The MphasiS Scandal – And How it Concerns U.S. Companies Considering Offshore BPO

June, 2005

Some of our clients may be concerned about highly-publicized news detailing the activities of call center employees who, working for CitiGroup in India, obtained passwords from U.S. citizens and used the information to illegally transfer large sums of money into bogus bank accounts. 

Here are the facts behind this story and some important considerations about the true risks of offshore outsourcing.

The Facts:

• In December 2004, four call center employees, working at an outsourcing facility operated by MphasiS in India, obtained PIN codes from four customers of MphasiS’ client, CitiGroup. These employees were not authorized to obtain the PINs.
• In association with others, the call center employees opened new accounts at Indian banks using false identities. Within two months, they used the PINs and account information gleaned during their employment at MphasiS to transfer money from the bank accounts of CitiGroup customers to the new accounts at Indian banks.
• By April 2005, the Indian police had tipped off to the scam by a U.S. bank, and quickly identified the individuals involved in the scam. Arrests were made when those individuals attempted to withdraw cash from the falsified accounts.
• $426,000 was stolen; the amount recovered was $230,000. Detailed investigations are ongoing, and it will take about three years for the perpetrators to be tried and sentenced.

Have There Been Similar Cases of Fraud Involving BPO Services in India?

Other than the MphasiS case, there have been no other reported cases involving a BPO service provider. Credit card fraud cases have been uncovered that involved the use of fraudulent cards originating from the Far East, but those cases were not linked to an outsourcing provider.

Another incident involved the customer service representatives of a BPO outfit extending credit limits without authorization. In this case the incident was quickly detected and the employees terminated.

A case of identity theft was also reported but the incident was quickly detected and closed before any damages occurred.

How Does the Indian Government Protect U.S. Companies That Offshore Business Processes?

India has well-established laws and a legal framework covering white-collar crimes. The Information Technology Act of 2000 goes further than previous legislation by addressing cyber crime. It links with the Indian Penal Code, making its coverage extensive. A number or other statutes exist covering contracts, company law, and the like.

Within this framework, BPO service providers can further protect their clients’ interests through enforceable contracts that address the issues of losses arising from the services provided. Moreover, the Indian insurance market is evolving and some insurance coverage is available to cover employee fraud.

How Do Fraud Cases in India Compare With Fraud in the U.S. and Other Countries?

Credit card fraud in India is rare by comparison to other parts of the world – approximately $900,000 annually. Fraud losses specifically related to BPO services are less common.

By contrast, annual credit card fraud and ID theft losses in the U.S. are in the $2 billion range.

Globally, the top ten countries in terms of fraud losses, according to a 2000 report prepared by the National White Collar Crime Center and the Federal Bureau of Investigation, and published by the Internet Fraud Complaint Center, include the U.S., Canada, Ukraine and the Netherlands, but not India. Even if the data were updated, it is unlikely that India would figure anywhere near the top ten.

Conclusion

The MphasiS incident received a great deal more press coverage than similar (and more devastating) fraud cases in the U.S. and around the world. In reality, the risk of fraud involving outsourced services is greater in the U.S. than in India.

Moreover, criminals in the MphasiS case were apprehended quickly and significant sums were recovered -- due to stringent enforcement and a high degree of cooperation between U.S. and Indian law enforcement and government agencies. This bodes well for any company considering offshore outsourcing at this time.

While every instance of fraud is serious and should raise concerns, Call Center Magazine on the web (April 08, 2005) summed up its opinion of the press coverage the MphasiS case received:

“…This kind of thing, though unfortunate, happens everyday in the US, the UK, and around the world. The fact that such a small scale theft came to light shows that the process actually works; customers report missing money; missing money is returned to customer; people who steal are caught.”

India offshore outsourcing - offshore outsourcing - Carretek