--- title: "Small NBFCs reportedly lost ₹300 crore in two months; RBI is checking banks' API links" summary: "What CERT-In's 9 October advisory, The Economic Times' unnamed sources and Reuters reported, 9 to 30 October 2026, and what no regulator has confirmed." url: https://www.thetechbag.com/blog/nbfc-api-attacks-300-crore-rbi-checks format: Note desk: "Security" area: "Threats & vulnerabilities" region: India published: 2026-11-01 facts_checked: 2026-11-01 author: TechBag (The TechBag Journal) tags: ["NBFC","API security","disbursement API","payment fraud","CERT-In","CIAD-2026-0046","RBI","DAKSH","ICICI Bank","mule accounts","BFSI"] cover: https://www.thetechbag.com/blog/covers/nbfc-api-attacks-300-crore-rbi-checks.png --- # Small NBFCs reportedly lost ₹300 crore in two months; RBI is checking banks' API links *What CERT-In's 9 October advisory, The Economic Times' unnamed sources and Reuters reported, 9 to 30 October 2026, and what no regulator has confirmed.* Note · Security · Threats & vulnerabilities · By TechBag · Published 2026-11-01 · Facts checked 2026-11-01 · Canonical: https://www.thetechbag.com/blog/nbfc-api-attacks-300-crore-rbi-checks Small non-bank lenders in India have lost about ₹300 crore to cyberattacks in roughly two months, The Economic Times reported on 29 October, citing unnamed “highly placed sources”.[1] No regulator has published a loss figure: neither CERT-In’s advisories nor any RBI notice gives one.[2] What is on the record is CERT-In’s “Critical” advisory of 9 October on attackers abusing payment and disbursement APIs,[3] and, as Reuters reported on 30 October, an RBI push asking banks to prove their cyber controls work and to probe their API links with NBFCs and fintechs.[4] ## What is reported, and who is saying it The Economic Times puts the losses at about ₹300 crore over “the past two months or so”, with nearly 150 complaints or first information reports filed, mostly by smaller NBFCs. “Cyberattacks used to happen earlier also but for the past one and a half months, they have become rampant,” one unnamed person told the paper.[1] MediaNama, reading the same report, describes the targets as lenders with turnover of about ₹1,000 crore or less, and one Delhi-based lender as losing ₹7.5 crore in one attack and ₹7.25 crore a few days later.[2] Reuters adds one documented case. Two Mumbai-based non-bank lenders lost about $2 million through more than 700 unauthorised instant transfers from accounts at ICICI Bank on 8 and 9 October, according to a police complaint Reuters reviewed; the attackers had compromised the API connection that carries loan-disbursement instructions to the bank. Neither the RBI nor ICICI Bank responded immediately to Reuters.[4] ReportedWhere the numbers come from The ₹300 crore and the complaint count are The Economic Times’ unnamed sources; MediaNama gives the count as “more than 150”, where the ET text says “nearly 150”. The $2 million is a police complaint as Reuters read it. MediaNama asked the RBI to confirm the losses and had no reply by 30 October.[1][2][4] ## How a stolen API credential becomes a payout CERT-In’s advisory CIAD-2026-0046, “Threat Actors Exploiting Payment and Disbursement APIs for Unauthorized Fund Transfers in BFSI Entities”, names no victim and no loss. It describes the path, and says the time between compromise and fraudulent transfer has shortened, with possible use of AI-assisted tooling; it does not say AI was used in any given case.[3] **Figure: The loan system is skipped: a stolen credential calls the disbursal API directly** *The attack path in CERT-In advisory CIAD-2026-0046, severity Critical, issued 9 October 2026* 1. 01Break in at the edgeInternet-facing apps, abandoned APIs, hard-coded tokens, plaintext credentials and accounts without MFA. 2. 02Take the API keysWeb shells map the payment databases, then steal payment-gateway and partner-bank API credentials. 3. 03Call the disbursal APIFrom the lender’s own whitelisted servers, bypassing loan creation, KYC and sanction, above per-transaction limits. 4. 04Out through mule accountsRapid IMPS and NEFT transfers to mule accounts at several banks, cash withdrawn, logs deleted. Source: CERT-In, CIAD-2026-0046 · as of 9 October 2026 ## What the RBI is asking, and what its rules already require Three people familiar with the discussions told Reuters the RBI raised its concerns in recent meetings with banks. It wants them to show that existing cybersecurity rules are implemented, to investigate weaknesses in their APIs, and to explain how they are preparing for AI-driven attacks.[4] The reporting rules already exist, with a gap at the small end. The RBI’s NBFC Direction of 31 July 2026 requires reporting on its DAKSH platform “within six hours of detection” for Base Layer NBFCs with assets of ₹500 crore or more and for Middle, Upper and Top Layer NBFCs; its chapter for Base Layer NBFCs below ₹500 crore has no incident-reporting paragraph.[5] Those smaller lenders still fall under CERT-In’s Directions of 28 April 2022, which require every body corporate to report listed incidents, including unauthorised access and attacks on digital payment systems, within six hours of noticing them.[6] For a lender or fintech with a disbursement API, the advisory’s own controls are the checklist:[3] - Maker-checker or a second-level check on every fund movement, and every payout matched to a sanctioned record. - Per-transaction and per-day ceilings enforced at the API, not only in the loan application. - API keys in a secrets manager or HSM, rotated; no long-lived static tokens; unused APIs formally retired. - Near-real-time reconciliation with bank and aggregator statements, and logs kept for at least 180 days. The regulation behind each of these is mapped in TechBag’s [BFSI guide](https://www.thetechbag.com/industries/bfsi); the credential controls are compared in the [privileged access guide](https://www.thetechbag.com/browse/identity-access/privileged-access-management); and our earlier piece, [two CERT-In advisories in six days](https://www.thetechbag.com/blog/cert-in-ai-agents-no-victim-noticed), reads advisory 0046 alongside its companion. How we did this Figures as of 1 November 2026 Loss and complaint figures are The Economic Times’ unnamed sources, read through its syndicated text and MediaNama. The Mumbai case and the RBI meetings are Reuters’, as carried by The420.in. The attack path is CERT-In’s advisory as issued on 9 October; reporting duties are from the two Directions cited. Left out as unconfirmed: hacking tools named by ET and city-by-city complaint counts. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [The Economic Times, AI-powered cyberattacks siphon ₹300 crore from small NBFCs in two months](https://economictimes.indiatimes.com/industry/banking/finance/ai-powered-cyberattacks-siphon-300-crore-from-small-nbfcs-in-two-months/articleshow/135278215.cms) — 29 October 2026 2. [MediaNama, AI cyberattacks siphon Rs 300 crore from NBFCs (CERT-In and RBI context, questions to the RBI)](https://www.medianama.com/2026/10/223-ai-cyberattacks-siphon-rs-300-crore-nbfcs/) — 30 October 2026 3. [CERT-In, CIAD-2026-0046: Threat Actors Exploiting Payment and Disbursement APIs for Unauthorized Fund Transfers in BFSI Entities](https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0046) — 9 October 2026 4. [Reuters, via The420.in: RBI seeks proof of cybersecurity compliance from banks after recent hacks](https://the420.in/?p=3314) — 30 October 2026 5. [Reserve Bank of India, (Non-Banking Financial Companies – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026, paras 3, 28 and 141](https://www.rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=13592) — 31 July 2026 6. [CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting, Annexure I)](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) — 28 April 2022 **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [BFSI industry guide](https://www.thetechbag.com/industries/bfsi) — the RBI, SEBI and CERT-In obligations a lender's security stack has to meet - [Privileged access management guide](https://www.thetechbag.com/browse/identity-access/privileged-access-management) — vaulting and rotating the API keys and admin credentials attackers steal - [SIEM and log management guide](https://www.thetechbag.com/browse/security/siem-log-management) — the 180-day logs and real-time alerts the advisory asks for