NEW DELHI, Feb 22 (Reuters) – India’s IDFC First Bank said it was investigating a suspected ?fraud of $65 million by some employees involving ?accounts of local government entities and that the bank had ?alerted the police.
In a statement to the Bombay Stock Exchange late on Saturday, IDFC First said it had observed discrepancies of 5.9 billion rupees in ?accounts of some ?entities of the Haryana state government in the north of the country.
The Mumbai-based ?midsize private lender said it had suspended four employees of the branch in the city of Chandigarh ?pending investigation ?of the “incident involving unauthorized ?and fraudulent activities”.
The bank, ?which attracted investments from the likes of Warburg Pincus and Abu Dhabi Investment Authority last year, said it would appoint an independent agency to probe the incident and had filed a police complaint.
The ?Haryana state…
IT & DATA SECURITY (MITIGATING THE “INSIDER THREAT”)
As seen in the TD Bank case, an employee with too much “access” can sell your customer data to syndicates.
- Principle of Least Privilege (PoLP): Employees should only have access to the specific folders and databases required for their current task.
- Access Revocation: Have a “Termination Checklist” that ensures all digital access (Email, VPN, Banking) is revoked within 60 minutes of an employee resigning or being dismissed.
- System Logs & Audit Trails: Enable “Read/Write Logging” on your server. If a customer’s data is leaked, you need to know exactly which login accessed that record and at what time.
- Encryption at Rest: Ensure that sensitive files (like your customer ID numbers or payroll spreadsheets) are encrypted so that if a staff member copies them to a USB, they cannot be read.