A QR-code visitor pass generated for entry into a residential society, WhatsApp messages, call detail records and banking transactions were among the digital evidence cited by the Central Bureau of Investigation (CBI) against former Chandigarh Smart City Limited (CSCL) chief financial officer (CFO) Nalini Malik in its chargesheet in the alleged Rs 116.84-crore CSCL-IDFC First Bank fraud case.
According to the chargesheet, the investigation revealed that Malik was “an authorised signatory and was responsible for management of the financial affairs of CSCL”.
The chargesheet stated that the investigation revealed Malik’s mobile number and email ID were linked with three CSCL bank accounts. Certified SMS alert logs obtained from IDFC First Bank allegedly revealed that alerts relating to debit transactions from these accounts, including transfers of funds to beneficiary entities such as CAPCO Fintech Services and other entities under investigation, “were successfully delivered” on the said mobile number.
The investigation further revealed that although the mobile number was registered in the name of Rajesh Malik, husband of Nalini Malik, it was being used by her and was also linked with her personal bank accounts.
According to the CBI, analysis of call detail records of Malik’s mobile phone and the mobile phone of co-accused Ribhav Rishi revealed 55 voice call interactions between the two between May 31, 2024 and December 8, 2025.
The chargesheet further alleged that banking records revealed that on October 24, 2025, an amount of Rs 2 lakh was credited into Malik’s bank account from Swastik Desh Projects. During the examination, the chargesheet said, Malik admitted receipt of the amount and stated that it had been arranged through accused Rishi towards consultancy or professional services.
The investigation further revealed that amounts of Rs 10 lakh and Rs 1.8 lakh were transferred from the account of Swastik Desh Projects to the account of A K Chadda and Co, a partnership firm in which Malik had been inducted as a partner with effect from April 1, 2025. As per the CBI chargesheet, examination of banking records, revealed that the receipts represented amounts pertaining to Malik and that substantial amounts were subsequently transferred or paid to her through banking channels and cash. The investigation further revealed that the source of these funds was also Swastik Desh Projects.
Story continues below this ad
The chargesheet also stated that investigation revealed extensive interior renovation work valued at approximately Rs 45 lakh at Malik’s residence at Aquila Taj Tower, Sector 104, Mohali. As per the CBI, statements of the interior contractor, WhatsApp communications recovered during investigation and documentary evidence allegedly revealed that the work was executed in consultation with Malik and at the instance of Rishi.
The investigation, however, has not revealed any evidence of payment made by Malik towards the said work, while the contractor stated that the value of the work was about Rs 45 lakh.
According to the chargesheet, the digital trail relating to the alleged cash delivery began on December 6, 2025, when Malik allegedly sent Rahul, who is described as a person engaged in cash delivery work at the instance of Rishi. A WhatsApp message stating “kita time lagega Rahul”, and “Party is waiting” were also sent by Malik indicating urgency of the cash delivery.
The CBI alleged that Malik also shared the QR-based gate access pass through an app (Mygate) of her residential society, Aquila Taj Tower, Sector 104, Mohali. However, the chargesheet stated that the cash delivery could not materialise that day.
Story continues below this ad
The investigation further revealed that on December 8, 2025, Malik again forwarded the QR-based gate access pass of her residential society to Rahul through WhatsApp. Rahul, according to the chargesheet, forwarded the QR code to Amritpal Singh, another alleged carrier working for Rishi.
“The said access details were subsequently used by Amritpal Singh for entry into the society and in delivery of cash amounting to Rs 50 lakh to Nalini Malik at her residence,” the CBI chargesheet said.
The chargesheet stated that MyGate records established that the QR code was used for entry into the society at 4:41 pm on December 8, 2025. Chat analysis allegedly revealed that the QR code shared by Malik had been forwarded by Rahul to Amritpal Singh. The CBI further stated that call detail records of Amritpal and Malik placed both at the same location.
According to the chargesheet, Amritpal stated during investigation that he delivered Rs 50 lakh in cash to Malik at her residence. “As per Amritpal, Nalini counted the cash and accepted,” the chargesheet said.
Story continues below this ad
The CBI has also relied on WhatsApp chats exchanged between Malik and another co-accused Abhay Kumar. According to the chargesheet, Abhay Kumar shared with Malik a PDF containing the statement of a CSCL account which reflected various unauthorised debit transactions.
As per CBI, investigation further revealed that multiple account statements later shared with Malik were forged and manipulated versions of the genuine account statements from which unauthorised transactions had been removed and false interest credit entries incorporated.
The chargesheet stated that Abhay shared with Malik a letter relating to creation of a Rs 50-crore fixed deposit of the Haryana Labour Welfare Board with IDFC First Bank, as well as documents, purportedly showing agreements between CAPCO Fintech Services and CSCL/CREST. According to the CBI, these agreements were false and formed part of the documentation created to conceal and justify the diversion of funds.
The investigation also cited WhatsApp chats in which Malik demanded Rs 1.8 lakh from Abhay and a screenshot for the same, with a message saying, “screen shot bhej dena” on November 23, 2025. The chargesheet alleged that on November 25, Abhay shared screenshots of payments of Rs 10 lakh and Rs 1.8 lakh made into the account of A K Chadda & Co., and that these funds were ultimately transferred to Malik through account transfers and cash.
Story continues below this ad
Summarising its findings against Malik, the CBI stated that the communications establish that she “was in possession of the genuine account statement reflecting the unauthorised transactions as well as the forged/manipulated account statements circulated for concealing such transactions”
The communications, the agency alleged, further establish that she “was not only aware about the fraudulent transactions taking place from CSCL accounts, but also a participant in the forgery of statements for falsification of accounts and concealing the fraud”.
