Quick Answer
Forensic accounting applies investigative and accounting skills to establish what happened, who did it, how much was lost, and what evidence proves it — to a standard usable in court. This article dissects four landmark Indian frauds — Satyam (₹7,100+ crore fictitious assets), PNB–Nirav Modi (₹13,000+ crore unrecorded LoUs), IL&FS (group-wide evergreening), and DHFL (₹31,000+ crore diverted through fictitious retail loans) — plus five anonymised mid-market investigations from our own CFE-led practice: vendor billing schemes, ghost employees, inventory shrinkage, teeming-and-lading, and promoter fund diversion. Each case ends with the red flags missed and the control that would have stopped it.
Last Updated: 15 August 2026 | Applies To: Boards, audit committees, CFOs, lenders, insolvency professionals and anyone who suspects — or must rule out — financial wrongdoing | Reference: Section 447, Companies Act, 2013 (punishment for fraud); Section 143(12) auditor reporting; SA 240; RBI Master Directions on Frauds; ACFE Fraud Examiners Manual
Fraud is a pattern business. The names change — an IT major in Hyderabad, a jeweller in Mumbai, an infrastructure conglomerate, a housing financier — but the mechanics repeat with remarkable discipline: a dominant insider, a control that exists on paper but not in operation, records controlled by the person they would incriminate, and years of red flags rationalised away. Studying cases is therefore not corporate true-crime entertainment; it is the cheapest forensic training available. This guide works through India’s four defining corporate frauds and five smaller investigations of the kind that never make the newspapers but quietly drain mid-market companies every year. For each: how the scheme worked, how it was concealed, how it surfaced, what the forensic team actually did, and the specific control that would have killed it early.
Definition — Forensic Accounting: The application of accounting, auditing and investigative techniques to examine financial records and transactions for use in legal proceedings — combining evidence preservation, funds tracing, data analytics, interviews and loss quantification. Unlike a statutory audit, which opines on true-and-fair presentation using samples, a forensic engagement targets allegations, examines full populations, attributes responsibility and produces evidence that must survive cross-examination.
| Aspect | Statutory audit | Forensic investigation |
|---|---|---|
| Objective | Opinion on true-and-fair presentation | Establish facts, attribute responsibility, quantify loss |
| Coverage | Sampling and materiality thresholds | Full transaction populations in the target area |
| Starting assumption | Professional scepticism, but no presumed wrongdoing | Specific allegation or anomaly to prove or disprove |
| Evidence standard | Sufficient appropriate audit evidence | Admissible: chain of custody, electronic-records certification, deposable methodology |
| Output | Audit report on the financial statements | Findings report, loss quantification, action matrix, expert testimony |
The distinction matters because every major case below features the question “where were the auditors?” The honest answer is that a sample-based true-and-fair opinion is structurally weak against a determined insider who controls the records — which is precisely the gap forensic accounting exists to close, and why fraud-specific credentials such as the Certified Fraud Examiner (CFE) focus on evidence, interviews and concealment patterns rather than accounting presentation.
The scheme. For years, Satyam Computer Services inflated revenue and profits by generating fictitious invoices through its own billing system and parking the fictional profits as fictitious cash and bank deposits — ultimately about ₹5,040 crore of non-existent bank balances, ₹3,983 crore of overstated debtors and understated liabilities, netting to roughly ₹7,100 crore of assets that did not exist. Headcount was also inflated, with salaries for non-existent employees flowing back to controlled accounts.
The concealment. Forged fixed-deposit receipts and bank confirmations. Critically, balance confirmations reached the auditors through management rather than directly from banks — the single point of failure the entire edifice rested on.
The exposure. The December 2008 attempt to acquire Maytas Properties and Maytas Infra — promoter-family companies — would have converted fictional cash into real assets and closed the hole. Investor revolt killed the deal, and on 7 January 2009 chairman B. Ramalinga Raju confessed, famously describing the ride as “a tiger, not knowing how to get off without being eaten.”
The forensic work. Multi-agency investigation (SFIO, CBI, SEBI) reconstructed the real financials: direct bank confirmations, invoice-level analysis distinguishing genuine billing from the fake-invoice series (the system carved out a hidden invoice range), payroll validation against bank credits, and email forensics establishing knowledge and intent. Sentences, auditor bans and SEBI disgorgement orders followed; the company survived only through a government-supervised sale to Tech Mahindra.
The control that would have stopped it: independent, direct bank confirmation — the auditor obtaining balances straight from the bank with no management intermediation. One properly executed confirmation cycle would have collapsed the fraud years earlier. Post-Satyam, direct confirmation and the NFRA regime exist precisely because of this case.
The scheme. Between roughly 2011 and early 2018, employees at Punjab National Bank’s Brady House branch issued Letters of Undertaking (LoUs) — guarantees enabling overseas branches of Indian banks to extend buyer’s credit to Nirav Modi and Mehul Choksi group firms — over the SWIFT network without recording them in the bank’s core banking system (CBS). Total exposure exceeded ₹13,000 crore.
The concealment. The fraud lived in the reconciliation gap: SWIFT said the obligations existed, CBS said they didn’t, and the same small group of insiders controlled both message entry and reconciliation, with one official remaining in the same seat for years. Fresh LoUs repaid maturing ones — a rolling structure with no net repayment.
The exposure. The key official retired. When the group’s firms sought fresh LoUs in January 2018, the new officer asked for cash margin; the borrowers protested that no margin had ever been required — and the bank went looking for the prior approvals that did not exist in its systems.
The forensic work. Reconciliation of seven years of SWIFT message logs against CBS entries; funds-flow tracing through overseas nostro accounts to map where buyer’s credit proceeds went (heavily round-tripped to repay earlier LoUs); identification of the internal maker-checker collapse; and the RBI’s system-wide mandate that followed — SWIFT–CBS integration became compulsory for all Indian banks. Our guide to the RBI fraud investigation framework covers the reporting machinery this case reshaped.
The control that would have stopped it: daily independent reconciliation of the external messaging system against the ledger, plus enforced rotation and mandatory leave. Any fraud that requires one person to stay in one seat forever is a fraud that mandatory leave detects.
The scheme. Infrastructure Leasing & Financial Services, sitting atop ~347 group entities and around ₹91,000 crore of consolidated debt, defaulted in mid-2018. Investigations found years of evergreening — new loans to stressed borrowers (and to group entities) used to service old ones, keeping accounts standard on paper — alongside lending to borrowers connected to the approving executives, remuneration disconnected from reality, and a group structure opaque enough that risk never aggregated anywhere.
The concealment. Complexity itself. Each entity’s accounts could look defensible in isolation; the rot was only visible in the consolidated funds flows — who was actually generating cash versus who was borrowing to pay interest. Credit ratings stayed investment-grade until weeks before default.
The exposure. Plain liquidity failure: commercial-paper and inter-corporate deposit defaults in June–September 2018 forced a government supersession of the board under Section 241 of the Companies Act — the first since Satyam.
The forensic work. Multiple forensic reviews across the group traced circular funds flows, mapped the borrower-approver relationships, and re-aged the loan book to show what would have been NPA without evergreening. SFO-style attribution across hundreds of entities required entity-relationship mapping — essentially building the group’s true organogram from bank statements outward. The NCLT-supervised resolution continues to distribute recoveries years later.
The control that would have stopped it: consolidated exposure monitoring — a single view of group-wide leverage and related-party flows — plus a board that priced the conflict of interest in lending to connected borrowers. Complexity is not a business model; it is a concealment method.
The scheme. Dewan Housing Finance Ltd. was found by forensic reviews and the CBI to have disbursed enormous sums through fictitious retail home-loan accounts — lakhs of borrower records, many linked to a notional “Bandra branch” that existed only as a database construct — with funds diverted to promoter-linked entities. The CBI’s charge, at over ₹34,000 crore of lender loss, made it India’s largest bank-fraud case at filing.
The concealment. Volume and plausibility. Retail home loans are individually small and collectively vast; auditors and lenders see portfolio statistics, not individual files. The fake accounts were interleaved with genuine ones in management-information systems, and separate software instances kept the parallel book.
The exposure. Liquidity stress after IL&FS froze the NBFC funding market in late 2018; a media exposé alleging diversion in January 2019; then lender-commissioned forensic audits under the RBI’s stressed-asset framework — the reviews that found the fictitious-borrower machinery.
The forensic work. Population-level analytics did the heavy lifting: duplicate matching across borrower KYC fields (same PAN patterns, addresses, phone numbers across thousands of accounts), disbursement-to-repayment circularity testing, branch-code validation against physical branch registers, and funds tracing from disbursement accounts to the ultimate beneficiaries. It is the clearest Indian illustration that digit and pattern analytics over full populations find what file-by-file review never will.
The control that would have stopped it: independent data-analytics validation of the loan book — KYC-field duplicate testing and branch-existence checks are cheap, automatable, and would have flagged the parallel book years earlier.
The setting. A Chennai-based components manufacturer, ~₹180 crore revenue. A whistleblower email through the company’s vigil mechanism alleged “something wrong with maintenance vendors.”
What we found. The purchase manager had created two shell vendors in the master — GST registrations genuine but obtained on rented premises, bank accounts controlled by relatives. Over 34 months the shells billed ₹2.7 crore for machine-maintenance services that were either never rendered or duplicated genuine vendors’ work. Invoices sat just below the ₹1 lakh threshold requiring second-signatory approval — a pattern our threshold-splitting analytics flagged within the first week. Vendor-master-to-payroll matching then showed a shell vendor’s contact number matching the purchase manager’s emergency-contact field.
The outcome. Termination, police complaint, ₹1.1 crore recovered through settlement against the employee’s terminal dues and property, and an insurance claim under the fidelity-guarantee policy for the balance — the quantification section of our report becoming the claim document. Full detail of this engagement type is on our vendor fraud forensic audit page.
Red flags that were visible for three years: vendors with no landline, no website and a residential address; invoices always just under an approval threshold; one buyer handling vendor creation, ordering and goods-receipt confirmation for the same category. Threshold-clustering is one of the most reliable analytics screens we run.
The setting. A facilities-management company with 4,000+ deployed staff across client sites in three states. Margins in two regions persistently lagged budget despite full billing.
What we found. Regional supervisors maintained 62 ghost employees — some entirely fictitious, some ex-employees never removed — with salaries flowing to bank accounts the supervisors controlled. Concealment relied on the gap between HR’s master and site-level attendance: attendance was marked on paper at sites and keyed in centrally by the same supervisors. Analytics that exposed it: bank-account duplicate testing across the payroll file (several “employees” sharing account numbers), PF/ESI registration mismatches, and zero leave, zero attrition, zero medical claims across the ghost population — real humans generate HR noise; ghosts are suspiciously perfect employees.
The outcome. ₹1.9 crore quantified over four years; supervisors dismissed and prosecuted; biometric attendance integrated directly to payroll. See our employee fraud investigation practice page for the methodology.
The setting. A distributor business where one accounts executive controlled both customer receipts and the receivables ledger — the classic segregation failure.
What we found. The executive pocketed cash and cheque receipts from Customer A, then applied Customer B’s later payment against A’s account, B covered by C, and so on — teeming and lading, a lapping scheme that stays invisible as long as new receipts keep arriving. It surfaced in our review of a different matter when customer-statement reconciliations showed payment dates in customer records preceding ledger application dates by 20–40 days, consistently, for one collection route. Confirmation letters to a sample of customers — sent independently, Satyam’s lesson applied at SME scale — broke the chain: ₹68 lakh permanently missing, the float having grown for six years.
The outcome. Recovery from the employee and the bonding insurer; receipts function separated from ledger maintenance; automated customer-statement circulation quarterly so that the customer, in effect, audits the company’s ledger for free.
The setting. An electronics retailer wrote off 2.8% of inventory annually as “shrinkage” — rationalised as industry-normal damage and pilferage. New CFO asked whether it actually was.
What we found. Analytics on write-off entries showed the losses concentrated 4:1 in one warehouse, spiked in the week before each physical count, and clustered in high-value small-form-factor SKUs (phones, memory cards) rather than tracking the store-wide sales mix — the signature of theft, not damage. CCTV retention had been quietly reduced at that warehouse from 90 to 14 days. A controlled surprise count with an independent team, reconciled to gate-pass logs, established a two-employee scheme moving stock through fake “damage return” documentation: ₹94 lakh over 26 months against total write-offs of ₹1.3 crore.
The outcome. Prosecution, insurer recovery, perpetual-inventory cycle counting replacing predictable annual counts, and write-off approval moved out of warehouse control. Shrinkage fell to 0.6% the following year — the difference was never “normal”.
The setting. Engaged by the resolution professional of a mid-sized manufacturer in CIRP to examine transactions in the two-year look-back window under Sections 43–66 of the Insolvency and Bankruptcy Code.
What we found. In the eighteen months before admission: sales to a promoter-relative’s trading entity at prices 18–22% below the price charged to arm’s-length customers for identical SKUs (undervalued transactions, Section 45); repayment of a promoter’s personally guaranteed loan ahead of operational creditors (preference, Section 43); “advances to suppliers” that looped through two intermediaries back to a promoter LLP (fraudulent trading, Section 66); and an asset sale of idle machinery at scrap value to a connected buyer who re-sold it working, at four times the price, within ninety days. Funds-flow tracing across 14 bank accounts and price benchmarking against the company’s own invoice history carried the burden of proof.
The outcome. Avoidance applications filed before the NCLT quantifying ₹23 crore of recoverable transactions; the report also grounding a Section 66 personal-liability claim against the directors. For companies on the borrower side, this is the same lens lenders now apply routinely through mandated forensic audits of stressed accounts — see our financial statement fraud detection page for the red-flag framework.
Nine cases, one recurring toolkit:
CA V. Viswanathan, FCA, CFE (Certified Fraud Examiner): After investigating frauds across manufacturing, retail, NBFC and services businesses, I hold two convictions that the headline cases and the small ones equally support. First, fraud is a control-design problem before it is a character problem. In every engagement — from a ₹68 lakh lapping scheme to promoter diversion in the tens of crores — the scheme mapped exactly onto a point where one person controlled a transaction and the record of that transaction. The Fraud Triangle’s “opportunity” leg is the only one a company controls, and it is entirely a design choice. Second, the data almost always knew first. Benford deviations, threshold clustering, duplicate bank accounts in payroll, write-offs spiking before counts — these signals sat in the ERP for years before any human complained. The CFE discipline I bring to these engagements is less about accounting than about evidence: preserving mailboxes before the first interview, sequencing interviews so subjects face documents rather than suspicions, and writing the report knowing opposing counsel will read every line. My advice to any board reading this: commission analytics-led health checks on payments, payroll and inventory every year or two, not because you distrust your people, but because the honest majority deserves controls that make the dishonest minority’s opportunity expensive. And when a complaint does arrive, spend the first 72 hours on preservation, not confrontation — that window decides whether you end up with a substantiated finding or an expensive suspicion.
Suspect a fraud — or need to rule one out?
Virtual Auditor’s CFE-led forensic team handles evidence preservation, analytics, funds tracing, interviews and court-ready reporting across India. Call +91 99622 60333 or contact us online for a confidential discussion.
What is forensic accounting and how is it different from a statutory audit?
Forensic accounting is the application of accounting, auditing and investigative skills to examine financial records for use in legal or disciplinary proceedings. A statutory audit expresses an opinion on whether financial statements are true and fair, on a test-check basis, assuming management integrity unless red flags emerge. A forensic engagement starts from the opposite premise — it targets specific allegations or anomalies, examines entire transaction populations, preserves evidence to an admissible standard, attributes responsibility, and quantifies loss.
How was the Satyam fraud finally exposed?
By confession, not detection. In January 2009 chairman B. Ramalinga Raju admitted that about ₹7,100 crore of the company’s reported assets — mainly cash and bank balances — were fictitious, after an aborted attempt to acquire Maytas entities that would have converted the fictional cash into real assets. The subsequent forensic investigation found forged fixed-deposit confirmations, thousands of fake invoices generated through the billing system, and inflated headcount. The enduring lesson is that auditors relied on management-routed bank confirmations instead of obtaining them directly and independently.
How did the PNB–Nirav Modi fraud stay hidden for so long?
The Letters of Undertaking were issued through the SWIFT messaging system without being recorded in the bank’s core banking system (CBS), so the bank’s own books showed no exposure. A small group of insiders controlled both SWIFT access and its reconciliation, and rotating LoUs repaid earlier ones. It surfaced only when the responsible official retired and his successor demanded cash margin for a fresh LoU request. The forensic lesson: reconcile independent external data streams (SWIFT logs) with internal books, and never let the maker of a transaction also be its checker.
What red flags were common across Satyam, IL&FS and DHFL?
Recurring signals include growth or margins persistently smoother than peers, cash that exists on paper but generates abnormally low interest income, heavy reliance on related-party or round-trip transactions, opaque group structures with hundreds of subsidiaries, dominant individuals with unchallenged authority, frequent changes in or unusual dependence on auditors, and borrowings that keep rising while reported cash stays high. None of these proves fraud alone — the pattern, tested against independent evidence, is what matters.
What techniques do forensic accountants actually use in these investigations?
Core techniques include direct third-party confirmation of balances, funds-flow tracing across bank statements to map diversion, data analytics on full transaction populations (duplicate testing, vendor-employee matching, threshold-splitting screens, Benford’s law digit analysis), email and device forensics to establish knowledge and intent, interview programmes sequenced from witnesses to subjects, and loss quantification suitable for court, arbitration or insurance claims. Chain-of-custody documentation runs through everything so findings remain admissible.
When should a company commission a forensic audit?
Triggers include a specific whistleblower complaint, unexplained cash or inventory shrinkage, vendor or payroll anomalies, suspicion of financial-statement manipulation before a transaction, lender-mandated reviews of stressed borrowers under RBI norms, disputes between promoters or JV partners, and regulatory notices from SFIO, SEBI or the ED. Engage early — evidence decays fast, and preservation in the first days determines what the investigation can prove months later.
Can forensic audit reports be used in court in India?
Yes, if the work is done to an evidentiary standard. Reports and underlying evidence are used in proceedings before NCLT, criminal courts, arbitral tribunals and regulators. Electronic evidence must satisfy the certification requirements for electronic records under Indian evidence law, collection must maintain chain of custody, and the expert must be able to depose to methodology. This is where Certified Fraud Examiner training matters — CFEs are trained specifically in evidence handling, interview law and report-writing for legal use.
What does a forensic accounting engagement cost in India?
Scope drives cost: a focused review of one vendor relationship or one suspect employee is a few lakh rupees and two to four weeks; a multi-entity funds-tracing investigation across years of data runs materially higher and several months. The recoveries and the litigation position it creates usually dwarf the fee — in our mid-market cases, quantified findings routinely exceed ten times the engagement cost. Most firms, including ours, scope a fixed-fee phase 1 (preservation plus preliminary findings) before any open-ended phase.
Why do most corporate frauds in India go undetected for years?
Because the person running the scheme usually controls the records that would reveal it, and routine controls test form rather than substance. Global fraud studies put median scheme duration near 12-18 months, and longer where senior management is involved. Detection improves dramatically with three things: a trusted whistleblower channel (tips are the top detection method), periodic data analytics over full populations rather than samples, and genuine segregation of duties over payments, master data and reconciliations.
What controls would have stopped the frauds described in these case studies?
Direct, independent confirmation of bank balances and receivables; integration and daily reconciliation of external systems like SWIFT with the core ledger; enforced maker-checker separation with mandatory leave; vendor master hygiene with independent verification of new vendors; surprise counts of inventory and fixed assets; analytics-based continuous monitoring; and an empowered audit committee that treats whistleblower complaints as priority intelligence rather than nuisance. Every scheme in this article defeated a control that existed on paper but not in operation.
Facing a suspected fraud, a lender-mandated forensic audit, or an NCLT avoidance-transaction review? Virtual Auditor’s CFE-led team investigates, quantifies and reports to court-ready standard. Call +91 99622 60333 or email support@virtualauditor.in.