A significant increase in corporate frauds has been witnessed in last few years

Dr. Harold D’Costa, President, Cyber Security Corporation

Corporate fraud is not a new phenomenon, as it has been going on for years. But in the past 2-3 years, a significant amount of increase has been witnessed. A corporate data fraud worth 450 crores came up some time back where an email played a significant role. I am giving the anecdotes as Company A and B. Both these companies collaborated to form a private limited company as Company C. Company C had five directors, of which three were of Company B and two were from Company A. Company A happened to be the investor as well as one of the stakeholders in the management of the organization.

Company B was actually a process oriented company, which means that this organization had the knowledge base where the investment that would come from Company A would be used by Company B and the profits would be shared according to the proportion which was made in the agreement. During the Board of Directors meeting, a resolution was adopted stating that an independent management team should be selected and that Company A will not be held liable for any project delays. Furthermore it mentioned that any delay would result in extension of the loan repayment to the Company B. This is a very critical point of how Company A later on made an allegation against Company B for a project delay.

Post the board meeting, due to the delay in the project, Company A was served with a legal notice for repayment of the debt to the sum of rupees 450 crores which included the principal amount, interest and opportunity cost. As a result of receiving an unreasonable notice, Company A filed a civil suit against Company B, saying that the investment which they gave was not properly utilized by Company B and the total damages which they claimed across was about Rs 450 crores from Company B.  Company B went for an appeal, filed a civil suit and said that it was an injustice against them.

The most important part of this case was that Company B wanted to prove that Company A was not only involved in making an investment, but also played an active role in the management of the company. And that's the reason when the civil suit was filed, Company B put a petition in the court asking that the emails which were circulated from the official domain of the company to be put on record in the court. Because these official emails would then give the indication that Companies A and B were together running the management of the company and A was just not an investor in the company. When Company B filed an application, they found that Company A had deleted the emails.  The deletion of any emails or distortion of any information amounts to a cybercrime. And when they noticed that there were some emails which had been deleted, they made a criminal complaint. Corporates would not like to take a matter to the law enforcement agency, unless they are of such prime importance. When the analysis was done, it was found that about 2000 emails were deleted and that's the piece of evidence they gave to the law enforcement agency. The police filed an FIR, but during the investigation they found that the complaint which was made by Company B was frivolous. So instead of filing a chargesheet, they filed a summary report that is called a B Summary report. It indicated that the charges were frivolous and the complaint fake and therefore Company B should be prosecuted.

During the investigations there were several shortcomings. When the laptops of the accused were seized, it was found that the files of the accused were in Outlook Express which were compared with G suite. The accused had deleted significant emails which stand as primary evidence in court from the G Suite. But the OST and the PST files which were available from the laptop of the accused served as the primary source to make a comparison between the G Suite of the accused and the OST and the PST files of the accused. When the investigation was completed, nobody thought that one significant claim of finding out whether the emails were deleted or not would come from the OST and the PST files. We usually conclude that if any email is deleted from G Suite, then that cannot be recovered. But up to 55 days, these mails can be recovered even if they are deleted from the G Suite. However, in this case, the time of the complaint made and the data which was recovered were more than 55 days.  Therefore Google also could not help us in providing the information to us. But the PST and the OST files in the accused laptop played a very significant role and there we found what information we needed.