On Tuesday, October 27, 2026, the shutter of a Punjab National Bank branch in Aichhar village, Greater Noida, stayed down. If the allegations hold, this is bank branch fraud without OTP, and the customers say they saw no alert either.
Outside, customers kept gathering. They came from Aichhar, Bironda, Viroondi Chakrasenpur, and nearby villages. Many described themselves as farmers. They had come with one question. Paisa gaya kahan?
One customer, Haneef Khan, says he had ₹39 lakh in his savings account. He says he got no message and signed no document. Another, Shrichand, alleges ₹1.16 crore was taken from his fixed deposit. Others allege more than ₹1 crore each.
Police have registered one FIR combining 16 complaints. The total is estimated at ₹35 crore. PNB has suspended five employees, including the branch manager, and started an internal investigation.
Nobody has been proven guilty. The method has not been established. These are allegations and an open probe.
But one claim is already enough to make every bank CTO uncomfortable. Customers say the money left without an OTP and without an SMS alert. If that is even partly true, the controls most banks rely on never had a chance to speak.
How Does Bank Branch Fraud Without OTP or Alert Happen?
There are three broad ways. Which one applies at Aichhar is for the police and the bank to establish.
First, the transaction never used the customer’s digital channel. An action taken inside the branch with staff credentials typically does not trigger a customer OTP. Second, the alert path was bypassed or suppressed, for example, by changing the mobile number or disabling alert settings. Third, the customer’s own credentials were stolen. Customers here say they received nothing, which points away from the third.
The lesson holds in all three cases. An OTP stops an outsider using the customer’s channel. It does not stop an action within the bank’s own process.
What Is Reported and What Is Not Yet Known
| Reported so far | Still unknown |
|---|---|
| At least 16 account holders complained. One FIR combines them. | The final amount. ₹35 crore is an estimate from complaints. |
| Money allegedly left savings accounts and fixed deposits. | The exact method and channel used. |
| Customers say they got no OTP, no SMS, and signed nothing. | Whether alerts were suppressed, bypassed, or never triggered. |
| Five staff, including the manager, suspended. Later reports say all branch staff. | Who did what. Nothing is proven. |
| FIR registered under Section 316(5) of the BNS. An ACP leads the inquiry. | Whether any system or process gap contributed. |
Reports on the number of suspended staff differ, so treat that line as developing.
Why This Is a Control Design Problem
Maker-checker is a control where one person initiates a transaction and a different, independently authorised person approves it before it takes effect. It is only as strong as the independence of the checker. When maker and checker can collude, share credentials, or treat approval as a formality, the control exists on paper only.
Every fraud of this type, whatever the final findings in this case, tests the same five links in a chain. If any one is weak, a branch can lose customer money quietly.
- Initiation. Who can start a premature FD closure, a transfer from an FD, or a change to account details? Does the customer have to be present or consent in a way the bank can prove?
- Approval. Is the approver truly independent of the initiator? Above a threshold, is the checker outside the branch?
- Alert. Is the customer alert generated by the core system itself, out of the branch’s reach? Who can change a registered mobile number, and what stops that being used to hide activity?
- Detection. Would anyone at head office notice several FDs closing at one branch in one week, all belonging to customers from one area? Would a sudden movement in a dormant, high-balance account raise a flag?
- Evidence. Can the bank reconstruct which user, which terminal, which network, and what time, within minutes?
Different case, different decade, same family of question. In 2018, PNB’s own disclosure said fraudulent letters of undertaking were issued through SWIFT without entries in the core banking module. The question then and now: can a transaction exist that the bank’s own controls never saw?
Earlier this year, police in Haryana also described a separate case involving government accounts at bank branches in Chandigarh, where they alleged employee collusion was central. Allegations again, but the pattern keeps repeating.
Ten Steps Every Bank, Co-operative Bank and NBFC Should Take
These apply to any institution with branches, field staff, or privileged back-office users. The RBI’s July 2026 cybersecurity framework for commercial banks explicitly calls out privileged access management, segregation of duties, and real-time log monitoring and alerting. These steps put that into practice.
1. Generate alerts at the core, not the branch. Every debit, FD closure, and change to contact details should trigger an alert from the core system. Reconcile alerts sent against transactions weekly. Report alert delivery failures to head office.
2. Lock down mobile number and alert changes. Require the customer to be present, verify both the old and new number, add a cool-off period, and notify the old number. This is the most abused back door.
3. Make maker-checker real on money-out events. Premature FD closure, loan against FD, and transfers from FD or dormant accounts need a checker outside the branch above a set value.
4. Watch dormant and high-balance accounts. Any movement should trigger a customer callback before a value above a threshold executes.
5. Run privileged access properly. Named IDs only. No shared logins. Session recording for sensitive functions. Quarterly access review tied to current role.
6. Bind sensitive functions to registered terminals. Core banking sensitive screens should work only from known branch devices on an enforced network segment. Anything else is quarantined.
7. Enforce mandatory leave and rotation. Fraud that needs ongoing cover-up often surfaces when the person is away. Block system access during leave. Do not allow “remote help” to defeat the purpose.
8. Give head office numbers, not narratives. Track per branch: premature FD closures, mobile number changes, after-hours transactions, alert failure rate. Set thresholds. Escalate on trend, not on complaint.
9. Verify with customers independently. Run passbook and statement reconciliation drives, especially for rural and older customers. Offer an independent channel to confirm FD status.
10. Rehearse the first six hours. Freeze suspect accounts. Preserve logs and terminal images before any staff transfers. Notify the regulator and CERT-In where applicable. Brief customers directly and early.
Where Skeletos Can Help, and Where It Cannot
Let me be straight about scope, because overselling helps nobody.
EasyNAC will not stop an authorised person approving a transaction on an authorised terminal with valid credentials. No network tool does. That is a core banking and process control, and the steps above cover it.
What EasyNAC does is close the layer underneath those controls:
- It identifies every device on a branch network the moment it connects. An unknown laptop, a personal device, or a remote access box shows up immediately.
- It enforces that sensitive systems are reachable only from registered terminals. Everything else lands in a restricted segment.
- It gives device-level evidence: which terminal, which port, what time. That shortens an investigation from weeks to hours.
- It deploys without switch changes or network reconfiguration, which matters for branches with mixed and ageing hardware.
Around that, the supporting pieces:
- OfficeSIA ties access to the employee lifecycle. Transfers, leave, and exits change access automatically, and mandatory leave can be tracked rather than assumed.
- FacctorX gives head office branch-level numbers in one view, so anomalies show up as a trend line before they show up as a protest outside a shutter.
- Our IT services team can run an independent review of your branch fraud controls against the five-link chain above. Think of it as the test your auditor should have run, run earlier.
If you are a co-operative bank, small finance bank or NBFC with a branch network, this is your risk too. The scale is smaller. The physics is the same.
The Pattern Behind the Pattern
Most of this year’s incidents on this blog were outside-in attacks. A compromised email. A leaked credential. A vendor laptop. A WhatsApp attachment. The industry has spent a decade building walls against those.
The allegation at Aichhar, if it holds, points the other way. The weak point sits inside the walls, behind the counter, in the trust that a branch has always run on. Every outside-in control, including the OTP, is irrelevant when the action never crosses the customer’s channel.
That does not mean branch staff is the problem. Most are honest, and most branches never see this. It means a bank cannot depend on honesty alone to protect a villager’s life savings. It needs controls that make the wrong action hard to do, loud when done, and easy to trace afterwards.
Final Thought
Customers gave a branch their entire savings because the building, the passbook, and the faces behind the counter felt safe. That trust is real, and it is valuable.
Bharosa achha hai. Bharosa akela control nahi hai.
If the investigation confirms internal misuse, the lesson will not be that one branch failed. It will be that trust was the only control for money that deserved five.
Ask your own team one question this week. If someone moved a customer’s FD tomorrow with no OTP and no alert, which of the five links would catch it, and how soon would head office know? If the honest answer is “we would find out when the customer complains”, you have your starting point.
At Skeletos IT Services, we help Indian banks, co-operative banks and NBFCs review branch-level fraud controls, enforce device and network access with EasyNAC, a plug-and-protect Network Access Control solution that gives IT teams real-time visibility into every device on their network without any switch changes or network reconfiguration. If you want to understand what is actually connected to your branch networks right now, we can show you in a 30-minute demo.
Note: This blog is based on reporting by The Statesman, Brut, NewsBytes, Gujarat Samachar and Indian PSU published October 28-30, 2026. The investigation is ongoing. Amounts, methods and suspensions are as reported and may change. No individual has been found guilty. This blog is for awareness and educational purposes. Consult your legal and compliance teams for entity-specific guidance.
