Skip to main content
Definition · 6 min read

What Are the Red Flags in a Bank Statement? A Plain-Language List for New Credit Analysts

A red flag is a pattern that does not fit a genuine salary or business profile. This list explains each one in plain words, gives a possible innocent reason, and says what to do next.

Terra Insight
Terra Insight Editorial Team Reconciliation Infrastructure

Content authored by practitioners with experience at Amazon India, Intuit QuickBooks, and the Tata Group. Meet the team →

Published 14 October 2026
Domain expertise
TDS Reconciliation GST Input Credit Platform Settlements NACH Batch Matching Bank Reconciliation Form 26AS Matching ERP Integrations Enterprise Finance Ops
Knowledge Card
Problem

New credit analysts see a bank statement and cannot tell which patterns are normal and which deserve a second look.

How It's Resolved

Sort each unusual pattern into document fraud or credit stress, note a possible innocent reason, then decide whether to ask for proof, refer or reject.

Configuration

Twelve months of statements, a list of known flags, the applicant's stated income or turnover, and the lender's own credit policy.

Output

A short note per flag with the evidence requested and the action taken, filed with the credit memo.

A red flag in a bank statement is a pattern that does not fit a genuine salary or business profile. The common ones are signs of an edited document, balance spikes just before the application, circular credits, repeated bounces, unexplained cash and heavy loan-app activity. A flag is a reason to ask a question, not a verdict.

Which red flags point to document fraud and which to credit stress?

It helps to sort flags into two groups. Document fraud flags question whether the statement is real. Credit stress flags are real entries that suggest the borrower may struggle to repay.

FlagHow it appearsPossible innocent reasonAction
Running balance does not add upPrevious balance plus credit minus debit gives a different figureRare in a genuine bank PDFRefer for forensic review
Fonts or alignment differOne row looks bolder or shiftedPoor scan of a printed copyAsk for a fresh net-banking download
Transaction on a bank holidayA cheque clearing dated on a national holidaySome digital payments do post on holidaysCheck the payment mode
Balance spike before applyingLarge credit in the last week, gone soon afterGenuine sale of an assetAsk for the sale deed or invoice
Circular creditsMoney goes out and comes back from the same partyRefund or returned advanceAsk for the contract or credit note
Repeated bouncesSeveral inward returns of EMI or chequesOne-off technical failureCount bounces across 12 months
Large unexplained cashCash deposits far above the usual daily levelCash-heavy trade such as a kiranaAsk for daily sales records
Many loan-app credits and debitsSmall credits from lending apps and frequent repaymentsShort-term working capitalList all obligations and recompute repayment capacity

When is one flag enough to escalate, and when do you ask for proof first?

Escalate at once when the document itself looks altered. If the arithmetic is broken on even one row, every other number in the file is in doubt, so the file goes to whoever handles fraud review under your lender’s policy.

For credit stress flags, ask for proof first. A trader who sold a vehicle can show the sale letter. A shop with heavy cash can show a sales register and GST returns. Escalate when the answer does not match the evidence, or when two or three flags appear together, for example a spike plus circular credits plus near-zero balances the rest of the year.

Worked example: a spike at the year end

An applicant’s statement shows month-end balances under ₹25,000 for eleven months. Then:

  1. On 28 March, ₹3,50,000 is credited by NEFT from an individual.
  2. On 31 March, the closing balance is ₹3,71,000.
  3. On 3 April, ₹3,45,000 is debited to the same individual.
  4. The April month-end balance falls back to ₹22,400.

If you looked only at the 31 March balance, the account seems to hold about 15 times its normal level. Averaged across the year, the ₹3,50,000 stayed for only 6 days, so it adds roughly ₹3,50,000 × 6 ÷ 365 = ₹5,753 to the average daily balance. The money arrived and left within a week and went back to the same person. That is a classic balance spike. Ask what the credit was. If the applicant cannot show a genuine reason, exclude it from income and balance calculations.

What else should a new analyst keep in mind?

  • Read the whole period, not just the last three months.
  • Compare the statement with the stated income or turnover. A ₹60,000 monthly salary should show about ₹60,000 credited each month, less deductions.
  • Look at the days just after the statement date as well as before it.
  • Write down what you asked for and what you received. A clear note protects the applicant and the lender.

Each flag has its own guide. Start with how to check if a bank statement is fake without software, then read PDF tampering detection for bank statements and counterparty spread analysis for loops and unusual party patterns.

When volumes grow, a bank statement analyzer runs these checks on every file. TransactIQ, delivered as a managed service on Terra Insight’s AWS Mumbai infrastructure, produces 40+ engineered credit signals, including fraud and anomaly signals that are rule-traceable so your credit team can explain each one.

Primary reference: Reserve Bank of India Master Directions — which set the fraud risk management and know-your-customer expectations for regulated lenders.

Frequently Asked Questions

What is a red flag in a bank statement?
It is any pattern that does not fit the genuine salary or business profile the applicant has described, such as a balance spike just before applying, repeated bounces or a file that looks edited.
Does one red flag mean the applicant is a fraud?
No. Many flags have innocent reasons. A single flag usually means you ask for proof. Signs of an edited document are different and are normally referred straight away.
Which red flags are most serious?
Signs that the document itself has been changed, such as a running balance that does not add up, are the most serious because they question every other number in the file.
How many months of statements should I review?
Many lenders ask for six to twelve months, but each lender sets its own policy. A longer period makes one-off spikes easier to see.
Should I tell the applicant which flag I found?
Follow your lender's process. Usually you ask a neutral question and request a document, such as a sale deed or invoice, without accusing anyone.

See how TransactIG handles reconciliation for your industry

Configuration takes 2–4 weeks. No code development required. ISO 27001:2022 certified.