Central Bank of India Files Cyber Fraud FIR After Rs 13.97 Crore Siphoned From RBI Settlement Account

State-owned lender Central Bank of India has reported a sophisticated cyber intrusion after unidentified entities fraudulently siphoned ₹13.97 crore directly from its settlement account with the Reserve Bank of India (RBI).

The incident came to light following a complaint lodged by the lender's General Manager (Treasury) at the Nodal Cyber Police Station in Mumbai. The Mumbai Cyber Police have registered a First Information Report (FIR) against unknown individuals invoking charges of personation, cheating, and violations of cyber laws.

Breach of Core Financial Messaging Channels

According to the bank's complaint, the fraudulent diversion took place across three consecutive days through 187 unauthorized fund transfers routed into 36 destination bank accounts:

• October 15: 6 unauthorized transfers were initiated.
• October 16: 88 unauthorized transfers were executed.
• October 17: 93 unauthorized transfers were processed.

The perpetrators allegedly penetrated the central Structured Financial Messaging System (SFMS) server operated by the Indian Financial Technology and Allied Services (IFTAS), a wholly owned subsidiary of the RBI. SFMS serves as the secure backbone carrying high-value interbank payment messages for the RBI’s Real-Time Gross Settlement (RTGS) and National Electronic Funds Transfer (NEFT) platforms.

The complaint outlines that the unauthorized actors gained access to IFTAS's central SFMS via the SFMS server of Central Bank of India's core banking system (CBS), debiting the bank's statutory settlement pool held at the central bank.

Vanishing Footprints in Internal Records

A major point of concern for forensic investigators and the lender's IT security team is that the payer accounts listed across all 187 transactions do not belong to Central Bank of India.

Furthermore, the bank's internal inspection teams could not trace any of the fraudulent transactions within:

• Physical branch logs or teller systems.
• Internet banking or mobile banking platforms.
• The bank's internal RTGS settlement portal or CBS ledger entries.

While partial log traces for 10 of the recipient accounts were detected in SFMS database logs, the corresponding transaction IDs did not correspond to any valid customer activity within Central Bank of India's records. Investigating officers noted that the absence of standard transaction footprints inside the core banking database indicates a highly specialized breach tailored to interbank settlement layers rather than conventional retail phishing.

Multi-Agency Alert and Investor Implications

Following the discovery of the deficit in its RBI account, Central Bank of India initiated incident response protocols, alerting several nodal agencies:

• The Reserve Bank of India (RBI)
• Indian Financial Technology and Allied Services (IFTAS)
• The RBI's Daksh supervisory portal
• National Critical Information Infrastructure Protection Centre (NCIIPC)
• Indian Computer Emergency Response Team (CERT-In)

For investors in banking equities, particularly across the Nifty PSU Bank basket, the incident underlines persistent operational vulnerabilities in legacy banking infrastructure. While the absolute monetary loss of ₹13.97 crore is immaterial relative to Central Bank of India's total balance sheet, unauthorized intrusions into central settlement and messaging gateways carry systemic risk implications.

Market participants will be monitoring the RBI's supervisory stance closely, as any findings of operational lapse, inadequate IT ring-fencing, or delayed fraud classification could attract regulatory penalties or mandate higher provisioning requirements for technology risk management.

Tags: Central Bank of India Reserve Bank of India IFTAS Cyber Security Public Sector Banks Nifty PSU Bank