another striking similarity concerns the manner in which the controversies became visible.

In the PNB case, the issue surfaced after a customer questioned suspicious transactions while updating a passbook.

In the IDFC case, the discrepancies reportedly came to light after government departments sought clarification regarding their balances and requested closure or transfer of funds.

This is a fundamental institutional concern.

Why should a customer have to visit a branch to discover that transactions have allegedly been carried out without authorisation?

Why should a government department need to initiate an account-closure process before discrepancies between institutional records and bank balances become apparent?

An effective fraud-monitoring system should be capable of identifying suspicious patterns independently of a customer’s complaint or a department’s decision to move its money elsewhere.

The public should not have to become the bank’s internal audit department.

PART III — THE MOST IMPORTANT DIFFERENCE: HOW THE CONTROL SYSTEMS ALLEGEDLY FAILED

9. PNB and IDFC: A comparison of the actual mechanisms

The following table separates the reported facts from broader analytical conclusions.

Parameter	PNB Greater Noida	IDFC First Bank
Primary affected accounts	Individual savings and fixed deposits	Government, public-institution and school accounts
Main reported amount	₹10.24 crore in the bank’s CBI complaint	₹645.59 crore net principal in KPMG’s review
Reported period	Approximately three years	KPMG review: October 2024–February 2026
Alleged employee involvement	Branch office assistant and other persons	Current/former bank employees and customer-side personnel
Digital access issue	Alleged misuse of six officials’ CBS credentials	KPMG found the bank’s CBS records accurate
Document manipulation	Missing vouchers, FD and account-detail changes	Allegedly modified cheques, authorisation letters, emails and FD documents
SMS alerts	Allegedly disabled or altered for some accounts	Bank reported monthly statements and applicable SMS alerts; KPMG found some confirmations inaccurate
External beneficiaries	Individuals and intermediary accounts	Shell entities, third parties, businesses and other bank accounts
Detection	Customer identified suspicious debits	Government departments identified balance discrepancies
Initial investigation	PNB internal examination and CBI registration	State Vigilance, CBI, ED and independent forensic review
Reimbursement	₹43 lakh in three claims reported settled at the PNB branch stage	₹645.59 crore principal plus ₹30.60 crore interest reported paid
Investigation status on 31 October 2026	Newly registered CBI case	Multiple CBI chargesheets, ED proceedings and arrests

The table exposes an important distinction.

The IDFC report states that the bank’s Core Banking System records were accurate and that broadly established system controls existed, but certain transactions were allegedly processed by circumventing manual controls through collusion.

In PNB, the allegations specifically concern unauthorised use of multiple officials’ CBS credentials.

Therefore, these are not identical cybersecurity failures.

However, both cases demonstrate why digital controls and documentary controls must operate together.

A transaction may technically appear in a banking system while the underlying instruction authorising it is fraudulent.

Conversely, an employee may exploit another official’s digital credentials to create the appearance of an authorised transaction.

The banking institution must secure both the transaction and its authorisation.

PART IV — THE IDFC INVESTIGATION: A MUCH WIDER NETWORK OF ALLEGED PUBLIC-FUND DIVERSION

10. The Haryana government connection and the alleged banking-business nexus

The IDFC controversy became significantly more serious when investigators began tracing the alleged diversion of public funds through multiple banks and beneficiary entities.

The CBI’s Haryana funds case covers eight government departments and public bodies.

These include:

1. Panchayat Department.
2. Municipal Corporations of Panchkula and Kalka.
3. Haryana School Shiksha Pariyojna Parishad.
4. Haryana Labour Welfare Board.
5. Haryana State Agricultural Marketing Board.
6. Haryana State Pollution Control Board.
7. Haryana Power Generation Corporation Limited.

The CBI’s case describes alleged collusion between public servants and officials of IDFC First Bank and AU Small Finance Bank in moving funds from empanelled banks into selected branches.

This is far more than a routine branch-level accounting irregularity.

The allegations concern how government money was allegedly moved through institutional banking arrangements, how transactions were supported by documents and what happened after the funds reached the recipient accounts.

The ₹50-crore HPGCL deposit and the alleged 14% interest offer

A particularly important strand of the CBI investigation concerns the Haryana Power Generation Corporation Limited (HPGCL).

According to the CBI chargesheet reporting published by The Indian Express on July 16, investigators alleged that IDFC branch officials offered an annual interest rate of 14% to induce HPGCL to deposit ₹50 crore with the bank.

The report states that the interest offer was not the bank’s official rate.

The CBI’s case alleges that this arrangement facilitated the movement of government funds and was part of the wider alleged conspiracy.

These are prosecution allegations, not a judicial finding of guilt.

Nevertheless, the episode raises important questions about treasury management and the due diligence expected when government departments place large sums of public money in financial institutions.

Why was the offer made?

Who approved it?

Was the deposit consistent with government financial guidelines?

Were the comparative rates independently examined?

Were higher officials informed?

These questions require answers from all concerned departments and institutions.

11. ED’s investigation: The alleged movement of money through commercial businesses

The Enforcement Directorate’s investigation provides another important dimension.

On March 12, 2026, the ED searched 19 premises across Chandigarh, Mohali, Panchkula, Gurugram and Bengaluru.

Its March 13 press release described an alleged diversion of approximately ₹597 crore in public funds linked to Haryana government departments, Chandigarh Municipal Corporation and other government accounts.

The ED identified several former bank employees, family members, beneficiary entities, jewellers and real-estate interests during its investigation.

In July 2026, the ED reportedly attached assets worth approximately ₹200.83 crore.

The agency also filed a prosecution complaint before the Special PMLA Court against 14 entities.

On September 30, the ED conducted further searches at 14 premises across Chandigarh, Mohali and Panchkula.

The investigation reportedly examined the alleged routing and layering of funds through jewellery businesses and related entities, with transactions allegedly presented as normal commercial activity.

This is an important investigative development because it moves the focus beyond the branch that processed the original transactions.

The question is no longer only how the money left the government accounts.

It is also how the money was allegedly converted, distributed, layered and potentially used to acquire assets.

A complete investigation must establish both the originating transactions and the ultimate beneficial ownership of the assets.

12. CBI chargesheets and the scale of the investigation

By September 2026, the CBI’s Haryana government funds case had advanced substantially.

On September 2, the agency filed its third chargesheet against 19 accused persons.

The chargesheet reportedly included:

• Six Haryana-cadre IAS officers.
• Three IDFC First Bank officers.
• One AU Small Finance Bank officer.
• Nine other Haryana government officials.

The total number of accused chargesheeted in the Haryana funds case reportedly reached 37, with 26 arrested at that stage.

The alleged offences include criminal conspiracy, cheating, destruction of evidence, forgery, use of forged documents as genuine, falsification of accounts, criminal breach of trust, abetment, bribery and criminal misconduct.

The CBI also took over related investigations concerning Chandigarh Smart City Limited, the Chandigarh Municipal Corporation and CREST, with chargesheets reportedly filed in those matters too.

The wider connected cluster has been reported at approximately ₹657 crore.

These investigations should not be treated as proof of the guilt of every person chargesheeted. They do, however, demonstrate that the IDFC-related matter has expanded into a significant multi-agency investigation involving banking personnel, public officials, private beneficiaries and multiple institutions.

The October 31, 2026 bail development

In the latest important judicial development, a Special CBI Court rejected the regular bail application of Chandigarh-based businessman Vikram Wadhwa on October 30, with the decision reported on October 31.

According to The Times of India’s account of the order, the CBI alleged that Wadhwa received approximately ₹37.82 crore in proceeds, including ₹4.57 crore in cash delivered through couriers and approximately ₹33.25 crore through accounts of shell entities.

The reported order also referred to 132 calls exchanged between Wadhwa and former IDFC First Bank branch manager Ribhav Rishi between June 2024 and January 2026.

The prosecution alleged that Wadhwa acted as a conduit in the alleged movement and layering of funds.

The court’s rejection of bail is not a conviction. It is a judicial decision on bail based on the material and circumstances presented at that stage.

Nevertheless, the development demonstrates the scale and seriousness of the continuing investigation.

PART V — THE PNB CONTROVERSY BEYOND THE ₹10.24-CRORE CASE

13. Outsiders allegedly handling banking operations: Another disturbing development at PNB

The Greater Noida case is not the only PNB-related controversy that has emerged in October 2026.

On October 27, surprise inspections at certain PNB branches reportedly found private individuals assisting employees with banking operations.

Moneylife reported approximately 20 branch-head suspensions on October 30.

Hello Banker subsequently reported that the figure had risen to around 50.

The reported outsiders included generator operators, recovery agents, insurance representatives, Business Correspondents and other private individuals.

One especially concerning incident reportedly involved an outsider assisting a cashier inside a cash cabin at approximately 11:27 AM on October 27.

A subsequent examination of CCTV footage allegedly showed the outsider assisting in the daily cash-closing process between 4 PM and 5 PM.

PNB reportedly issued a fresh advisory on October 30 directing branches to protect access to CBS, computers, records and other bank assets, and not to share user IDs or passwords.

The officers’ association has raised concerns about staffing shortages and the fairness of disciplinary proceedings.

Why this deserves attention in the comparison

This is a separate matter from the Greater Noida suspected fund diversion.

There is no verified evidence establishing that the outsiders found during the nationwide inspections were connected with the Greater Noida allegations.

However, the two matters raise overlapping questions about access governance.

If a bank has unauthorised individuals working on branch computers or assisting with sensitive cash operations, management must examine how its physical and digital access controls are being enforced.

If a separate branch is simultaneously facing allegations involving misuse of CBS credentials, it becomes particularly important to examine whether access-control policies are consistently implemented.

It would be inaccurate to conclude that the two incidents prove one another.

It would be equally irresponsible to ignore the wider operational questions they collectively raise.

A bank’s security policy has little value if employees can routinely bypass it without effective detection.

PART VI — THE DEEPEST SIMILARITIES: WHAT THESE TWO CASES TELL US ABOUT BANKING GOVERNANCE

14. The weakness of relying excessively on individual employee integrity

Both controversies expose a fundamental problem with any institution that relies too heavily on the honesty of the people operating its internal processes.

No banking institution should assume that the presence of a bank employee automatically makes a transaction legitimate.

No banking system should accept an internal approval merely because the transaction was processed using an employee ID.

No bank should consider a document genuine simply because it is attached to a transaction voucher.

Effective control requires independent verification.

Segregation of duties, dual authorisation, maker-checker controls, access restrictions, independent customer confirmations and audit trails must operate as meaningful safeguards.

Where an employee can allegedly circumvent several of these controls through collusion, the design and implementation of those controls deserve scrutiny.

15. The danger of false documentation

The IDFC KPMG report is particularly instructive because it describes alleged manipulation of supporting documentation even where electronic banking records were accurate.

This is a sophisticated control problem.

Consider the distinction:

A banking system may correctly record that a transaction was initiated and approved using the credentials assigned to an employee.

But the customer may never have authorised it.

The attached cheque may be forged.

The approval email may be altered.

The fixed-deposit advice may not exist.

In such a situation, the electronic record establishes that the transaction occurred; it does not automatically establish that the underlying instruction was genuine.

The PNB case raises a related but different issue: if another person can allegedly execute transactions under an employee’s credentials, the identity recorded by the system may not correspond to the actual person operating it.

Both scenarios demonstrate why a bank must establish the authenticity of the underlying authority, not merely the existence of a system entry.

16. The failure of transaction monitoring and early-warning systems

Both cases raise serious questions about early detection.

In the PNB case, the bank’s complaint alleges that SMS alerts were disabled for certain accounts.

In the IDFC case, the bank stated that monthly statements and applicable SMS alerts were provided. However, KPMG found that certain customer-side confirmations were inaccurate and that branch-level manual controls had been circumvented.

This is an important distinction.

The mere generation of an SMS alert or bank statement does not prove that the account holder actually received, examined or verified it.

Likewise, a confirmation obtained through a potentially compromised representative is not necessarily an independent confirmation.

A strong verification system should establish that the confirmation came from a genuinely authorised person using an independently validated communication channel.

A bank cannot rely on a confirmation from an individual whose involvement is itself under investigation.

17. The risk of collusion between the inside and outside

Both cases demonstrate why collusion is among the most difficult risks for banking institutions.

Ordinary controls are often designed to prevent one person from acting alone.

But what happens when multiple participants allegedly cooperate?

A staff member may process a transaction.

Another person may provide or obtain the supporting documents.

A third party may receive the funds.

An intermediary may move the money.

The final beneficiary may have no apparent connection with the original account holder.

This is why banks require multiple, independently functioning control mechanisms.

The risk is not simply an unauthorised transaction.

It is the possibility that multiple layers of an otherwise legitimate process may be manipulated together.

PART VII — WHO MUST BE HELD ACCOUNTABLE?

18. Accountability cannot stop at the cashier, office assistant or branch manager

The most important institutional lesson from both controversies is that responsibility must be examined at every level.

The employees who allegedly processed unauthorised transactions must be investigated.

The external persons who allegedly received or routed the funds must be traced.

The officials responsible for approving documentation must be examined.

But the inquiry must also consider whether regional and senior management systems were adequate.

The following questions deserve answers:

At branch level:

• Who initiated the transactions?
• Who authorised them?
• Who verified the supporting documents?
• Were employee access credentials compromised?
• Were transaction vouchers retained?
• Did cash and deposit reconciliations reveal anomalies?
• Were complaints ignored?

At the regional and zonal level:

• Were abnormal transactions escalated?
• Were branches subject to effective independent audits?
• Were warnings or complaints received?
• Were exceptions investigated?
• Were staffing or operational deficiencies reported?

At the head-office level:

• Were adequate internal-control policies in place?
• Were fraud-risk indicators operating effectively?
• Were transaction patterns monitored centrally?
• Were customer-confirmation processes adequately independent?
• Were third-party relationships properly supervised?
• Did the Board’s Audit Committee receive timely and complete information?

These are institutional governance questions.

They are not allegations that any particular senior executive or director has committed an offence.

But leadership accountability should not disappear merely because a criminal investigation identifies individuals at branch level.

PART VIII — WHAT THE RBI’S REGULATORY FRAMEWORK EXPECTS

19. The regulatory framework already recognises these risks

The Reserve Bank of India issued its revised Master Directions on Fraud Risk Management for Commercial Banks and All India Financial Institutions on July 15, 2024.

The directions emphasise:

• Board-level governance and oversight.
• Early-warning signals.
• Red-flagging and fraud detection.
• Independent internal controls.
• Staff accountability.
• Reporting to investigating agencies and the RBI.
• The role of auditors in fraud-risk management.

The RBI also issued its Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices in November 2023.

The regulatory framework therefore recognises that preventing fraud requires more than ordinary branch supervision.

It requires a comprehensive approach to access control, risk monitoring, technology governance, segregation of duties and institutional accountability.

Both IDFC First Bank and PNB need to demonstrate that their controls are effective in actual operating conditions.

A policy document cannot prevent fraud merely by existing in a compliance manual.

A password policy cannot protect customers if credentials are allegedly misused.

A cheque-verification process cannot protect government funds if forged supporting documents are accepted.

An audit mechanism cannot provide meaningful protection if suspicious patterns remain undetected for years.

The test is implementation, not paperwork.

PART IX — WHAT NEEDS TO HAPPEN NOW

20. Ten urgent measures that banking regulators and investigators should demand

1. Independent forensic examination of the PNB Greater Noida branch

PNB should ensure a comprehensive independent examination covering the entire suspected period.

This should include CBS access logs, credentials, transaction histories, system alerts, fixed-deposit records, vouchers, CCTV footage, device records and beneficiary accounts.

The scope should not be limited to the transactions already identified in the initial complaint.

2. Independent verification of employee credentials

Investigators should establish precisely how the six officials’ credentials allegedly came to be used.

The inquiry should determine whether there was password sharing, unauthorised access, compromised devices or other weaknesses in the access-control environment.

3. Full reconstruction of the IDFC money trail

The CBI and ED should continue tracing the movement of funds through every intermediary and beneficiary account.

This should include the identification of ultimate beneficial owners, related entities, property acquisitions and cash withdrawals.

4. Comprehensive cross-bank examination

The PNB and IDFC investigations should establish whether any funds moved through other regulated financial institutions and whether the recipient banks conducted appropriate scrutiny.

This is particularly relevant to the IDFC investigation, where the KPMG report identified recipient accounts across multiple banks.

However, no receiving bank should be presumed complicit merely because an account received funds.

5. Verification of government treasury controls

The Haryana investigation should examine the circumstances in which public departments allegedly transferred funds into selected banking arrangements.

Every government department should be required to produce deposit approvals, comparative interest-rate records, treasury instructions, account mandates and relevant correspondence.

6. Strengthening customer confirmation systems

Banks should introduce independently verified confirmations for high-value fixed-deposit closures, changes in joint-holder details and changes to repayment instructions.

A confirmation obtained through a potentially compromised internal channel must not become the sole basis for releasing substantial funds.

7. Review of branch-level audit mechanisms

RBI should examine whether current inspection and internal audit procedures are sufficiently capable of detecting collusion between branch employees and external parties.

A routine checklist may not identify organised or repeated manipulation.

8. Time-bound disciplinary proceedings

Employees against whom evidence is established must face appropriate proceedings.

At the same time, disciplinary action must distinguish proven misconduct from mere association, administrative oversight or unverified allegations.

Suspension cannot become a permanent substitute for a reasoned disciplinary decision.

9. Transparent customer reimbursement

PNB must complete customer-wise reconciliation and honour all genuine claims.

IDFC First Bank’s reported reimbursement of the quantified principal and applicable interest is an important customer-protection step.

Nevertheless, reimbursement does not remove the need to identify the people responsible or recover the money from the alleged perpetrators.

10. Speedy criminal investigation and judicial proceedings

The CBI, ED and other competent authorities should coordinate their investigations to prevent duplication, evidence gaps and unnecessary delay.

Financial trails must be established through forensic banking records, device evidence, beneficiary-account analysis and property documentation.

The courts should be provided with complete and properly investigated cases so that trials can progress without avoidable delay.

The objective should be a fair, evidence-based and speedy determination of criminal responsibility.

PART X — THE BIGGER QUESTION: IS THE BANKING SYSTEM PROTECTING DEPOSITORS OR MERELY PROCESSING TRANSACTIONS?

21. The uncomfortable comparison

The PNB case reportedly involves a bank employee allegedly using credentials assigned to other officials to carry out unauthorised transactions.

The IDFC investigation describes alleged collusion involving employees, government customer-side personnel and external parties to circumvent branch-level controls.

The PNB case raises questions about account access, passwords, fixed deposits and customer alerts.

The IDFC case raises questions about documentary authorisation, government treasury decisions, account-opening procedures, forged banking instruments and the movement of public funds through multiple entities.

The similarities are not merely superficial.

Both investigations expose the possibility that an apparently routine banking process can be manipulated if its internal safeguards are not independently effective.

The most worrying feature is the apparent duration of the suspected activity.

A bank is expected to identify unusual transactions, irregular account changes, premature fixed-deposit closures and discrepancies in balances.

These are not obscure financial phenomena.

They are precisely the areas where banks are expected to maintain effective monitoring and reconciliation systems.

If a transaction can pass through multiple internal processes without the necessary authority, then the problem deserves more than another internal circular.

22. The difference between returning money and establishing accountability

There is one important difference between the institutional responses.

IDFC First Bank reported payment of ₹645.59 crore in principal claims and ₹30.60 crore in interest, based on its KPMG-reviewed disclosures.

PNB reported settling three claims totalling ₹43 lakh in the Greater Noida case at the time of the October investigation and stated that it would honour genuine claims.

These developments matter.

Customers and government departments should not be forced to bear the financial consequences of unauthorised transactions merely because criminal proceedings are pending.

But reimbursement alone cannot settle the matter.

A bank returning money to its customers does not answer how unauthorised transactions were possible.

It does not identify every person who allegedly received the funds.

It does not establish whether the bank’s internal systems were functioning properly.

And it certainly does not replace criminal accountability.

Recovery, restitution and prosecution are three separate responsibilities.

All three must be pursued.

23. Why the IDFC forensic report should be studied beyond IDFC

There is a particular lesson in the IDFC KPMG report that deserves the attention of every banking institution.

The report’s findings do not suggest that every fraud requires a sophisticated technical breach or the hacking of a banking platform.

According to the review, broadly established system controls existed, but certain transactions were allegedly processed through collusion and by circumventing manual controls.

This is an important warning.

Technology alone cannot prevent financial misconduct when people controlling the underlying authorisation process allegedly cooperate to bypass safeguards.

The same principle applies to the PNB case, where allegations involve the misuse of other employees’ credentials.

A secure banking environment requires independent verification of the person, the authority, the transaction, the supporting documents and the beneficiary.

All these elements must work together.

24. The question of institutional credibility

PNB is one of India’s largest public-sector banks.

IDFC First Bank is a major private-sector banking institution.

Their respective controversies demonstrate that neither ownership structure automatically guarantees freedom from operational misconduct or fraud risk.

A public-sector bank cannot rely exclusively on its government ownership and established branch network as evidence of safety.

A private-sector bank cannot rely exclusively on technology, digital transformation, modern infrastructure or corporate governance disclosures as evidence of safety.

Both are expected to maintain effective safeguards.

The customer does not care whether a bank is public or private when an unauthorised transaction appears in the account.

The government department does not care about the bank’s marketing claims when its deposit balance fails to reconcile.

The depositor wants money to remain safe, records to remain accurate and authorised transactions to be executed only on genuine instructions.

That is the basic banking contract.

CONCLUSION: DIFFERENT BANKS, DIFFERENT METHODS, BUT THE SAME QUESTIONS ABOUT TRUST AND CONTROL

The PNB Greater Noida alleged ₹10.24-crore case and the IDFC First Bank-linked Haryana public-funds investigation are not identical scandals.

One is a newly registered CBI case concerning individual customer accounts, alleged credential misuse and fixed-deposit manipulation.

The other has developed into a wide-ranging multi-agency investigation involving hundreds of crores in reported public-fund diversion, alleged collusion between banking personnel and government officials, beneficiary networks, shell entities and money-laundering allegations.

The IDFC investigation is considerably more advanced, with multiple chargesheets, arrests, ED asset attachments and judicial scrutiny.

The PNB investigation is at an earlier stage and requires a full account-wise and transaction-wise reconstruction.

Nevertheless, the common questions are serious.

How can banking employees allegedly misuse their authority without timely detection?

How can the supporting documents for financial transactions allegedly be manipulated?

How can customer alerts or independent confirmations fail to provide adequate protection?

How can money move through multiple beneficiary accounts before the institution identifies a discrepancy?

And why do customers or public departments sometimes appear to be the first parties to discover that something is wrong?

These questions cannot be answered through slogans about zero tolerance for fraud.

They cannot be answered through a few employee suspensions, a new advisory or a press release assuring the public that the bank takes security seriously.

They require transparent investigations, stronger systems, accountability across management levels and demonstrable improvements to banking controls.

A bank’s credibility is not measured by how confidently it advertises the safety of deposits. It is measured by whether it can actually protect them.

The public has every right to demand answers from PNB, IDFC First Bank, their managements, their boards and the regulators responsible for supervising the banking system.

The CBI and ED must complete their investigations without unnecessary delay. The banking regulator must examine systemic weaknesses, and genuine customer claims must be resolved promptly.

The ultimate objective should not be to create another temporary banking controversy that disappears from public attention after a few weeks.

It should be to ensure that the next customer who walks into a bank to update a passbook does not discover that money has disappeared, and that the next government department seeking to withdraw its own funds does not discover an unexplained gap between its records and the bank’s books.

Banks are custodians of public confidence. They cannot demand unquestioning trust while leaving fundamental questions about access, authorisation, reconciliation and accountability unanswered.

DISCLAIMER, LEGAL POSITION AND EDITORIAL CLARIFICATION

This report is based on publicly available bank disclosures, forensic-review findings published by IDFC First Bank, Enforcement Directorate releases, reported CBI chargesheets and FIR details, court-related reporting, and media reports published up to October 31, 2026.

All allegations concerning PNB employees, IDFC First Bank employees, former employees, public servants, account holders, private individuals, businesses and other persons must be treated as allegations unless established through the appropriate legal proceedings.

The PNB Greater Noida matter is under CBI investigation. Registration of an FIR does not establish guilt, and the allegations against the individuals named or referred to in the complaint remain subject to investigation and adjudication.

The IDFC First Bank-related Haryana and Chandigarh matters involve multiple investigative proceedings, including CBI and ED investigations. Filing a chargesheet, arresting an accused, attaching property or rejecting a bail application does not amount to conviction.

The IDFC First Bank KPMG report expressly states that it was not an audit or assurance engagement and that its findings were subject to limitations of scope, information and procedures. Its findings should be understood within those limitations.

The October 2026 PNB surprise-inspection controversy involving outsiders working inside certain branches is a separate matter from the alleged Greater Noida customer-funds diversion. No direct connection between the two has been established in the publicly available evidence examined for this report.

As of October 31, 2026, based on the material reviewed, no court of law has convicted the individuals accused in the specific PNB Greater Noida or IDFC First Bank-related 2026 matters discussed in this report.

All accused persons are entitled to the presumption of innocence, due process and a fair trial.

The purpose of this report is to examine documented developments, identify similarities in the alleged banking-control failures, question institutional accountability and demand thorough, independent and speedy investigations. It does not pronounce any person guilty of an offence.