How to Respond to a Suspected Payment-Fraud Event

The response is ordered, and the order is the substance: stop further movement, tell the institution, make the statutory report, and record the times of all three as they happen. Everything else can be done later and none of those four can. Do them in that order, starting now.

A person who has just realised that money has been taken from them is not, in that moment, able to hold a procedure in mind and choose between its branches, and any instruction sheet that asks them to will be abandoned somewhere in the middle. So the four actions come first, in a fixed order, with no branches and no conditions attached to any of them. Nobody has to know what happened. Nobody has to be sure it was fraud. Nobody has to have the amount right. Nobody has to have finished being frightened. The four are built for somebody who is unsure and not calm. All four work perfectly well done in exactly that condition.

Everything below this point is reasoning. A household that understands why the order is what it is will hold on to it better, will not be talked out of action three by somebody who thinks action two covers it, and will not spend the first twenty minutes on the one activity that feels most productive and helps least. The reasoning is genuinely optional in the first hour. Come back to it.

Why is there an order at all, and what decides it?

Think about a burst pipe under the kitchen sink. Water is on the floor, it is spreading toward the room where the almirah stands, and there are four sensible things a household could do. Turn the tap off at the wall. Call somebody who repairs pipes. Move what is on the floor. Work out why the pipe burst. Every one of those is reasonable. Only one of them changes how much water ends up on the floor, and it changes it more the sooner it is done. The other three are worth doing and none of them gets worse for being done twenty minutes later.

The burst pipe is the whole of the logic, transferred onto money. The four actions are ordered not by how important they are but by how fast each one stops being possible, and the one that stops being possible fastest goes first. Importance is a poor sorting rule here because all four matter. A different question sorts them cleanly: if I do this one an hour from now instead of now, how much of its value have I lost? Turning the tap off an hour later loses almost all of its value. Working out why the pipe burst loses none.

A payment fraud eventA transfer obtained by deception, whatever the route it went out through and whoever obtained it. has the same shape. Money that has already left is a settled fact within seconds and nothing on any list changes it. Money that has not yet left is a live question, and the answer to that question is decided by how fast the route out gets closed. So closing the route is first. Then two separate tellings. The two bodies told do different work, and neither of them substitutes for the other. Then the record. The record is last only because it can be written in the gaps between the other three, and it holds the one class of information that genuinely cannot be produced later.

Why does stopping further movement come before everything else?

To stop further movementPreventing anything else leaving, by closing, freezing or blocking whatever route the money went out through. Closing the route is the first of the four actions. is to draw a line under the loss so it can no longer grow. Drawing that line sounds obvious written down and it is not obvious at all in the moment. The mind is entirely occupied with the money that has gone, and the money that has gone is the one part of the situation that no action can touch. Every rupee already transferred is a fact. The only live variable in the first minutes is whether anything further follows it.

Why would anything further follow it? Because a transfer obtained by deception is rarely a single isolated instruction. Whatever gave access once tends to still give access: a set of details that were handed over, a code that was read out, an approval that was granted, a route that was left open. The person on the other end has every reason to use it again, and often does, within minutes. In this household's case a second transfer followed the first by five minutes. Five minutes is the ordinary shape of it rather than an unusual one.

So the first action is not about the money that has gone; it is about the difference between a loss that is now fixed and a loss that is still growing, and that difference is the only thing in the first minutes that is still open to decision.

Stopping further movement means, in practice, closing whatever route the money went out through, on whatever channel is fastest. Sometimes the household can do it directly. Sometimes it has to ask the institution to do it. The first action and the second action then collapse into one telephone call, and that is fine and common. Where the route used cannot be identified, every route that can be reached is closed and the matter sorted out afterwards. The cost of over-closing is inconvenience for a day. The cost of under-closing is measured in rupees. A household that blocks four things when only one was compromised has lost an afternoon. A household that blocks nothing because it was not certain which one to block has lost whatever leaves next.

One thing this action is not: it is not an admission of anything, it is not irreversible, and it does not require the person doing it to be right. Closing a route can be undone. The asymmetry is what makes closing a route the safe first move for a frightened person, and it is why the closing can be done before any thinking has been finished.

Who do I tell, and what do I actually say?

The second action is telling the institution that holds the account. Use whatever channel answers fastest, and follow it in writing wherever writing is possible. If the fastest channel is a telephone call, make the call, and then send something in writing afterwards saying the same thing and naming the time of the call. If the fastest channel is written from the start, better still.

The thing people struggle with is what to say, and the struggle is nearly always about wanting to say it well. Saying it well is not required. There is a very short version and it is complete: money left my account without my authorisation, it was obtained by deception, here is the amount, here are the times, and I want this recorded now. That is it. No case is being made, nobody is being persuaded, and nothing is being explained. A fact and a time are being put on somebody else's record, and the shortest version does that just as well as the best written one.

Whatever is known is stated, and whatever is not known is labelled as not yet known, rather than left out because it is uncertain. Where it is unclear whether the second transfer was Rs 6,000/- or Rs 8,000/-, the report says approximately Rs 6,000/-, to be confirmed. Where the exact words used on the call are not certain, it says a caller referred to the recurring deposit and used my name, exact wording to follow. An incomplete report made now is a stronger position than a complete one made in two hours, and every part of it can be corrected later. Nobody is disqualified for having been unsure.

A common and expensive hesitation arrives at this step, the wish to sound competent to whoever answers. A household that has just been deceived is often more worried about how it will be perceived by the person on the line than about the substance of what it is reporting, and that worry produces long, careful, apologetic accounts that take fifteen minutes to reach the amount. Say the amount and the time in the first sentence. Everything else can follow at whatever pace the conversation allows.

What is the statutory report, and why is it a separate thing?

The third action is the statutory reportThe report made to the national reporting arrangement for this class of offence. The statutory report is a separate act from telling the institution that holds the account., made to the national arrangement that exists for reporting this class of offence. In India that arrangement sits with the Ministry of Home Affairs, and what matters here is that it exists and is separate. The details of how a report is made, and everything procedural attached to it, are set by the authorities and change, so they are established at the source. The Indian arrangements below say where.

Why is it separate, and why does it need saying? Because a very large number of households do action two and stop, in the honest belief that action two contains action three. It does not. Telling the institution puts the matter on the institution's record and sets whatever the institution does in motion. The statutory report puts the matter on a different record entirely, held by a different body, with different powers and a different purpose. Neither one produces the other automatically, and a household that has done only one of them has done half of the telling.

The two tellings are not two versions of the same act; they go to different bodies, do different work, and neither one stands in for the other. The practical instruction that follows is blunt: both are done, on the same day, in that order, even if the second one feels redundant at the time. The feeling of redundancy is the exact feeling that stops most people making the statutory report, and it is a false signal.

What do I write down while it is still happening?

The fourth action is the record, and within the record the part that matters most is the times. A contemporaneous noteSomething written down while it is happening or immediately afterwards. The weight comes from when it was written, and a later reconstruction cannot have that. is anything written while the thing is happening or immediately after, and its whole value comes from when it was written rather than from how well it was written. A line in a notebook, a message sent to yourself, the back of an envelope with the time and one sentence on it. Format is irrelevant. Timing is everything.

Six clock times matter in this household's case, and it is worth seeing them as a list because the list is short and complete. The call came at 11:38. Rs 12,000/- left at 11:42. Rs 6,000/- left at 11:47. The realisation came at 11:53. The institution was told at 12:20. The statutory report was made at 12:35. Six lines are the whole record of the day. Two of the six sit on a statement somewhere whether anybody writes them down or not. The other four exist only if somebody writes them down.

The parts of what is known today that could still be stated with confidence in three weeks can wait. The parts that fail that test are written down first. The amount is on a record, so it will still be known in three weeks. The transfer times will still be known, for the same reason. The moment of realisation, the moment each call was made, and what the caller actually said are none of them written anywhere except in one person's memory, and that memory is going to smooth all three of them into a rounded, tidy, slightly wrong version within about seventy two hours. Not through carelessness. Because that is what memory does with events it found frightening.

Alongside the times goes what was said. Not a polished account of it. The phrases, as close to the words used as can be managed, in whatever order they come back. If the caller used a name, that goes down. If the caller knew a detail about an account, the detail goes down. If a specific reason was given for the transfer, the reason goes down in the words it was given in. The wording is worth more the earlier it is written, and it loses value at a genuinely alarming rate.

Why does the order matter more than the speed?

Everybody who writes about this subject writes about speed, and speed does matter. Speed is not, however, what most responses get wrong. Most responses get completeness wrong, and completeness is decided by order. A household that moves through a fixed list from the top does all four things eventually. A household that moves through the same four items in whatever order panic supplies does two or three of them and then runs out of the energy panic was providing. Panic's energy has a short life and it does not come back the same afternoon.

Order decides what gets done at all, and speed only decides when. Doing all four of the right things at forty minutes beats doing three of them at five. The item that gets dropped is almost never the first one. The dropped item is almost always the third: the statutory report, made to a body the household has never dealt with, on a matter it now understands slightly better than it did an hour ago, at a point where the immediate danger feels handled because the institution has been told. Every one of those feelings is understandable and each of them argues for stopping one item early.

The same reasoning is why the list has no branches. A list with branches asks the reader to evaluate, and evaluation is the first faculty to go. There is documented work on this, and the most useful framing belongs to Kahneman: under time pressure and emotional load, people stop weighing options and start following whatever structure is in front of them. Kahneman's finding is usually cited as an explanation of how the deception succeeded in the first place, and it is exactly as true of the response. So the response is given the same shape the deception had: a fixed sequence, stated with authority, with nothing to decide. The difference is that this sequence works for the household rather than against it.

What do I do about the account itself?

Once the four actions are done, there is a second, calmer set of questions about the account and everything attached to it, and none of these is urgent in the same way. The calmer questions are handled the same day where that is possible and the next day where it is not.

The first is access. The household does not yet know what was learned about it, so whatever means of access existed before is now suspect, whether or not it is believed to have been the route used. Every means of access that can be changed is changed. Details that were read out or typed anywhere are treated as known to somebody else from now on, permanently, and acted on as such.

The second is everything standing. Instructions that run on their own, arrangements that pull an amount on a date, anything that moves money without a fresh decision each time. The list of them is worth going through. The search is not for something suspicious. The search is for anything better not left running while it is still unclear what was compromised, and pausing one arrangement for a fortnight costs almost nothing.

The third is the other accounts. Households reuse things. The same set of details, the same approach to security questions, the same handful of memorable answers spread across four institutions. If any of that was handed over, it was handed over for all of them at once, not just for the one the money left. The question to ask about every other account is not whether it was touched but whether it could be reached by whatever was learned this morning, and anything that could be reached gets treated as exposed.

The fourth is the household. Tell the people who share the finances, that day. Telling them is unpleasant and it is not optional. The other members of the household may need to act on their own accounts, and the alternative is their finding out later. Finding out later is worse for everybody. In this case Meghna Bhosale was told when she came home. Ira Bhosale, who is a child, was told a shorter version, and the reason for telling her at all was that a household in which this is a secret is a household in which it can happen again to somebody who was never warned.

What did this household actually do on 14 September?

Here is the whole of it, with the times. The times are the substance of the account rather than an illustration attached to it. On an invented 14 September, Ashok Bhosale answered a telephone call at 11:38. The caller said there was a problem with the recurring deposit, used his name, and knew the last four digits of an account number. He was calm, unhurried and correct about every single thing he said until the moment he was not.

He wrote both of those times down as he did them, along with the two transfer times, the time of the call and what the caller had said. Eleven minutes from the first transfer to realising. Twenty seven more to the institution. Fifteen more to the report. Thirty eight minutes from the first rupee leaving to the first report being made.

Two things follow from those numbers, and they pull against each other. The truth of this subject sits in the tension between them, and either half carried alone would be lying by omission.

The Rs 18,000/- did something to the household worth stating in its own arithmetic, and the arithmetic explains why five minutes on a Tuesday morning matters more than the number by itself suggests. Before 14 September the household held a buffer of Rs 31,320/- against Rs 42,770/- that leaves in an ordinary month, or 0.73 months of cover. Rs 18,000/- is 57.5 per cent of that buffer. Afterwards the buffer stands at Rs 13,320/-, or 0.31 months. Nine months of ordinary household arithmetic built that buffer and five minutes removed most of it.

What if I only realise days later?

A great many people do. The realisation arrives while reconciling a statement at the end of the month, or when somebody else notices, or in the middle of the night eleven days later for no reason at all. In that case the four actions are exactly the same four actions and they are done in exactly the same order, starting from the moment of realisation.

The four change only in what each of them can reach. The range of what is possibleWhat can still be done about a situation. The range narrows as time passes and it is never certain at any point, including the earliest. narrows with time, in different ways for each action. Vagueness on this point produces the wrong conclusion, so it is worth being precise about which narrows and how. Stopping further movement protects everything from today onward, and today is still ahead, so it is nearly undiminished. Telling the institution narrows. Any institution's power over a transfer depends partly on how recently it moved. The statutory report narrows in what it may set in motion and never closes, and it is still made. The record is the one that genuinely decays. The times and the wording live only in memory, and memory is not preserving them.

Late is a completely different situation from never. Nothing about a late report makes anything worse than not reporting at all. The belief that a late report is pointless, or worse, embarrassing, is one of the two reasons most events never get reported, so it needs saying flatly. A late report is not pointless. A record of an offence has uses that do not depend on any money coming back: it exists if the same thing happens again, it exists if a pattern is being assembled from many reports, and it exists as the household's own dated account of a day it will otherwise remember badly.

One practical instruction for the late case. The date of the realisation and how it came about are the newest time-boundSomething that stops being possible after a while, whether or not anybody is paying attention to it. facts the household holds, and they will fade like all the others. Both go down before anything else. Then the four actions, from the top.

Why is reconstructing before reporting the costliest instinct?

There is a version of this that catches careful people in particular, and it is worth naming because carefulness is usually a virtue. Somebody who keeps good records, reconciles their own accounts and dislikes saying anything they have not checked will feel a genuine reluctance to make a report containing an approximation. The reluctance is the same quality that makes them good at their own books. The quality is simply pointed at the wrong target, where the cost of a small inaccuracy is a later correction and the cost of the delay that avoids it can be everything.

Why does shame stop most reports being made?

One more practical note, and in practice it decides whether a report gets made at all. The statutory report is not left until last, after the people who were dreaded have been told. The statutory report is made before. The telling of relatives is genuinely hard and it can consume an entire evening, and a household that arrives at the end of that evening emotionally finished does not then sit down and file anything. The report sits at position three for that reason, and the reason is not procedural.

What should a household actually expect?

Expect a process. Expect to be asked for the same information more than once, by more than one person, in more than one form, and expect at least one of those askings to feel as though the previous one was never recorded. Repetition is ordinary and it is not a signal about how the matter is being treated. With the six times and the amounts written on one sheet, repeating them costs nothing.

Expect the record to be the most useful thing the household holds. Not because it produces an outcome, but because every subsequent conversation, at whatever level, begins by trying to establish what happened and when, and a household that can answer that in thirty seconds from a written sheet is in a different position from one reconstructing it aloud each time.

Expect no promise about the money, from anybody, and treat a promise as a reason for caution rather than comfort. Reporting quickly improves what is possible and it promises nothing. Most of the time the money does not come back. Saying so is the honest position, and this household ends the day Rs 18,000/- short despite doing everything in the right order inside thirty eight minutes.

Expect the household finances to need a decision within the week that has nothing to do with fraud at all. A buffer of Rs 13,320/- against Rs 42,770/- of monthly commitments is 0.31 months of cover, and that is a resilience question rather than a fraud question. The resilience question is answerable and the fraud question is not, so the two are worth separating. Spending a fortnight on the unanswerable one while the answerable one waits is very easy.

How do the Indian arrangements sit, and what has to be established at the source?

The four ordered actions are craft rather than law and they hold anywhere. A jurisdiction decides which bodies receive which report, what each one requires, and every period, number and rule attached to them. Every one of those particulars is established at the authority's own site rather than taken second hand.

A household that reads a period second hand, believes it, and acts on it has been handed something that resembles certainty and is not. A household told to establish it at the source has been handed one extra task and no false confidence. The second is the better trade every single time.