The series of financial frauds uncovered in Chandigarh and Haryana, spanning the IDFC First Bank, AU Small Finance Bank and Kotak Mahindra Bank, reveal a highly structured modus operandi. At the core, was a collusive network of bank officials, government employees, and private intermediaries who exploited systemic loopholes in public fund management and fixed deposit (FD) scheme processes.First, there was collusion across sectors. It involved government officials from where the funds originated, bank officials who were custodians of the deposited funds, and external facilitators, private entities who routed the siphoned-off money into real estate investments. Second, the fraud relied on paperwork manipulation, trust-based systems, and institutional gaps. Also, FDs, considered safe, became vulnerable due to manual controls, lack of real-time tracking, and dependence on bank confirmations.As per the investigation so far, here is a breakdown of how the fraud was allegedly executed.Step 1: Identifying vulnerable government fundsThe accused allegedly began by targeting government departments and civic bodies that routinely parked large sums in fixed deposits. Prominent among these were the state government’s panchayat department, municipal corporations, special purpose vehicles like Smart City missions, and agencies like CREST (renewable energy wing) of the Chandigarh Administration. Such bodies often maintain idle funds. temporarily invested in FDs, making them ideal targets due to large transaction size, limited real-time oversight, and reliance on manual or semi-digital processes.Step 2: Gaining insider access within banksA crucial pillar of the fraud allegedly was the involvement of bank officials, especially relationship managers and branch-level staff. Their role included accessing sensitive account details, understanding FD maturity cycles, manipulating internal banking systems, preparing forged statements, and liaising with government officials authorised to deal with bank. These bank officials allegedly bypassed safeguards that would normally prevent unauthorised withdrawals or transfers.Step 3: Forging or manipulating documentationThe conspirators then allegedly created or altered financial documents, including FD closure requests, authorisation letters, official instructions on department letterheads, bank vouchers, and bank statements showing the status of fund deposits. Such forged documents were presented to the government. While government records reflected a different status of deposits, the money had already been moved from the bank to private firms’ and individuals’ accounts and further into real estate projects. In some cases, documents were allegedly forged outright or prepared using insider knowledge of formats and verification gaps. This gave transactions surface-level legitimacy, allowing them to pass internal checks.Step 4: Premature closure or unauthorised liquidation of FDsUsing forged or manipulated instructions, the accused liquidated existing fixed deposits before maturity and redirected funds without proper approvals. Normally, premature FD closure requires multi-level authorisation and verification from account holders. However, due to collusion within banks, these checks were either skipped, fabricated, or falsely marked as completed.Story continues below this adStep 5: Diverting funds into layered accountsOnce FDs were liquidated, funds were transferred into multiple intermediary accounts. These accounts belonged to shell entities, associates of bank officials and private entities, and businesses controlled by intermediaries. The purpose was layering, a classic money-laundering technique: breaking large sums into smaller transactions and moving money across multiple accounts.Step 6: Use of private intermediaries and ‘beneficiaries’Private individuals, including realtors, jewellers, and businesspersons, played key roles, providing bank accounts for routing funds, acting as “end beneficiaries”, and helping convert funds into assets including real estate investments. These actors often had no formal link to the government bodies, helping obscure the money trail.Step 7: Fake reinvestments to delay detectionTo avoid raising suspicion, the accused sometimes created records showing funds were reinvested into new FDs or manipulated statements to reflect ongoing balances. This created an illusion that funds were still intact and investments were continuing normally; as a result, audits did not immediately flag discrepancies.Step 8: Exploiting weak audit and reconciliation systemsA major enabler of the fraud was the lack of real-time reconciliation between government departments, banks, and audit systems. Key weaknesses included delayed audits, over-reliance on bank-issued statements, and limited cross-verification. This allowed the fraud to continue for several months, possibly over two years, undetected.Story continues below this adStep 9: Repeating the pattern across multiple entitiesOnce the method proved successful, the same network replicated the process across different departments, using similar documentation and channels. That is why investigators found overlapping accused and identical transaction patterns across IDFC First Bank accounts, Smart City funds, CREST deposits, and Panchkula Municipal Corporation FDs.Step 10: Distribution and personal enrichmentAfter layering, funds were either withdrawn as cash, invested in real estate, or routed into personal or business accounts. The proceeds were allegedly shared among bank insiders, government officials, and private collaborators.Step 11: Collapse triggered by audit discrepanciesThe fraud began to unravel in January this year when the Haryana government’s Panchayat department detected internal discrepancies. Certain FDs failed to reflect in official records, and verification requests exposed missing funds. Once one case surfaced, notably the IDFC-linked fraud, it triggered wider scrutiny, cross-case linkages, and multiple FIRs across agencies.Which are the key companies under the scanner of probe agencies?Story continues below this adThe key entities in which government money was allegedly routed include RS Traders, Cap Co Fintech Services, SRR Planning Gurus Pvt Ltd, and Swastik Desh Projects Pvt Ltd, with funds allegedly diverted into real estate and jewellery businesses. Swastik Desh Projects Pvt Ltd is linked to Swati Singla and Abhishek Singla, while RS Traders is associated with Hemraj, allegedly a driver for a bank employee, and Cap Co Fintech Services is linked to Bhupinder Singh and Sapna. Other entities are associated with Chandigarh-based developer and hotelier Vikram Wadhwa, including Prisma Residency LLP and Kinspire Realty LLP.At the heart of the probe is the IDFC First Bank’s Sector 32 branch, where the prime accused, Ribhav Rishi, worked as branch manager when the funds were allegedly siphoned off.