Central Bank of India Restores RTGS Operations and Assures Customer Deposits Are Secure After Rs 13.97 Crore Server Glitch
State-owned Central Bank of India has reassured depositors that their funds and account balances are completely safe after a technical glitch in its interface environment triggered 187 unauthorised transactions amounting to Rs 13.97 crore. The bank confirmed that its Core Banking System (CBS) was not breached and that Real-Time Gross Settlement (RTGS) services have resumed across all channels.
The lender approached the Maharashtra Nodal Cyber Police Station in Mumbai after detecting the anomaly, leading to a First Information Report (FIR) registered against unidentified perpetrators.
How the Technical Disruption Unfolded
According to disclosures and the police complaint filed by the bank's treasury department, the unauthorised fund transfers took place over three consecutive days:
- October 15: Six unauthorised transactions were initiated.
- October 16: A total of 88 fraudulent transfers occurred.
- October 17: Another 93 transactions were detected, bringing the total to 187 transactions amounting to Rs 13.97 crore.
The diversion occurred from the lender’s settlement account maintained directly with the Reserve Bank of India (RBI) and was routed across 36 external bank accounts. Central Bank of India’s internal review revealed that the transactions did not originate from branches, mobile banking, internet banking, or genuine customer requests. In fact, the payer account numbers displayed in the messaging logs did not belong to any customer of the bank.
The complaint highlighted that unauthorised actors appear to have gained entry into the central Structured Financial Messaging System (SFMS) server run by Indian Financial Technology and Allied Services (IFTAS)—a wholly owned subsidiary of the RBI—via the interface linked to the bank's localized RTGS server.
Impact on Customer Deposits and Bank Systems
The public sector lender moved swiftly to isolate the affected systems and engaged leading forensic cybersecurity specialists to conduct a comprehensive root-cause analysis.
In a formal public statement, Central Bank of India stated: "We wish to clarify that there was a technical issue observed in the interface environment of localised RTGS server maintained at Bank's end and no customer account is impacted. Also, our CBS System remains entirely secure and safe."
Because the funds were siphoned from the bank's institutional settlement account with the central bank rather than individual customer accounts, retail and institutional deposits were never debited or compromised.
What Depositors and Investors Should Note
Safety of retail balances: Depositors do not face any deduction or loss of capital from this event. The RBI's regulatory framework explicitly protects account holders against losses arising from third-party system vulnerabilities or technical failures where the customer is not at fault.
Full service restoration: Following temporary precautionary suspensions, RTGS channels have been brought back online and are operating as normal across branches and digital banking portals.
Operational vigilance: While customer balances remain untouched, the incident has highlighted emerging cybersecurity vulnerabilities in inter-bank payment gateways and API endpoints. CERT-In and CSIRT-Fin had previously issued warnings urging financial institutions to strengthen API protections, access protocols, and payment interface perimeters.
Central Bank of India noted that law enforcement agencies and cyber experts are currently tracking the flow of the siphoned capital to recover the remaining proceeds.
