One quarter's profit, gone! How IDFC First Bank fell victim to banking's oldest fraud in the age of cyberattacks

In the era of cyberattacks and algorithmic heists, private sector lender IDFC First Bank has been hit hard by forged incheques, the oldest fraud known to the banking industry, making its shareholders lose over Rs 14,400 crore in just a few hours on Monday morng.

The trail began on February 18, when the Haryana state government entities asked the bank to close some accounts and transfer funds. What came back was a discrepancy. The numbers didn't add up, and a paper trail pointed straight to fraud inside a Chandigarh branch. Five days later, 29 lakh shareholders were paying the bill.

IDFC First Bank shares crashed as much as 20% on Monday, and were on track to record their steepest single-day fall in the last 6 years, after IDFC First Bank disclosed that employees at its Chandigarh branch had allegedly cleared forged instruments in connivance with external parties, draining approximately Rs 590 crore from Haryana government-linked accounts.

The irony is not lost on the bank, which prides itself on being a technology-focused lender. Yet it was undone not by a digital breach but by paper — physical cheques that, in hindsight, were forged.

"This is not a digital transaction," Managing Director and CEO V. Vaidyanathan told investors on a call. "People came with forged cheques. Oldest kind of fraud probably known to banking.”

The fraud amount is not just a headline number but larger than the bank's entire Q3 net profit of Rs 503 crore — meaning one branch, in one city, has effectively erased a full quarter of earnings in a single stroke.

How it happened

The mechanics, as Vaidyanathan described them, are straightforward in their brazenness. Debit instructions arrived at the branch, supposedly from the Haryana government client, but were fraudulent. Employees processed them, cleared the forged cheques, and transferred funds out of the bank to beneficiary accounts that are now also suspected to be suspicious.

"This is clearly a case of employee fraud," Vaidyanathan said. "External parties are also involved."

He was careful to contain the blast radius. "There is no senior management involvement in the entire incident as far as we understand currently," he said, adding that the matter is confined to a limited set of government-linked accounts at one branch and has not touched any other customer or any other branch.

The bank is now racing to follow the money. "We are checking where the money has gone," Vaidyanathan said. "If the money has not left the banking system, we will be able to block it." The bank has already sent recall requests to beneficiary banks to lien-mark balances in suspicious accounts, a move that could claw back some of the loss, though the quantum remains uncertain pending KPMG's forensic audit and law enforcement investigations.

The scale of the damage, relative to the bank's size, is what rattled analysts. Nomura's Ankit Bihani calculated that the Rs 590 crore under reconciliation represents 28% of IDFC First's full-year FY26 forecast profit and 19 basis points of its CET-1 ratio, which stood at 14.23% as of December 2025.

UBS estimated the suspected amount at about 22% of the bank's fiscal 2026 profit after tax, though it noted the capital impact would be limited to around 1% of net worth. Morgan Stanley pegged the potential hit to FY26 profit before tax at roughly 20%.

The capital cushion, by most accounts, holds. But that is not what is keeping investors up at night.

"While the issue appears localized, it raises concerns around governance and branch-level controls," Bihani wrote. His warning on the provisioning math is sobering: in deposit-linked frauds, banks typically protect depositors and book the loss through the P&L once the fraud is established — meaning provisioning tends to be high, often full — while recoveries through insurance, asset seizure, or third-party liability are generally back-ended and uncertain.

"Given IDFC First Bank's retail deposit-led model, reputational perception remains critical, and the stock could remain under pressure until forensic findings and the financial impact are clearly established,” he said.

Jefferies added that the bank will need to strengthen operational controls and clarify that the issue has not spread to other clients, though it noted the matter did not appear systemic.

Vaidyanathan faced the unenviable task of explaining how a bank with maker-checker-authoriser controls, SMS alerts, monthly statements and balance confirmation certificates still got defrauded for Rs 590 crore.

His answer: the system worked. The people subverted it.

"It appears that connivance between the employees and third parties has led to the clearing of instruments, which, in hindsight, are appearing forged," he said. He leaned on the bank's decade-long track record to frame this as an aberration. "We have been in operation for over 10 years and have rolled out over 1,000 branches, and have had no such incident before."

He acknowledged that controls would be tightened in the aftermath. "In light of the incident, we will try to enhance certain controls as we move along," he said, while maintaining that the breach was human, not structural. "I can assure you that this issue is confined to only this branch."

On the bank's ability to absorb the blow, he was measured but firm: "The bank is well capitalised, and profitability is on a positive trajectory because of falling credit costs and expected improvement in net interest margin during the fourth quarter, and hence, this number should be manageable."

The bank's response has been swift. Four branch officials have been suspended — all those currently under suspicion, Vaidyanathan confirmed. Police complaints have been filed. Statutory auditors and regulators have been informed. The fraud management committee, audit committee, and board have all convened emergency meetings. KPMG has been appointed for an independent forensic audit, with law enforcement agencies also engaged.

"More details will be known after the forensic audit — everybody will be investigated, trails will be followed," the bank management said.

The final figure will depend on the validation of claims, recoveries through lien marking, liabilities of third parties involved, and the outcome of legal proceedings.

Beyond the balance sheet, the reputational damage has taken on a political dimension. The Haryana government has de-empanelled IDFC First Bank, along with AU Small Finance Bank, directing all state departments to close their accounts with both lenders. For a bank whose retail deposit franchise is central to its identity and growth story, losing a state government as a client is a signal the market cannot ignore.

The forensic auditors at KPMG now hold the answers. Until their findings are public, the stock faces a simple, uncomfortable truth: a technology-forward bank was brought low not by hackers or algorithmic exploits, but by paper, pen, and the oldest trick in the book.