Outsourcing exposes firms to fraud

By Zubair Ahmed BBC News, Mumbai

Thousands of call centre jobs have sprouted up in India in recent years

The arrest last week of a man in western India in an alleged call-centre fraud case went unreported. This was despite the high-profile reporting on the case in April when 16 others were arrested.

This suited India's business process outsourcing (BPO) companies, especially Mphasis, whose four employees have been implicated in the case. They are yet to recover from the shock of the alleged fraud of nearly $400,000.

Amid calls for tightening BPO regulations and more effective cyber laws the country's call centres are busy taking adequate security measures. Another one or two such cases and the industry is doomed, they admit.

Police, who are still investigating the case, believe it was well thought through and very organised.

Investigating officer Sanjay Yadav says the latest arrest just highlights how well-planned and widespread the fraud was.

Backlash fears

Police say some of the 17 people currently languishing in jail opened fake accounts, and allegedly transferred large sums from the bank accounts of four American customers of Citibank whose back office work was being done by Mphasis in Pune near Mumbai.

Fake degrees and documents are a major concern of our clients Yogesh Bhura, Quest Research

Mr Yadav says they went on a luxurious holiday to Bangkok and kept transferring more money into their fake accounts from the Thai capital.

The industry, fearing a backlash from clients in the West, has started to get its act together.

One of the security steps the BPO centres are taking is the stringent background screening of new employees.

Yogesh Bhura, whose company, Quest Research, undertakes this task, has more than 250 BPO customers.

He has clients all over Asia, but many of his new customers are Indian.

But Mr Bhura's main challenge remains "educating people of the need to make this critical activity an integral part of their recruitment policy."

He reveals that 10-25% of applicants to call centres provide false and incorrect information.

"Fake degrees and documents are a major concern of our clients," he says.

Screening

But verifying an applicant's criminal background remains the most challenging task for companies such as Mr Bhura's and he admits it: "It's a grey area: there's no central data of criminals, there's no standardised process of data storage in police stations. It's a continuous challenge."

Many believe background screening is not enough. Mr Bhura is quick to add a rider: "It's a risk mitigation and not a risk elimination activity."

Mr Singh says IT infrastructure management is inadequate

But one of his clients, Intellinet Global Services, a joint venture between HDFC and Barclays, says background verification is not the only security tool it's applying.

"We take a lot of precautions," says Manuel D'Souza, the company's HR head.

"We don't allow mobile phones in the office, no e-mail access is provided; pen and papers are not allowed in and all employees are screened when they leave the office."

But experts say call centres are a young industry in India. It still doesn't have a comprehensive security management system in place.

Vinod Singh, boss of Bangalore-based security management company Ilantus, is alarmed by the state of affairs the BPO companies are in.

"Our understanding of most of the BPOs that we have been surveying is that they have put the basic IT systems in place, they have put in a lot of money, but the management of IT infrastructure is not up to the mark," he says.

This is one of the major problems with the $4bn BPO industry, which began to flourish in India just five years ago.

Security hole

According to industry estimates, 80% of BPO companies don't use integrated security management tools. That probably explains why some current and former employees of Mphasis, which has a security certification from an international trade body, allegedly stole huge sums belonging to its clients in the U.S.

Ilantus surveyed seven call centres in Bangalore and to its horror found that the digital IDs of the former employees still existed, which potentially can be misused.

But Mr D'Souza says most companies would immediately delete the IDs of the employees who are leaving them.

Growth brings in its own pressures. Back office business is one of India's sunshine industries, growing at 30% annually. The workforce is young, loyalty is low as the young boys and girls move to greener pastures at the first opportunity.

For most of them it's not a career option, but a good first job out of college. The workforce turnover is as high as 40%. Work from the US and Europe is pouring in thick and fast.

Cyber squad

Industry players admit they know security is the top priority, but they say there is no time to implement all the security measures.

Pune police are providing a safe environment for BPO customers from the West Sanjay Yadav, Cyber Crime Cell

Mr Bhura says background screening is just one of the security measures: "Internal security control has to be the most important component of the overall security system".

Mr Singh of Ilantus too cannot guarantee a foolproof internal security system.

"Our system is not 100%, but it dramatically reduces the risks."

But one can take a lot of satisfaction from the fact that a relatively small city like Pune has a Cyber Crime Cell.

The alleged fraud was committed in Pune-based Mphasis and it was busted by the city's Cyber Crime Cell.

As Mr Yadav of the Cell says: "We have acted swiftly to bust the fraud and recovered most of the money siphoned off. Pune police are providing a safe environment for BPO customers from the West."

Till the time the authorities come up with tighter legislations, the Cyber Crime Cells in Indian cities are the best bet.