Outsourcing exposes firms to fraud.
By Zubair Ahmed, Mumbai
Excerpts from BBC News June 16, 2005

The arrest last week of a man in western India in an alleged call-centre fraud case went unreported. This was despite the high-profile reporting on the case in April when 16 others were arrested. The alleged fraud amounted to nearly $400,000.

Amid calls for tightening BPO regulations and more effective cyber laws the country's call centres are busy taking adequate security measures. Another one or two such cases and the industry is doomed, they admit.

Police, who are still investigating the case, believe it was well thought through and very organised.

Investigating officer Sanjay Yadav says the latest arrest just highlights how well-planned and widespread the fraud was.

Backlash fears
Police say some of the 17 people currently languishing in jail opened fake accounts, and allegedly transferred large sums from the bank accounts of four American customers of a large multinational bank whose back office work was being done by an IT firm in Pune near Mumbai.

Mr Yadav says they went on a luxurious holiday to Bangkok and kept transferring more money into their fake accounts from the Thai capital.

The industry, fearing a backlash from clients in the West, has started to get its act together.

One of the security steps the BPO centres are taking is the stringent background screening of new employees.

Yogesh Bhura, whose company, Quest Research, undertakes this task, has more than 250 BPO customers.

He has clients all over Asia, but many of his new customers are Indian.

But Mr Bhura's main challenge remains "educating people of the need to make this critical activity an integral part of their recruitment policy."

He reveals that 10-25% of applicants to call centres provide false and incorrect information.

"Fake degrees and documents are a major concern of our clients," he says.

Screening
But verifying an applicant's criminal background remains the most challenging task for companies such as Mr Bhura's and he admits it: "It's a grey area: there's no central data of criminals, there's no standardised process of data storage in police stations. It's a continuous challenge."

Many believe background screening is not enough. Mr Bhura is quick to add a rider: "It's a risk mitigation and not a risk elimination activity."

But one of his clients, Intellinet Global Services, a joint venture between HDFC and Barclays, says background verification is not the only security tool it's applying.

"We take a lot of precautions," says Manuel D'Souza, the company's HR head.

"We don't allow mobile phones in the office, no e-mail access is provided; pen and papers are not allowed in and all employees are screened when they leave the office."

But experts say call centres are a young industry in India. It still doesn't have a comprehensive security management system in place.

Most of the BPOs have put the basic IT systems in place, they have put in a lot of money, but the management of IT infrastructure is not up to the mark.

This is one of the major problems with the $4bn BPO industry, which began to flourish in India just five years ago.

Security hole
According to industry estimates, 80% of BPO companies don't use integrated security management tools. That probably explains why some current and former employees of the Pune-based company, which has a security certification from an international trade body, allegedly stole huge sums belonging to its clients in the U.S.

Growth brings in its own pressures. Back office business is one of India's sunshine industries, growing at 30% annually. The workforce is young, loyalty is low as the young boys and girls move to greener pastures at the first opportunity.

For most of them it's not a career option, but a good first job out of college. The workforce turnover is as high as 40%. Work from the US and Europe is pouring in thick and fast.

Cyber squad
Industry players admit they know security is the top priority, but they say there is no time to implement all the security measures.

Mr Bhura says background screening is just one of the security measures: "Internal security control has to be the most important component of the overall security system".

But one can take a lot of satisfaction from the fact that a relatively small city like Pune has a Cyber Crime Cell.

The alleged fraud was committed in Pune and it was busted by the city's Cyber Crime Cell.

As Mr Yadav of the Cell says: "We have acted swiftly to bust the fraud and recovered most of the money siphoned off. Pune police are providing a safe environment for BPO customers from the West."

Till the time the authorities come up with tighter legislations, the Cyber Crime Cells in Indian cities are the best bet.