The revised guidelines come after a recent breach at Star Health Insurance
The Insurance Regulatory and Development Authority of India (IRDAI) has introduced new guidelines to curb online fraud in the wake of recent hacking incidents targeting insurance companies, such as Star Health Insurance. These proposed Insurance Fraud Monitoring Framework Guidelines, 2024, aim to improve insurers’ defences against cyber threats through stricter anti-fraud policies, dedicated Fraud Monitoring Units (FMUs), and enhanced cybersecurity measures.
“Cyber fraud can have far-reaching consequences, including identity impersonation, financial frauds, reputational damage etc.,” the IRDAI noted in its draft guidelines. The regulator highlighted the growing risk of cybercriminals exploiting vulnerabilities in insurers’ security systems to access sensitive data, including KYC details, financial information, and medical records.
The revised guidelines come after a recent breach at Star Health Insurance. A hacker, operating under the alias “xenZen,” alleged that the company’s chief information security officer sold customer data, later attempting to renegotiate payment to maintain backdoor access. The hacker has since posted the data for sale at $150,000, or in smaller portions at $10,000, threatening to expose sensitive policyholder data.
Under the guidelines, IRDAI has directed insurers to implement board-approved anti-fraud policies that ensure zero tolerance for fraud, outline detection methods, and establish protocols for investigating incidents. Additionally, the formation of independent FMUs will provide focused oversight on fraud detection, investigation, and collaboration with law enforcement agencies. These units will report quarterly to the risk management committee on all fraud cases, allowing senior management to remain informed of fraud-related activities.
To strengthen cybersecurity, insurers are required to establish robust defence frameworks, conduct regular audits, and adopt advanced technology to detect and prevent digital fraud. The regulator is also pushing for insurers to conduct fraud awareness programs for employees, agents, and policyholders, fostering a culture of vigilance to prevent potential fraud risks.
The new framework underscores IRDAI’s commitment to a more secure digital environment within the insurance sector, encouraging companies to proactively address cyber risks as the industry increasingly relies on digital channels.