The Central Bank of India has alleged a coordinated cyber fraud involving 187 unauthorized transactions amounting to Rs 13.97 crore siphoned via the Structured Financial Messaging System (SFMS) over three days in mid-October, prompting a criminal investigation by Mumbai police.
- 187 unauthorized RTGS transfers totaling Rs 13.97 crore executed via SFMS
- Intrusion exploited the interface between Central Bank of India and IFTAS central SFMS server
- IFTAS and Central Bank assert core banking and messaging systems remain secure
What happened
The Central Bank of India detected 187 unauthorized fund transfers totaling Rs 13.97 crore from its RBI-settlement account between October 15 and 17, 2026. These transactions bypassed normal customer account debit procedures and appeared only in the SFMS messaging logs without corresponding records in the bank’s branches, internet banking, or core systems. The fraud spanned three days with payments routed to 36 distinct accounts that do not belong to the bank.
Investigation revealed that unknown attackers accessed the central SFMS server operated by Indian Financial Technology and Allied Services (IFTAS), a subsidiary of the RBI, by exploiting a vulnerability in the bank’s own SFMS server interface. This allowed fraudulent routing of payments via the Real Time Gross Settlement (RTGS) network, prompting the Mumbai cyber police to file charges of cheating and personation against unidentified suspects.
Why it matters
This incident exposes critical risks in India’s interbank financial messaging infrastructure, underscoring the challenge of securing communication channels used to settle billions in daily transactions. While the core banking system and customer accounts were reportedly unaffected, attackers’ ability to manipulate SFMS servers suggests potential gaps in how financial messages are authenticated and monitored.
The breach raises concerns over the operational security of IFTAS, which manages the central SFMS platform relied upon by all Indian banks and the RBI. Given that SFMS uses Public Key Infrastructure and digital signatures to secure transactions, the allegations touch on fundamental issues around access controls, system interface integrity, and audit traceability in a vital financial backbone.
What to watch next
Authorities and the Central Bank of India will continue forensic investigations to precisely identify how the attackers breached the SFMS interface and routed the unauthorized transfers. The case highlights an urgent need to review and possibly strengthen cybersecurity measures surrounding SFMS, including endpoint authentication, transaction validation, and real-time monitoring mechanisms.
The incident could prompt regulatory scrutiny and industry-wide assessments of financial messaging security practices in India’s banking sector. Stakeholders will be watching closely for follow-up communications from IFTAS, RBI, and affected banks to understand the lessons learned and steps taken to prevent similar frauds within one of the country’s most critical payment infrastructures.