INDUSTRY FACT FILE · ASSET MANAGEMENT

Threat Landscape: Top Cyber Threats Facing Asset and Investment Managers

The 18 most relevant cyber threats, attacks and industry challenges for mutual funds, AMCs, portfolio managers, AIFs, advisers and wealth platforms in India.

Investment-related fraud is the largest category of cyber-fraud complaints in India; reports based on I4C data indicate around 36% of 2025 complaints related to investment fraud. Asset managers face both direct attacks on their systems and scams that misuse their brands and fund managers' identities.

Because investor data and transactions flow through AMCs, RTAs, distributors, platforms and fund accountants, a weakness at any partner can expose investors.

The list below is a practical assessment framework, not a statistical ranking. Priority varies by business model, technology exposure and existing controls.

The matrix is a qualitative guide for prioritising the first round of security reviews.

Figure 5: Qualitative threat relevance by asset management segment (Codec Networks assessment).

4.1 Redemption and bank-mandate fraud

Fraudsters use leaked personal data and SIM swaps to change contact details and bank mandates, then redeem units. Because AMCs and RTAs share responsibility for these transactions, controls must work across both.

• Questions to test: Are there cooling periods and alerts on old and new channels after contact or bank changes? Are high-value redemptions verified? Are SIM-change signals used?
• Relevant services: redemption and bank-change flow testing, IAM & MFA bypass testing, SOC fraud use cases.

4.2 Front-running and order leakage

Leakage of fund orders or price-sensitive information from dealing desks can lead to front-running, SEBI action and reputational damage.

• Questions to test: Are dealing rooms controlled (recorded lines, device restrictions)? Is DLP deployed on research and dealing systems? Are employee and associate trades surveilled?
• Relevant services: dealing-room controls review, DLP review, insider threat simulation, surveillance analytics.

4.3 Third-party and RTA risk

RTAs, custodians, fund accountants and vendors process investor and fund data for many AMCs. CSCRF expects REs to manage third-party risk, and a single provider breach can affect many funds.

• Questions to test: When were key providers last assessed? Do contracts include security, incident-notification and audit clauses? Are data flows minimised?
• Relevant services: third-party risk management, vendor and RTA assessments, contract security review.

4.4 NAV and pricing integrity

Fund accounting depends on pricing feeds and custodian data. Compromised feeds or credentials can produce incorrect NAVs that investors transact on.

• Questions to test: Are feeds authenticated and validated against tolerances? Are price overrides logged and approved?
• Relevant services: integrity controls review, vendor assessment, system audit.

4.5 Impersonation and deepfake scams

Scammers increasingly use fake apps, social-media groups and deepfake videos of fund managers to lure investors into fraudulent schemes.

• Questions to test: Is the brand monitored across social media and app stores? How quickly can fakes be taken down? Do investors know official channels?
• Relevant services: brand and social-media monitoring, takedown support, investor awareness, deepfake simulation.

• SEBI: cyber incidents reported within six hours under CSCRF, with follow-up reporting and root-cause analysis.
• CERT-In: specified incidents reported within six hours; ICT logs kept for 180 days in India.
• Trustees: significant incidents are reported to trustees and Boards.
• Privacy: once DPDP breach provisions commence in May 2027, personal data breaches must be intimated to the Data Protection Board, with a detailed report within 72 hours.
• Investors: compensation and communication obligations can follow incorrect NAVs or unauthorised redemptions.

• Do we know our CSCRF category and meet its audit, VAPT and SOC obligations?
• Would we stop a redemption after a fraudulent bank-mandate change?
• Could order information leave our dealing desk without detection?
• When were our RTA, custodian and fund accountant last assessed?
• Is our brand being used in fake apps or deepfake videos today?
• Could we report an incident to SEBI and CERT-In within six hours?

Note: Threat descriptions and relevance ratings are general guidance, not findings about any specific entity. I4C figures cover all channels and are as reported in public sources. Confirm obligations against SEBI's current circulars.