MUMBAI — Indian cyber police are investigating how nearly Rs. 14 crore was allegedly moved from Central Bank of India’s RBI settlement account, while the lender maintains that customer accounts and its core banking system remain secure.
Central Bank of India has reported 187 unauthorised fund transfers totalling approximately INR 13.97 crore from its settlement account maintained with the Reserve Bank of India (RBI), prompting a police investigation into suspected interference with the financial messaging infrastructure used for interbank transactions.
The disputed transfers occurred between October 15 and 17, 2026, with funds routed to 36 bank accounts, according to details contained in the bank’s complaint to Maharashtra’s cyber police.
Investigators are examining allegations that unidentified individuals obtained unauthorised access to the central Structured Financial Messaging System (SFMS) server operated by Indian Financial Technology and Allied Services (IFTAS), a wholly owned subsidiary of the RBI.
A first information report (FIR) has been registered against unidentified suspects following a complaint from Central Bank of India’s treasury management.
The lender subsequently clarified that a technical problem had affected the interface environment of its localised Real Time Gross Settlement (RTGS) server, but maintained that its core banking system remained secure and no customer accounts were affected.
RTGS services have since been restored across all channels.
The police investigation must now establish how the disputed transfers were generated, which systems were accessed and where the money ultimately went.
187 Unauthorised Transactions Over Three Days
The suspected fraud was spread across three consecutive days rather than occurring as a single transfer.
According to the complaint, the transactions were distributed as follows:
- October 15: Six unauthorised transactions were recorded.
- October 16: A further 88 transactions took place.
- October 17: Another 93 transfers were recorded, bringing the total to 187.
Together, the transactions involved approximately INR 13.97 crore.
Some reports give the amount as INR 13.96 crore, a minor discrepancy that has not been reconciled against the complete underlying transaction records.
The original account characterises the initial six transactions as a possible test of security safeguards, followed by an acceleration of the operation.
That interpretation has not been established by investigators.
While the increasing number of transfers may be relevant to reconstructing the incident, the published evidence does not show whether the perpetrators deliberately tested alert systems or what technical sequence they followed.
The transactions were reportedly directed to 36 beneficiary accounts, which investigators must examine to trace the movement of the disputed funds.
Payment Records Missing from the Bank’s Systems
One of the most unusual aspects of the complaint concerns the absence of corresponding transaction records in the bank’s ordinary payment-processing systems.
An internal examination reportedly found no matching entries for the 187 transfers in branch records, internet banking, mobile banking or other conventional customer transaction channels.
The bank also reported that the transactions were not reflected in its core banking records, RTGS settlement records or its own SFMS server in the expected manner.
Furthermore, the accounts identified as originating the disputed payments did not correspond to accounts maintained with Central Bank of India.
These discrepancies prompted concerns that payment messages may have been generated or processed outside the normal authorised transaction workflow.
The records were not entirely devoid of evidence, however.
According to reporting on the police complaint, partial traces associated with 10 accounts were found in SFMS database logs, although the corresponding transaction identification numbers were missing from the bank’s records.
The available findings therefore suggest discrepancies between different systems rather than an operation that has conclusively left no digital evidence.
Further technical examination will be required to identify the origin of the payment instructions and determine how they entered the settlement process.
Suspected Access to IFTAS Financial Messaging Server
The investigation focuses partly on the Structured Financial Messaging System, which supports secure financial communication between banks and India’s central payment infrastructure.
Under the normal process, a payment instruction entered into a commercial bank’s core banking system can generate financial messages transmitted through the bank’s SFMS environment to the central infrastructure operated by IFTAS.
Those messages support settlement through payment systems such as RTGS and NEFT.
In its police complaint, Central Bank of India alleged that unidentified persons gained unauthorised access to IFTAS’s central SFMS server through the messaging infrastructure associated with the bank’s core banking system.
The complaint suggests that unauthorised payment instructions may have been processed through this connection, resulting in debits from the bank’s settlement account with the RBI.
The precise technical mechanism remains unconfirmed.
There is no publicly available independent forensic finding establishing that attackers successfully compromised IFTAS’s central server, defeated its encryption or obtained unrestricted access to the RBI’s wider payment infrastructure.
Nor has the investigation established whether the incident involved an external attacker, misuse of authorised credentials, an internal participant or another form of system failure.
Those possibilities require examination of payment messages, authentication records, access controls, system logs and communications between the institutions involved.
Central Bank of India Says Customer Accounts Remain Safe
Following reports of the suspected fraud, Central Bank of India issued a clarification concerning the security of its systems.
The bank attributed the operational problem to a technical issue in the interface environment of its localised RTGS server.
It maintained that its core banking system, which supports ordinary customer accounts and banking transactions, had not been compromised.
The lender also said that no customer accounts were affected and confirmed the restoration of RTGS services across its channels.
The clarification is particularly important because the institution involved is a commercial bank named Central Bank of India, not the Reserve Bank of India itself.
The disputed funds were transferred through an account maintained by Central Bank of India with the RBI.
That does not establish that the RBI’s own funds were stolen.
The exact financial liability arising from the alleged transfers, including recovery prospects and any eventual loss borne by the bank, its customers or other institutions, has not been conclusively established in the reporting reviewed.
The investigation must reconcile the reported unauthorised settlement transactions with the bank’s assurance that customer accounts remained secure.
RBI and National Cybersecurity Authorities Notified
Central Bank of India informed several financial and cybersecurity authorities following the discovery of the irregularities.
The institutions notified included the Reserve Bank of India, IFTAS, the Daksh regulatory reporting platform, the National Critical Information Infrastructure Protection Centre (NCIIPC) and the Indian Computer Emergency Response Team (CERT-In).
These organisations have different responsibilities concerning banking supervision, payment infrastructure, critical infrastructure protection and cybersecurity incident response.
Mumbai’s Nodal Cyber Police Station registered an FIR against unidentified persons concerning suspected cheating and personation.
Police are examining the transaction trail, the allegedly unauthorised system access and the accounts that received the funds.
The fact that these institutions were informed does not establish that every agency has opened a separate formal investigation.
Their respective roles and any technical findings released subsequently will be important in determining whether the incident exposed weaknesses in one bank’s local systems or in a broader financial messaging environment.
Banking Cybersecurity Under Scrutiny
The reported transfers illustrate the potential risks associated with highly interconnected financial systems.
Modern interbank transactions depend on multiple layers of authentication, message generation, routing, settlement and recordkeeping.
Where different systems maintain inconsistent records, investigators may face considerable difficulty identifying the point at which an unauthorised instruction entered the process.
A successful investigation will therefore need to establish whether the disputed payment messages were genuine, manipulated or generated without proper authority.
It must also determine whether the beneficiary accounts were controlled by the suspected perpetrators and whether any of the money can be recovered.
The incident has prompted questions about monitoring safeguards, transaction reconciliation and the controls designed to identify suspicious activity in financial messaging networks.
Yet those questions cannot be answered simply by assuming that India’s entire banking settlement infrastructure was successfully penetrated.
Central Bank of India’s explanation of a localised RTGS interface problem, the allegations of unauthorised transfers and the absence of matching transaction records must all be examined together.
The decisive findings will come from a technical reconstruction of the payments and the police investigation into the destination accounts.
Until those findings are available, the case remains a serious suspected financial cyber-fraud incident rather than proof of a systemic compromise of India’s central banking infrastructure.
