November 12, 2026 - 5 min read

By Chidambaram, founder of PhishClean

Tamil Nadu's ₹22 Crore Rural Development Fraud: What Is Known, and What Any Office With a Payment Login Should Do

Money meant for rural health centres was moved out through an online fund portal, using the logins of three block development offices. Police have not yet said how those logins were obtained. Here is what has been reported, and what any office that pays through a web portal can do now.

What has been reported

• The amount. ₹22,30,04,879, about ₹22.3 crore, in 46 transactions, according to the FIR as reported by ETV Bharat. Other reports put it at ₹22.1 crore.
• The money. 15th Finance Commission health grant funds for primary healthcare buildings in rural areas, held in an account of the Director of Rural Development and Panchayat Raj at a private bank in Chennai.
• The logins. Block Development Officers have their own usernames and passwords to pay contractors, with one person entering a payment (the maker) and another approving it (the checker). The maker and checker accounts of three block offices were used: Mandapam in Ramanathapuram district, Dharapuram in Tiruppur district and Keezhaiyur in Nagapattinam district. Reports give the split as about ₹14 crore, ₹5 crore and ₹3.1 crore.
• The dates. The FIR says the access took place between 12 and 30 October. Two other reports say the third week of September. The department complained on 3 November, and the Central Crime Branch's cyber crime wing in Chennai registered the case that day.
• Where it went. To accounts of more than a dozen companies and traders, some of which were paid several times. Reports say the accounts are in northern states.

Why the logins matter whatever the cause

A maker and checker system is meant to stop one person moving money alone. It only works if the two logins are held by two people and neither can be copied. In this case the maker and checker logins of three offices were used for 46 transfers, over days or weeks, and nobody noticed until the money was gone.

That pattern has only a few explanations. Someone had both passwords and could get past the OTP, or the portal let them in without those, or someone inside did it. The investigation will say which. The first of these is the one an office can do something about today, and it is a common way payment logins are lost: a message or a call that sends an officer to a page that looks like the portal, and asks for the username, the password and then the OTP.

The address problem

The FIR, as reported, names the web address the fraud went through. It is not on the bank's own domain and not on a government domain. It belongs to a software vendor and is linked to the bank's account management system.

This is normal in government payments, and it is a weakness. Staff are told to "check the address", but the genuine address they use every day is a private company's name that few people could spell from memory. A fake on a similar name would look no stranger than the real one.

What an office can do this week

• Write the portal's exact address down and open it only from a bookmark. Never from a link in an email, SMS or WhatsApp message, and never from a search result.
• Keep maker and checker apart. Two people, two devices, two phone numbers for OTPs. If one person knows both passwords, or both OTPs arrive on one phone, the control does not exist.
• Never read out an OTP or type it anywhere except the portal you opened yourself. The bank and the department do not ask for it by phone.
• Ask the bank for alerts and limits. An SMS and email for every debit, sent to a senior officer who is not the maker or checker; a daily limit; and approval of new payees before the first payment.
• Reconcile daily. 46 transfers went unnoticed for at least four days after the last one. A five-minute check of yesterday's debits each morning would have stopped most of them.
• Change both passwords now if they were ever shared, written in a register, or typed on a shared computer.
• If money has gone, call 1930 at once and report at cybercrime.gov.in. Banks can freeze the receiving accounts if they hear within hours. Our India checklist has the steps in order.

Where PhishClean fits, and where it doesn't

PhishClean is a browser extension. It checks each page a member of staff opens and warns before they type a password into a page that is a reported phishing site, a lookalike of a well-known address, or a login form that sends the password to a different site. An IT team can install it on every staff browser with one key. It runs in the browser, and we never see what staff browse.

It would not have helped if the portal itself was breached or if insiders moved the money. It does not replace the bank's controls above. It would also not recognise a copy of a small vendor's portal by name alone; it relies on the reported list and on how the page behaves. It covers one cause out of three, the one that starts with a fake page.

Sources

• ETV Bharat, 11 November 2026: the FIR's amount, dates, offices and sections.
• DT Next, 11 November 2026: the split by panchayat union and the lines of investigation.
• News Today, 11 November 2026.

Last updated: 12 November 2026