Transfer of MF Units in Statement of Account Format – is it susceptible to cyber fraud?

For years, a prevailing sense of security has comforted the average mutual fund investor. Until now, cybercrimes primarily involved bank accounts, credit cards, or UPI scams, leaving mutual fund investors relatively peaceful in the knowledge that their units were safe.

This confidence stemmed from the structural design of the investment; mutual funds operated under a closed-loop system. This meant that any redemption of funds could only pass through the investor’s registered bank accounts. Even if a bad actor gained access to a mutual fund portfolio, the money could technically only be sent back to the rightful owner’s bank account, creating a formidable barrier against third-party theft.

About the author: Manmohan Sethumadhavan is a freelancer, investor, and personal finance enthusiast “in search of the absolute truth.” You can follow Manu on Twitter @ManuTsr. He is the author of the popular Revised Capital Gains Taxation Rules Ready Reckoner for FY 2025-2026.

However, the landscape of financial security is shifting as regulatory bodies and Registrar and Transfer Agents (RTAs) strive to increase liquidity and ease of operations for investors. SEBI has allowed, and RTAs like CAMS and KFin have effectively implemented, the transfer of mutual fund units in Statement of Account (SoA) format across various scenarios. 

• Transfer of Mutual Fund Units in Non-Demat (SoA) Mode
• FAQs on Transfer of Units in SOA Mode

1. a) Surviving joint unitholder, who wants to add new joint holder(s) in the folio upon the demise of a unitholder.
2. b) A nominee of a deceased unitholder, who wants to transfer the units to the legal heirs of the deceased unitholder, post the transmission of units in the name of the nominee.
3. c) A minor unitholder who has turned a major and has changed his/her status from minor to major, wants to add the name of the parent / guardian, sibling, spouse etc. in the folio as joint holder(s).
4. d) Transfer to siblings.
5. e) Gifting of units.
6. f) Transfer of units to a third party.
7. g) Addition / Deletion of unit holder(s), i.e. Joint Holder(s).

While intended to reduce bureaucratic friction, this change effectively opens the closed loop, introducing new vectors for potential exploitation that were previously non-existent in the mutual fund ecosystem.

The security side of these options is worth discussing in detail because the ability to transfer units to a third party or add new joint holders fundamentally alters the risk profile of the asset class. In the past, a hacker had to compromise both the investment account and the linked bank account to steal funds. With these transfer facilities, a fraudster who gains access to the mutual fund folio does not necessarily need to redeem the money to the victim’s bank account. Instead, they could potentially transfer the units to a “mule” account or a third party under the guise of gifting or sibling transfer, effectively bypassing the safety net of the registered bank account.

There can be cases where one can misuse or manipulate or do fraud with minors’ accounts, senior citizens’ accounts, or people without much knowledge about technology, if they get hold access to their OTP. The reliance on OTP-based authentication, while standard, creates a single point of failure. A fraudster engaging in social engineering could convince a senior citizen to share an OTP, claiming it is for a KYC update or a bank linkage confirmation, while in reality, they are authorising the addition of a rogue joint holder or a complete transfer of units to a third party. Similarly, in families where financial boundaries are blurred, guardians of minors or relatives assisting the tech-illiterate could manipulate these transfer provisions to misappropriate funds without the primary holder ever realising the units have been moved until it is too late.

To mitigate these risks, the system does employ certain safeguards. Currently, there is a cooling time period of 10 days before a redemption from the transferee folio is permitted. This means that if units are fraudulently transferred to a new account, the thief cannot liquidate them immediately.

This window is designed to give the original owner time to notice the unauthorized transaction and raise a dispute. However, this safeguard relies entirely on the vigilance of the investor. Unmonitored folios can face a threat in the future because many long-term investors do not check their statements or transaction alerts daily or even weekly.

If an investor misses the email or SMS notification regarding the transfer, the 10-day window closes, the units become liquid in the hands of the fraudster, and the closed loop that once protected the investor is permanently shattered.