Fraud Prevention & Cybersecurity Policy

Welcome to Fin 100X.AI — India’s First Protocol-Governed AI Financial Operating System. By using our app or platform, you agree to the following terms:

  1. Introduction Fin 100X.AI (“we,” “our,” “us”) is India’s first protocol-governed AI Financial Operating System, designed to empower Youth, Gen Z, Gen Alpha, and first-time earners with financial dignity, security, and freedom. With the rise of digital financial services, fraudsters are increasingly exploiting vulnerabilities through phishing, identity theft, cyberattacks, and social engineering. Given our role as an AI-first financial OS, protecting users from fraud and ensuring cyber resilience is a non-negotiable duty. This Fraud Prevention & Cybersecurity Policy (“Policy”) sets forth: Our fraud risk management framework. Mandatory cybersecurity standards across systems and networks. Responsibilities for fraud detection, prevention, and response. User protections, reporting mechanisms, and grievance redressal. Compliance with CERT-IN, RBI, SEBI, IRDAI, PFRDA, DPDP Act 2023.
  2. Scope This Policy applies to: All users of Fin 100X.AI (mobile app, website, WhatsApp, SDKs). All financial modules (Fin AI, Fin Advisor, Fin Literacy, Fin Score, Credit, SIP, Insurance, Retirement, Tax, Fraud Shield). All employees, contractors, advisors, vendors, and partners with access to data/systems. All data, transactions, systems, APIs, and AI models used within the platform.
  3. Regulatory Framework CERT-IN Cybersecurity Directions, 2022 – 6-hour breach reporting. RBI Cyber Security Framework, 2016 – For banks & NBFCs. RBI Ombudsman Scheme, 2021 – Fraud complaint handling. SEBI Cyber Resilience Framework, 2023 – Stock brokers, AMCs, MFs. IRDAI Information & Cybersecurity Guidelines, 2017. PFRDA IT & Cybersecurity Circulars, 2021. DPDP Act, 2023 – Data fiduciary obligations. IT Act, 2000 & Rules. Global Standards – ISO 27001, NIST, PCI DSS, OWASP Top 10.
  4. Objectives To prevent, detect, and respond to financial fraud and cyber incidents. To build cyber resilience across Fin 100X.AI systems and partners. To ensure compliance with CERT-IN, RBI, SEBI, IRDAI, PFRDA, DPDP. To educate and empower users with fraud awareness. To leverage AI-powered Fraud Shield for real-time anomaly detection.
  5. Fraud Prevention Framework 5.1 Types of Fraud Covered Phishing & Vishing – Fake emails, calls impersonating Fin 100X.AI. Identity Theft – Unauthorized use of Aadhaar, PAN, or credentials. Transaction Fraud – Unauthorized transfers, payment fraud. Insider Fraud – Collusion or misconduct by employees/partners. Synthetic Identity Fraud – Fake accounts created with partial KYC. Investment & Insurance Mis-selling – False promises by agents or fraudsters.

5.2 Preventive Measures Strong KYC – CKYC, DigiLocker, Video KYC. Multi-Factor Authentication (MFA) – OTP + biometrics. Transaction Limits & Alerts – Real-time push alerts. AI Fraud Shield – Behavioral anomaly detection. Blacklist Database – Integration with RBI, SEBI, IRDAI fraud registries.

5.3 Fraud Investigation Dedicated Fraud Risk Management Unit (FRMU). Escalation to Fraud Shield Task Force. Mandatory reporting to FIU-IND for money laundering suspicions.

  1. Cybersecurity Framework 6.1 Core Security Principles Zero Trust Architecture (ZTA) – “Never trust, always verify.” Defense-in-Depth – Multiple security layers. Least Privilege Access – Role-based controls. Continuous Monitoring – SIEM, SOC integration.

6.2 Network Security Firewalls, IDS/IPS systems. End-to-end VPN for remote access. Secure API gateway for partner integrations.

6.3 Data Security Encryption at Rest – AES-256. Encryption in Transit – TLS 1.3. Tokenization – Sensitive data replaced with tokens. Data Masking – Testing & analytics.

6.4 Application Security Secure coding aligned with OWASP Top 10. Quarterly VAPT (Vulnerability Assessment & Penetration Testing). Bug Bounty Program – Ethical hackers rewarded.

6.5 AI Security Adversarial Testing for AI models. Bias & Manipulation Checks for Fraud Shield algorithms. Explainable AI (XAI) reports for regulators.

  1. Incident Response & Reporting 7.1 Incident Lifecycle
  2. Detection – AI Fraud Shield or user complaint.
  3. Containment – Immediate isolation of system/account.
  4. Reporting – CERT-IN within 6 hours.
  5. Investigation – Incident Response Team (IRT).
  6. Recovery – Restore systems, compensate if applicable.
  7. Audit & Learning – Root cause analysis.

7.2 Regulatory Reporting CERT-IN – Cyber incidents within 6 hours. RBI Ombudsman – Fraud complaints. SEBI SCORES – Investment-related fraud. IRDAI IGMS – Insurance fraud. PFRDA CGMS – Retirement-related fraud.

  1. User Protection 24x7 Fraud Helpline – Users can report fraud. Fraud Awareness Campaigns – App banners, Fin Literacy Hub. Refund & Redressal – In line with RBI’s zero liability policy (circular DBR.No.Leg.BC.78/09.07.005/2017-18). Grievance Officer – Dedicated fraud complaints officer.
  2. Roles & Responsibilities Board of Directors – Oversight of cyber & fraud risk. Chief Information Security Officer (CISO) – Cybersecurity leadership. Fraud Risk Officer (FRO) – Head of fraud prevention. Employees & Advisors – Report suspicious activity immediately. Vendors/Partners – Bound by cybersecurity & fraud clauses in contracts.
  3. Record-Keeping Fraud incident logs retained for 10 years (PMLA & RBI norms). Cyber incident reports retained for 5 years. Immutable, tamper-proof audit trails maintained.
  4. Training & Awareness Annual Cyber Hygiene Training for employees. Mandatory Anti-Fraud & AML training for advisors. Specialized AI security training for engineers. Quarterly fraud simulations (“red team” exercises).
  5. Enforcement Employees/vendors engaging in fraud → termination + prosecution. Users misusing platform → account freeze + regulator reporting. Non-compliance with CERT-IN/RBI/SEBI → regulatory penalties.
  6. Policy Review Reviewed annually or upon regulatory changes. Approved by Board & Risk Management Committee. Updated in alignment with IndiaAI National AI Safety Mission.

Annexures Annexure A – Fraud Red-Flag Indicators Unusual login patterns. Sudden high-value transactions. Multiple accounts linked to same PAN/mobile. Insurance claims filed soon after policy issuance. Investments withdrawn unusually early.

Annexure B – CERT-IN Incident Reporting Format

  1. Nature of Incident
  2. Date/Time of Detection
  3. Affected Systems
  4. Root Cause
  5. Mitigation Steps
  6. Contact of Reporting Officer

Annexure C – Cyber Hygiene Checklist (for Users) Enable 2FA/MFA. Change passwords every 90 days. Verify Fin 100X.AI communication sources. Do not share OTPs or PINs. Do not click on unknown links.

Annexure D – Fraud Response Escalation Chart Stage Authority Timeline Action 1 App/User Report Immediate Alert triggered2 Fraud Shield <1 hour Block suspicious transaction3 Incident Response Team 6 hours Report to CERT-IN4 CRO & Board 24 hours Review & disclose5 Regulator/Ombudsman As mandated Final reporting

11 Fraud Prevention & Cybersecurity Policy(CERT-IN, RBI, SEBI, IRDAI, PFRDA, IT Act, DPDP Act aligned) This policy is essential because it: Establishes fraud prevention protocols (phishing, identity theft, transaction fraud). Defines cybersecurity standards (CERT-IN 6-hour breach reporting, SOC, SIEM, encryption). Sets up Fraud Shield as a core AI-powered defense module. Mandates incident response, escalation, and regulatory reporting. Protects users against scams, impersonation, fake advisory, and insider collusion. Includes Annexures: Fraud red-flag matrix, CERT-IN incident template, cyber hygiene checklist.