How Do RBI's Fraud Risk Management Directions Apply to Deepfake Fraud?

What do the RBI fraud risk management directions require, and where do deepfakes fit?

On 15 July 2024 the Reserve Bank of India replaced its older fraud circulars with three revised Master Directions on fraud risk management: one for commercial banks (including regional rural banks) and all-India financial institutions, one for cooperative banks, and one for non-banking financial companies. They share a structure: a board-approved fraud risk policy, a special board committee to monitor frauds, principles of natural justice before anyone is declared fraudulent, an early warning system, red-flagging of accounts, staff accountability, and reporting to RBI and law enforcement. RBI updates and consolidates its directions over time, so check the current version for your entity.

None of the three uses the word deepfake. They do not need to. A face-swapped video used to open a mule account, a cloned voice used to authorise a payment, and a synthetic video call impersonating a relationship manager are all frauds the framework already covers. The question for a bank is where synthetic media shows up in its own fraud lifecycle and which controls in the directions should catch it.

The commercial bank direction puts that work under its early warning chapter. Paragraph 3.3.2 requires a dedicated Data Analytics and Market Intelligence Unit, sized to the bank, to collect and process information for early detection and prevention of potentially fraudulent activity. Paragraph 3.4 extends the early warning system to non-credit and digital transactions, which is where most deepfake-enabled fraud lands.

What does RBI's early warning system require for digital fraud?

Paragraph 3.4.1 asks banks to identify suitable indicators, parameterise them in the early warning system for non-credit transactions, upgrade the system continuously and test its effectiveness periodically. Paragraph 3.4.2 requires a design that keeps customer data secure and monitors transactions for potential fraud on a real-time basis, with particular vigilance over non-KYC-compliant and money mule accounts. Paragraph 3.4.3 asks the analytics unit to monitor transactions through digital platforms and applications to spot unusual patterns in time. Banks had six months from issuance to upgrade their systems.

These provisions give deepfake signals an obvious home. A high manipulation score on an onboarding selfie or a V-CIP frame is an early warning indicator for a potential mule account. A synthetic-voice flag on a phone instruction to add a payee is an indicator on a non-credit transaction. Both belong in the same alert queue as device, behavioural and transaction signals, with the same examination timelines and red-flag escalation the directions set for other alerts.

How should a bank report a deepfake-enabled fraud to RBI?

Through the Fraud Monitoring Return. Paragraph 6.1 asks banks to choose the most appropriate category from a fixed list, which includes cheating by concealment of facts and cheating by impersonation, and forgery. There is no deepfake category, so the bank classifies by the underlying conduct: a cloned voice of a customer is usually impersonation, a synthetic identity document is usually forgery. The return is due within 14 days of classifying the incident as fraud. Payment-system frauds that are disputed, suspected or attempted go to the Central Payments Fraud Information Registry, and are reported again through the Fraud Monitoring Return if later concluded to be fraud.

Law enforcement reporting follows separate thresholds. For public sector banks, for example, frauds below ₹6 crore go to state or union territory police and those of ₹6 crore and above go to the Central Bureau of Investigation, and every bank must name nodal officers for this coordination. A V-CIP forged-identity case also has a parallel duty under the KYC Directions, which require detected forged identities through V-CIP to be reported as a cyber event.

Why does evidence quality matter before declaring a deepfake fraud?

The directions require a time-bound natural justice process before persons or entities are declared fraudulent: a detailed show cause notice setting out the transactions and events relied on, at least 21 days to respond, and a reasoned order. That standard matters for synthetic media. A bare detector score is weak ground for an adverse finding against a customer, who may be a victim whose face or voice was cloned rather than a participant.

Build case files that hold up. Combine the media analysis with account activity, device and session data, communications, payment movement and reviewer conclusions. Record the detector and its version, the input quality and any conflicting evidence, and why the final decision went the way it did. Monitor false positives across channels and customer groups so that deepfake controls do not quietly push genuine customers into red-flag queues.

How can Neural Defend feed RBI fraud controls?

For real-time early warning, NeuroVerify takes a face image, video or audio in one API call and returns one unified risk score with signal-level evidence from six signals, including Live Presence Verification, Face Manipulation Detection and AI Generative Model Analysis. Eligible image requests return in under 200 ms at p95 under defined test conditions, so scores can flow into the early warning system alongside transaction and device indicators without slowing onboarding or payments. Your fraud policy, not the model, decides whether a score raises an alert, a red flag or nothing.

For investigation and classification, NeuroDetect gives the fraud team a forensic case workspace. Analysts examine the onboarding video, call recording or submitted image with heatmaps and attention views down to regions, frames and audio segments, and download a report with observations, uncertainty, provenance, model context and analyst notes. That report supports the show cause notice, the Fraud Monitoring Return and any law enforcement referral. Voice-channel teams can evaluate NeuroCall (Beta) for synthetic voice detection on calls.

RBI expects customer data in fraud monitoring systems to stay secure. Neural Defend can deploy on-premises, air-gapped, as a secure container or in the bank's private cloud or VPC, and holds ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 42001 and SOC 2 Type II certifications. On the public VendorBench-100 benchmark of 100 adversarial still images, Neural Defend ranked first of 36 systems with an MCC of 0.876.