Lakshmi Nehru, Senior Compliance Manager, Investigations, Viatris, in an exclusive conversation with ET LegalWorld, addresses new fraud patterns, indicators that organisations are relying on today to spot fraud, and approaches to internal investigations.
1. What new fraud patterns—digital, third-party, or internal—are the contemporary challenges for compliance leaders?
Lakshmi Nehru: The threat landscape has shifted from isolated frauds to coordinated, tech-enabled schemes such as Digital fraud, Third-party risk, and Internal fraud.
Firstly, Synthetic identities and deepfake approvals are showing up in vendor onboarding and expense approvals. We’re seeing cases where payments are released because the “CFO”on a Teams/WhatsApp call was AI-generated. Faster onboarding + remote workflows make this harder to catch with manual checks.
Secondly, the main issue now is layered “pass-through” agents and distributors. On paper, the entity is clean, but beneficial ownership and money trails lead to PEPs, sanctioned persons, or shell companies. In India, this often plays out in distributor margins, channel incentives, and CSR payments.
And lastly, Collusion between procurement and junior finance staff to split invoices just below approval thresholds. It’s low-tech, but because it exploits process gaps in hybrid/remote setups, it evades traditional controls.
The common theme is that the fraudsters are exploiting gaps where human oversight has thinned due to remote work, rapid digitization, and process automation without corresponding controls.
2. What red flags, data signals, or behavioural indicators are organisations relying on today to spot fraud?
Lakshmi Nehru: We use a mix of data analytics and behavioral cues now. Waiting for a whistleblower is too late.
Firstly, data signals which include invoices consistently just under approval limits, vendors with mailbox addresses/free email domains, duplicate bank details across vendors, and payments to employees’ personal accounts disguised as reimbursements. A simple ERP + T&E data extract in SQL or Python surfaces 70-80% of this in minutes.
Secondly, Network signals where multiple vendors share the same phone number, email domain, IP address, or director. We’ve flagged clusters of 10-15 “unrelated” vendors this way, which led to substantiated cases.
And lastly, behavioral indicators such as staff who never take leave, frequent “emergency” overrides of controls, reluctance to provide documentation, and third parties resisting standard KYC/ABAC checks. In ABAC, watch for business teams bypassing compliance, citing “urgency.”
The key is to use analytics to isolate anomalies first, then validate with interviews and document review. Starting with interviews alone gives you rationalizations, not evidence.
3. How should companies structure internal investigations to balance legal risk, employee rights, regulatory expectations, and business continuity?
Lakshmi Nehru: In India, you need a controlled triage from Day 1. A US-style “collect everything first” approach will backfire due to labor law and DPDP constraints.
First is the legal risk. If there’s any PCA, FCPA, SEBI, or ED angle, involve Legal and external counsel before touching data. This preserves privilege and keeps voluntary disclosure options open. Delaying this usually means losing control of the narrative.
Second is the employee rights. You cannot seize laptops or access emails without following due process under the Shops and Establishments Act and your HR policy. In one case, we waited 48 hours for an HR notice. In that window, we secured server logs and bank trails instead. Ignoring these risks, evidence being inadmissible, and wrongful termination claims.
Third is the regulatory expectations. Regulators like SEBI, MCA, and ED don’t expect perfection. They expect prompt, independent, and well-documented investigations. No leading questions, contemporaneous notes, and a report that can stand alone in a boardroom or hearing.
And lastly is the business continuity. Contain the exposure without shutting the business. Pause suspicious payments, restrict access, switch to an alternate vendor. In a procurement fraud case, we stopped a ₹19 Cr payment and activated a backup supplier in 6 hours. Production continued with zero disruption.
The mistake I see most is applying the same protocol to a ₹50k expense misuse and a ₹50 Cr third-party bribery case. Scale your response to the risk, and make sure your investigator understands both the law and how your business actually operates on the ground.
Lakshmi Nehru is set to join the ET Legal India White-Collar Crime Forum 2026 on the panel titled “Fraud, Forensics & Fallout: How Companies Can Detect, Investigate and Respond to Corporate Fraud in 2026.”
[Please note that the answers reflect her personal views as a speaker and should not be interpreted as the official views or position of her employer or any affiliated organisation.]
