How to make a deposit disappear
Published 3 October 2026
Banks have controls because they know people will try things. A maker prepares a transaction, a checker reviews it, an authoriser approves it, a customer confirms a high-value one by phone. The CBI's case is that every one of these steps was present in form and absent in substance.
The method, as the CBI describes it
According to the CBI's investigation papers, as reported by The Tribune, Rishi and Abhay Kumar, along with four others, resorted to forged debit notes and cheques bearing forged signatures, as well as unauthorised debits without any cheque. The transactions were processed and approved through the bank's internal maker-checker workflow, so that bank officials, in the CBI's phrase, induced the banking system to act on forged instruments. The call confirmation with authorised signatories of the government accounts, the CBI said, turned out to be a farce, and there was no call recording by the banks.
To make the fraud look real to the departments, the CBI says the accused officials prepared forged fixed deposit receipts, account statements and interest certificates and submitted them to the government departments. They also allegedly altered the mobile numbers and email IDs linked to the accounts in the account-opening forms, and substituted ones they controlled. This is the detail that matters most for the question of how a department could fail to notice: a department that expects SMS alerts, and whose registered number has been quietly replaced, will not receive them.
KPMG's forensic review, which the bank disclosed in June, described the method in similar terms from the bank's side. The review found that the unauthorised transactions were processed with potentially modified or edited authorisation letters, cheques (including misuse of a few cheques) and approval emails attached to transaction vouchers by the then branch staff, and that non-existent fixed deposit advices, edited interest certificates and modified bank account statements were shared with the customers. Two investigations, one by an agency and one commissioned by the bank, describe the same technique.
Three transactions the CBI picked out
The CBI's papers give specific examples. On Monday, 5 May 2025, Rs 50 crore was debited from the Haryana Power Generation Corporation's account through Cheque No. 3. HPGCL never issued that cheque, the CBI said. The maker, Anuj Kaushal, and the checker, Seema Dhiman, are accused; Rishi himself conducted the call verification, and the call was made for some other purpose. The fraud, the agency says, was allowed to pass without a cheque.
On 19 May 2025, a Monday, Rs 5 crore went out. The bank could not produce Cheque No. 9 on which the transaction was supposedly based. Because the money moved through the bank's general ledger, no SMS alert was sent to the authorised signatory due to a technical fault in IDFC First Bank's system. That sentence turns up three times in the CBI's papers in different accounts. The pattern the CBI draws from it is that an internal ledger account was used as a way station, and that the alert system did not fire for ledger-routed debits.
The third example involves the other bank. In a Rs 25 crore debit from the HPGCL Pension Fund Trust's account at AU Small Finance Bank, by cheque on 29 December 2025, the CBI alleges the Mohali branch manager, Charanjit Singh Randhawa, made the call confirmation through the mobile phone of Abhay Kumar, who had brought the cheque. The cheque bore only the authorised signatories' signatures; Randhawa, the CBI alleges, filled in the body, including the amount, date and the beneficiary's name. The money went to Swastik Desh Projects. The call detail record, the CBI said, did not log any call between the two.
Forged emails to the bosses
For high-value transactions, the bank's own procedure required approval from the cluster head, regional head, zonal head or country head, depending on the amount. The CBI alleges Rishi forged emails to his seniors to make it appear that transactions had been approved by the country head, the zonal head, the regional head and the cluster head for debits from the Haryana School Shiksha Pariyojana Parishad's account. That account saw, per the CBI, 101 fraudulent debit entries and 33 fraudulent credit entries. In the Panchkula Municipal Corporation's account there were 22 fraudulent debits, with no SMS and no call confirmation. In the Pollution Control Board's account, several cheques and debit notes could not be found in the records.
The bank's counter-position is that the core banking records were accurate. In its June statement the bank said that the records in the Core Banking System were accurate, that customers were provided monthly account statements reflecting their balances and transactions, and that they were notified through SMS alerts where applicable. That is the bank's reading of the facts, and it rests partly on what the statements and alerts said and partly on whether the customer-facing documents were what the branch actually sent. The CBI's reading is that the statements customers saw were not the statements the bank held.
The arithmetic of it
The CBI summarised the Haryana case in numbers: across 12 accounts in eight departments of the Haryana Government, there were 236 fraudulent debit transactions worth Rs 818 crore and 84 fraudulent credit transactions worth Rs 214 crore, resulting in a loss of Rs 504.36 crore. Read that carefully: Rs 818 crore went out, Rs 214 crore went back in, and the net is the loss. Credits are how, on the investigators' account, a fraud keeps up appearances: the money flows back in enough to make a balance look plausible for a while. Wadhwa's disclosure statement carries the same logic when it quotes the assurance that reverse entries could be made into the government accounts whenever required.
A deposit, in this method, does not vanish in one move. It is first redirected, then covered, then re-covered, and the paper that covers it is a forged statement. The next chapter follows the debit leg out of the bank: to the counters of jewellers.
Get the next file
One email when a new file is published. No paid service needed.