Central Bank of India Files FIR After Hackers Siphon Rs 13.97 Crore via Financial Messaging System
State-run Central Bank of India has approached law enforcement after discovering that hackers siphoned off ₹13.97 crore from its settlement account with the Reserve Bank of India (RBI). The fraudulent withdrawals occurred through 187 unauthorised transactions carried out between October 15 and October 17.
Following a formal complaint lodged by the bank’s general manager in charge of treasury operations, Maharashtra’s Nodal Cyber Police Station in Mumbai registered a First Information Report (FIR) against unidentified individuals on charges of cheating and impersonation.
Modus Operandi and Messaging System Breach
According to the bank's complaint, the perpetrators gained unauthorized access to the central Structured Financial Messaging System (SFMS) server operated by Indian Financial Technology and Allied Services (IFTAS), a wholly owned subsidiary of the RBI. SFMS serves as the critical messaging backbone for interbank fund transfers across India, powering high-value systems such as Real Time Gross Settlement (RTGS) and National Electronic Funds Transfer (NEFT).
The unauthorised transfers were systematically executed over three consecutive days:
- October 15: 6 fraudulent transactions
- October 16: 88 fraudulent transactions
- October 17: 93 fraudulent transactions
The siphoned funds were disbursed across accounts held at 36 different commercial banks.
Phantom Entries and Operational Discrepancies
Investigators and internal bank teams discovered that the transactions completely bypassed standard retail verification protocols. Under ordinary circumstances, an outward RTGS payment requires a customer debit entry in the Core Banking System (CBS), which then transmits instructions to the bank's RTGS settlement account and onwards through the SFMS server to the central RBI settlement account.
However, the bank’s internal forensic audit revealed several alarming anomalies:
- The 187 transactions left no operational footprint in physical branches, internet banking, or mobile banking platforms.
- No corresponding transaction records or standard transaction IDs were generated within the bank’s CBS or RTGS settlement account.
- While partial log traces referencing 10 accounts were identified in SFMS database logs, the payer account details listed on the outgoing payment messages did not belong to Central Bank of India customers.
Regulatory Response and Investor Takeaways
Upon discovering the discrepancy during account reconciliation, the lender notified key regulatory and cybersecurity watchdogs, including the Reserve Bank of India, IFTAS, the Daksh supervisory portal, the Indian Computer Emergency Response Team (CERT-In), and the National Critical Information Infrastructure Protection Centre (NCIIPC).
In a regulatory clarification to stock exchanges, Central Bank of India stated that a technical issue had been identified in the interface environment of its localized RTGS server. The bank emphasized that the affected interface was promptly isolated, outbound RTGS services were fully restored, and its Core Banking System remains safe and uncompromised. It further reiterated that no individual retail or corporate customer accounts suffered any direct financial losses.
For market participants and banking sector investors, the incident highlights persistent systemic vulnerabilities in interbank payment interfaces. While the financial loss of ₹13.97 crore is absorbable relative to Central Bank of India's balance sheet, forensic outcomes from the probe will likely prompt the central bank to tighten cybersecurity auditing mandates and digital infrastructure safeguards across public and private sector lenders.
