Chapter 5

The GPS files

For four years, some car-loan customers of India's largest vehicle financier discovered - only when they read their loan documents - that they had also "bought" an ₹18,000 tracking device. The internal probe that followed cost executives their jobs, cost the bank ₹10 crore, and ended the career of the man who built its auto-loan empire.

The scheme, as reconstructed by the Economic Times and Moneycontrol in July 2020, was simple. HDFC Bank had a tie-up with a vendor called Trackpoint GPS. Staff in the vehicle-loan business bundled the devices - costing ₹18,000-19,500 each - into car loans, allegedly as a precondition for clearing the loan. Some customers did not know they had bought anything until the documents were checked. An official in the know told ET that 4,000-5,000 such devices were sold a month, and called the real failure the bank's audit, which had not spotted it.

The numbers around the scheme were large. HDFC Bank is India's largest vehicle financier, booking 50,000-55,000 car loans a month, with an outstanding vehicle portfolio of ₹81,082 crore at the end of June 2020. The alleged forcing ran from 2015 to December 2019 - about four years, as the RBI later recorded.

"The gross failure for the bank has been its audit which failed to spot the misdoing."- An official in the know, to the Economic Times, July 2020

The fall of Ashok Khanna

The episode's most senior casualty was Ashok Khanna, the 18-year veteran who headed vehicle lending. A Bloomberg report said he had been denied an extension after the probe began. At the bank's July 2020 AGM, CEO Aditya Puri told shareholders that a whistleblower-triggered internal enquiry had found no conflict of interest and no bearing on the loan portfolio, but "another aspect related to personal misconduct exhibited by a set of individuals", for which disciplinary action had been taken. He said Khanna had participated in the enquiry and had "superannuated on 31 March, 2020 upon expiry of his tenure."

Khanna, speaking to ET, denied all allegations: he had retired on completing his contract, had already received a three-year extension earlier, and claimed "an attempt to malign my name and reputation by someone." He noted he had built "a highly profit making & envious franchise" for the bank.

At least six senior and mid-level executives were terminated for violating the code of conduct and governance standards, people familiar with the matter told ET. The bank declined to respond to ET's detailed questionnaire at the time.

The regulator's arithmetic

The RBI sought details of the internal probe within days of the story breaking, per Business Standard. Ten months later, on 28 May 2021, it imposed a ₹10 crore penalty on the bank, stating that after the show-cause process it found the charge of contravention "substantiated", as Mint reported. Two US law firms - Rosen Law Firm and Schall Law Firm - filed class-action suits against the bank on behalf of shareholders, Mint noted.

The defence, also on record: the devices were a bank-approved product, a minuscule fraction of the portfolio; peers offered similar add-ons (ICICI Bank told ET about 5% of its customers chose to buy a financed tracker; it stressed it sold no accessory itself); and Puri's AGM statement framed the findings as individual misconduct, not a design flaw.

What no one disputed by the end: customers were sold devices many did not know they were buying, the practice ran for years inside the country's most admired retail bank, and the regulator fined the bank ₹10 crore for it.

The ₹18,000 accessory nobody ordered

The scheme, as reconstructed by the Economic Times and Moneycontrol in July 2020, deserves slow reading because of its simplicity. HDFC Bank, India's largest vehicle financier, had a tie-up with a vendor called Trackpoint GPS. Staff in the vehicle-loan business bundled the devices - costing ₹18,000 to ₹19,500 each - into car loans, allegedly as a precondition for clearing the loan. Some customers did not know they had bought anything until they read their own loan documents. Under RBI norms, a bank may have tie-ups with suppliers, but the sale must be optional; forcing a customer to buy a third-party product is the irregularity. An official in the know told ET that 4,000-5,000 such devices were being sold every month.

Do the arithmetic the coverage left to the reader. Four to five thousand devices a month at ₹18,000-19,500 is roughly ₹7-10 crore of devices every month, running - as the RBI later recorded - from 2015 to December 2019, about four years. Over that span, the scheme's gross throughput plausibly runs into the hundreds of crores. Against that, consider the defence the same official offered ET: it was "a bank approved product," and "quite a minuscule portion of the bank's portfolio." Both true. Both irrelevant. The question was never the size of the device line relative to the book. It was whether customers consented - and the bank's own internal probe concluded that the conduct on the ground was serious enough to end careers.

The whistleblower and the probe

The affair surfaced not through the vaunted audit function but through whistle-blowing complaints, as Aditya Puri himself told shareholders at the bank's July 2020 AGM. Internal enquiries followed. Their conclusion, in Puri's public telling, was carefully partitioned: no conflict of interest, no bearing on the loan portfolio - but "another aspect related to personal misconduct exhibited by a set of individuals," for which "appropriate disciplinary actions" had been taken. The Economic Times reported that at least six senior and mid-level executives were terminated for violating the code of conduct and governance standards "by indulging in practices seen as corrupt," citing three people familiar with the matter. The bank declined to respond to ET's detailed questionnaire.

The partition deserves scrutiny, because it became the template for every later episode: the institution is fine; the individuals were bad. A four-year, thousands-a-month forced-bundling practice in the bank's flagship retail product is, in this framing, not a systems failure - not a target architecture that rewarded bundling, not an audit function that failed to sample a single loan file in four years - but a localised outbreak of misconduct by individuals who have now been removed. The ET's own source inside the affair said the quiet part aloud: "The gross failure for the bank has been its audit which failed to spot the misdoing." Four years. The largest vehicle financier in the country. And the audit found nothing until a whistleblower drew a map.

The fall of Ashok Khanna

The episode's most senior casualty was Ashok Khanna, the 18-year veteran who headed vehicle lending - the man who had built the auto-loan empire that made HDFC Bank the category's undisputed leader. A Bloomberg report in July 2020 said Khanna had been denied an extension after the probe began. Puri addressed it head-on at the AGM: Khanna "had also participated in the enquiry process," and "subsequently, he superannuated on 31 March, 2020 upon expiry of his tenure and as per the original terms of employment."

Khanna, speaking exclusively to ET, denied every allegation. He had retired on completing his contract; he had already received a three-year extension earlier; there was no offer made to him that he declined. "There is an attempt to malign my name and reputation by someone," he said, pointing to the franchise he had built: "I have worked for 18 years and created a great quality - highly profit making & envious franchise for the bank. I have always practiced zero tolerance for any malafide intent, be it channel partners or employees." His account and the bank's account cannot both be wholly true, and no public document resolves the contradiction. What is on record: the head of the business where a four-year forced-selling scheme ran departed in the middle of the probe into it, and the bank and the man tell different stories about why. The reader is entitled to hold both versions and notice which one required a Bloomberg report to exist.

"The gross failure for the bank has been its audit which failed to spot the misdoing."- An official in the know, to the Economic Times, July 2020

The regulator's arithmetic

The RBI moved with unusual speed for an institution its size. Within days of the story breaking, the central bank sought details of the internal probe, per Business Standard. Ten months later, on 28 May 2021, it imposed a penalty of ₹10 crore - among the larger monetary punishments it had levied on a private bank - stating that after examining documents, the bank's reply to its show-cause notice, oral submissions at a personal hearing and further clarifications, it found the charge of contravention "substantiated," as Mint reported. The complaint, the RBI's record noted, pertained to customers being forced to purchase the tracking devices "for about four years ended December 2019," in possible breach of guidelines prohibiting banks from non-financial business.

Two American class-action law firms - Rosen Law Firm and Schall Law Firm - filed suits against the bank on behalf of shareholders in the aftermath, Mint noted. The allegation in that arena was different in kind: not that customers were wronged, but that investors were - that a bank trading at a governance premium had a forced-selling scandal running inside its flagship book, and the market learned of it from journalists rather than from the bank. The suits, like so much else in this dossier, traced back to the same root: the gap between the story the institution told and the records the institution kept.

The 5% alibi

The most illuminating document in the whole affair is a single email from a competitor. Industry sources told ET that ICICI Bank and Axis Bank also offered such products - only if the customer chose. Axis declined to comment, citing a silent period. ICICI Bank chose clarity: "ICICI Bank does not sell any accessory while providing vehicle loans to customers. In case a customer wishes to buy an accessory, he/she has the option to seek finance from us for the product while availing the vehicle loan. We have seen that only 5% of our customers purchase a GPS tracker on finance from us on a monthly basis." Five per cent, opt-in, documented. That is what the product looks like when it is actually optional. The comparison demolishes the "bank approved product" defence: approval was never the issue, and every banker in the country knew it. The issue was the difference between a customer choosing and a customer discovering.

The misconduct frame, examined

Strip the episode to its competing explanations, because the choice between them explains the institution better than any balance sheet. The bank's frame: a set of individuals engaged in personal misconduct; the institution investigated, punished, and moved on. The critics' frame: a four-year, industrial-scale practice, in the bank's largest retail product, discovered by a whistleblower rather than by any control the institution built - which is not a people problem but a design confession. Both frames fit the public facts. They differ in what they predict. If the bank's frame is right, removing the individuals removes the problem, and nothing similar should recur. If the critics' frame is right, the same incentive architecture will produce the same family of conduct somewhere else. The record since 2020 - the regulator's digital ban, the chairman's resignation, the board fining its own CEO over a deposit arrangement, the Dubai suitability lapse - is the experiment, run in public. The reader has the results.

What the customer experienced

Reserve the last word for the people the scheme was built on. A forced sale is not an administrative error; it is a specific betrayal with a specific texture. The customer signs a loan believing every line in it was necessary. The discovery - an ₹18,000 device they never asked for, buried in paperwork they trusted - arrives months later, if it arrives at all. Some of those customers, per the original reporting, learned what they had bought only when they checked the documents. The amount is small enough that fighting it costs more than paying it, which is precisely why schemes like this work at scale: no single victim has a case worth the trouble, and the aggregate belongs to no one. That asymmetry - a small loss multiplied by an enormous base, below the threshold of individual resistance - is the recurring commercial insight at the dark edge of retail banking. It powered the GPS device. It powers, in various forms, several chapters still to come.

The timetable of knowing

One more document exists only in aggregate: the timeline of who knew what, when. The practice ran from 2015 to December 2019 - the RBI's own record fixes the four-year span. The whistleblower complaints arrived somewhere in late 2019 or early 2020; the internal enquiries and terminations followed; Khanna's superannuation was 31 March 2020; the story broke in the press in July 2020; the RBI sought details within days; the penalty landed in May 2021. Notice the institution's learning curve: four years of not-knowing, then - once a whistleblower spoke - a cascade of knowing so rapid it reached the AGM stage and the front pages within months. The information was always available. What was missing, for four years, was the demand for it. That is the deepest line in this chapter, and it is not this dossier's line - it is the bank's own sequence of dates, laid end to end.

The fine, measured

Is ₹10 crore a punishment or a rounding error? Against the bank's profits it is hours of earnings, and critics said so. But measured differently it was a landmark: one of the largest monetary penalties the RBI had imposed on a private-sector bank, attached to a customer-conduct charge rather than a technical breach, with the regulator's unusually stark finding that the charge was "substantiated." Central banks do not use that word lightly; it is the administrative-law equivalent of a conviction. And the penalty's real target was not the bank's wallet but its file: from May 2021 onward, the RBI's supervisory record on HDFC Bank contained a proved, admitted-by-process case of forced selling. Everything the regulator did afterward - the scrutiny, the questions about the chairman's allegations, the demand that the bank explain its board's own fines - happened with that file open on the desk. The ₹10 crore bought the regulator's attention. The attention never left.

The empire the scheme lived in

To grasp why this chapter matters beyond its rupees, zoom out to the empire it lived in. At the end of June 2020, HDFC Bank's outstanding vehicle-loan portfolio stood at ₹81,082 crore, booking 50,000-55,000 car loans a month - the largest vehicle financier in the country, as the Economic Times noted. This was not a fringe product where rogue behaviour might hide. It was the crown of the retail franchise, the book that defined the bank's dominance of Indian consumer credit. A forced-selling practice running for four years inside that book is not a leak in the basement. It is a crack in the load-bearing wall. And the man who built that wall, Ashok Khanna, was gone within weeks of the probe - an exit the bank and the exit's subject describe in mutually exclusive terms to this day.

The aftermath's quietest fact: the customers were never the story's subject again. The executives were punished, the CEO was questioned at the AGM, the regulator was paid, the lawyers filed their suits - and the people who discovered ₹18,000 devices in their loan papers faded from the record entirely. No public accounting ever established how many of them were made whole. The scheme's smallest participants turned out to be its most disposable. That, more than the fine, is the chapter's lesson: in the machinery of Indian retail banking, the customer is the one component that can always be replaced - and the one constituency no probe was convened to compensate.