INDUSTRY FACT FILE · ASSET MANAGEMENT

Five New Case Studies in Asset Management Security

Original 2026 case studies, each written as a blog post, showing how current threats play out for asset and investment managers under SEBI's CSCRF and how Codec Networks services break the attack chain.

In this document 1.  About these case studies 2.  Case Study 1: The Redemption That Went to the Wrong Account 3.  Case Study 2: The Dealer Who Traded Ahead 4.  Case Study 3: The NAV Feed That Lied 5.  Case Study 4: The Distributor App That Leaked Folios 6.  Case Study 5: The Deepfake Fund Manager

These five case studies were written for this document set and have not been published elsewhere. Each is a composite scenario combining attack techniques and control failures widely observed in asset management with the obligations that apply in India as of October 2026—in particular SEBI's CSCRF, the mutual fund system audit framework, SEBI's cloud framework, CERT-In's Directions and the DPDP framework.

Important disclosure The organisations described are fictional and the scenarios are illustrative. They are not accounts of real incidents, and they are not Codec Networks client engagements or claims of achieved outcomes. Their value lies in showing how connected weaknesses form an attack chain, which controls break it, and which services test those controls.

Case study	Manager type	Core threat	Regulatory lens	Primary bundles
1. The Redemption That Went to the Wrong Account	Mid-sized AMC and its RTA	Bank-mandate change and redemption fraud	SEBI CSCRF; CERT-In	B2, B7, B6
2. The Dealer Who Traded Ahead	Large AMC	Order leakage and front-running	SEBI regulations; CSCRF	B7, B6, B8
3. The NAV Feed That Lied	AMC and fund accounting provider	Pricing feed compromise	MF system audit; CSCRF third-party risk	B9, B2, B4
4. The Distributor App That Leaked Folios	Wealth platform and AMC partners	Partner API exposing folio data	CSCRF third-party risk; DPDP; CERT-In	B2, B9, B6
5. The Deepfake Fund Manager	AMC	Deepfake impersonation and investment scam	CERT-In; brand protection	B7, B10, B11

Every step looked legitimate to the system—because the fraudster controlled the investor's phone and email.

At a glance
Organisation	A mid-sized AMC (“AMC A”) whose transactions are processed by an RTA
Threat	SIM swap, email compromise and bank-mandate change followed by redemption
Why it is new	Redemption fraud exploits shared AMC–RTA processes; CSCRF requires monitoring and 6-hour reporting
Codec Networks services	Transaction-flow testing, SOC fraud use cases, data protection review (Bundles B2, B7, B6)

The scenario

A fraudster bought an investor's personal details from a leaked database and arranged a SIM swap.

With control of OTPs and the investor's email, the fraudster changed the registered bank mandate through the online portal.

A large redemption was paid to the fraudster's account. The investor noticed days later.

Figure 8: Illustrative attack path for Case Study 1 and the controls that break it.

What went wrong

• No cooling period after the bank-mandate change.
• Alerts went only to the compromised channels.
• High-value redemptions were not step-up verified.
• AMC and RTA monitoring were not joined up.

The impact

AMC A compensated the investor, faced complaints and regulatory attention, and had to redesign its change and redemption controls with its RTA.

The regulatory lens

• SEBI CSCRF: monitoring and incident handling, with cyber incidents reported to SEBI within six hours.
• CERT-In Directions: identity-theft and fraud incidents reported within six hours.
• DPDP Act and Rules: safeguards for investor data once provisions commence.

How Codec Networks would help

Need	Codec Networks response	Bundle
Fix the flow	Bank-change and redemption flow testing	B2
Spot the fraud	SOC use cases combining SIM-change, device and transaction signals	B7
Reduce leaked data	Investor data protection review	B6

Key lessons Add a cooling period after bank or contact changes. Alert the old channels, not just the new ones. Step up verification on large redemptions. Join AMC and RTA fraud monitoring.

The leak was not a sophisticated hack—just a phone, a messaging app and an associate's trading account.

At a glance
Organisation	A large AMC (“AMC B”) with an in-house dealing desk
Threat	Leakage of pending order information enabling front-running
Why it is new	Front-running cases attract SEBI action; dealing-room controls are a core part of insider risk management
Codec Networks services	Dealing-room controls review, DLP, surveillance analytics, forensics (Bundles B7, B6, B8)

The scenario

A dealer with access to large pending orders shared details through a personal messaging app.

Associates placed trades ahead of the fund's orders and profited from the price movement.

Surveillance analysis eventually flagged suspicious patterns, prompting an investigation.

Figure 9: Illustrative attack path for Case Study 2 and the controls that break it.

What went wrong

• Personal devices were allowed on the dealing floor.
• No DLP on dealing and research systems.
• Employee and associate trades were not correlated with fund orders.
• Access to order information was too broad.

The impact

AMC B faced a regulatory investigation, reputational damage and the cost of tightening dealing-room controls.

The regulatory lens

• SEBI regulations: prohibitions on front-running and insider trading, with expectations for controls over price-sensitive information.
• SEBI CSCRF: access control, monitoring and data security controls.

How Codec Networks would help

Need	Codec Networks response	Bundle
Lock down the desk	Dealing-room controls review (devices, recorded lines, access)	B7
Stop data leaving	DLP review for dealing and research systems	B6
Investigate	Forensic investigation and surveillance analytics	B8

Key lessons Keep personal devices off the dealing floor. Deploy DLP where orders and research live. Correlate employee trades with fund orders. Limit who can see pending orders.

The NAV calculation was perfect. The prices going into it were not.

At a glance
Organisation	An AMC (“AMC C”) using an outsourced fund accounting provider and third-party pricing feeds
Threat	Stolen vendor API credentials used to alter prices for illiquid securities
Why it is new	NAV integrity depends on vendors; system audits and CSCRF third-party controls must cover pricing data
Codec Networks services	Vendor assessment, API integrity review, system audit (Bundles B9, B2, B4)

The scenario

An attacker stole API credentials belonging to a pricing data vendor.

Prices for a set of illiquid bonds were altered in the feed consumed by AMC C's fund accountant.

The scheme's NAV was misstated for several days before tolerance checks were tightened and the error detected.

Figure 10: Illustrative attack path for Case Study 3 and the controls that break it.

What went wrong

• Feeds were not authenticated or signed.
• Tolerance checks were too wide for illiquid securities.
• The vendor's security had not been assessed.
• Unusual price movements did not trigger alerts.

The impact

AMC C had to correct the NAV, compensate affected investors, report to trustees and address audit findings.

The regulatory lens

• SEBI mutual fund system audit framework: coverage of NAV systems, interfaces and controls.
• SEBI CSCRF: third-party risk management and data integrity controls.
• CERT-In Directions: reporting of specified incidents within six hours.

How Codec Networks would help

Need	Codec Networks response	Bundle
Assure the vendor	Pricing and fund accounting vendor assessment	B9
Protect the feed	API authentication and integrity review	B2
Audit the controls	System audit of NAV processes and tolerances	B4

Key lessons Authenticate and validate every pricing feed. Tighten tolerances for illiquid securities. Assess pricing and accounting vendors. Alert on unusual price movements.

The AMCs' systems were secure. A partner's API handed out their investors' folios anyway.

At a glance
Organisation	A wealth platform (“Platform D”) distributing several AMCs' schemes
Threat	Broken object-level authorisation in a partner API returning folio details
Why it is new	Platform distribution concentrates investor data across many AMCs; DPDP breach duties will follow
Codec Networks services	API security testing, partner assessment, privacy review (Bundles B2, B9, B6)

The scenario

Platform D's API returned folio, holdings and contact details for any investor ID submitted by an authenticated user.

An attacker enumerated IDs and scraped data on many investors across multiple AMCs.

Investors began receiving targeted scam calls referencing their actual holdings.

Figure 11: Illustrative attack path for Case Study 4 and the controls that break it.

What went wrong

• No object-level authorisation on the folio API.
• Responses included more data than needed.
• No rate limiting or anomaly alerts.
• AMC partners had not assessed the platform's security.

The impact

Platform D and its AMC partners faced data-breach response, investor harm and partnership disputes.

The regulatory lens

• SEBI CSCRF: third-party risk management and application security for regulated entities and their partners.
• CERT-In Directions: data leaks reported within six hours.
• DPDP Act and Rules: safeguards and breach intimation once provisions commence.

How Codec Networks would help

Need	Codec Networks response	Bundle
Test the API	Object-level authorisation and data-exposure testing	B2
Assess partners	Distributor and platform security assessment	B9
Minimise data	Data minimisation and privacy review	B6

Key lessons Check ownership on every API request. Return only the fields a partner needs. Rate-limit and alert on enumeration. Assess every distribution partner.

The video looked and sounded exactly like the fund's star manager. It was entirely fake.

At a glance
Organisation	A well-known AMC (“AMC E”) with a prominent chief investment officer
Threat	AI-generated video impersonating a fund manager to promote a fraudulent scheme
Why it is new	Deepfake investment scams are spreading rapidly on social media
Codec Networks services	Brand and social-media monitoring, takedown, deepfake awareness (Bundles B7, B10, B11)

The scenario

Scammers produced a deepfake video of AMC E's chief investment officer recommending a 'guaranteed returns' scheme.

The video was promoted on social media and linked to a messaging group where 'advisers' collected money.

Victims complained publicly, naming AMC E.

Figure 12: Illustrative attack path for Case Study 5 and the controls that break it.

What went wrong

• No social-media monitoring for impersonation.
• No rapid takedown process with platforms.
• Investors were unsure which channels were official.
• No prepared response for impersonation incidents.

The impact

AMC E suffered brand damage and had to run investor-awareness campaigns while victims lost money to scammers.

The regulatory lens

• CERT-In Directions: reporting of specified incidents including impersonation and fake profiles.
• SEBI and AMFI investor-awareness expectations for official communication channels.

How Codec Networks would help

Need	Codec Networks response	Bundle
Find fakes fast	Brand and social-media monitoring	B7
Take them down	Takedown support and evidence packs	B7
Prepare people	Deepfake awareness and simulation	B10, B11

Key lessons Monitor for your people's faces and voices, not just your logo. Build takedown relationships before you need them. Publish and repeat official channels. Prepare an impersonation response plan.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com