₹300 crore in two months: how attackers hijacked NBFC payout systems

Over the last few months, a quiet kind of bank robbery has played out across India's lending sector. Nobody broke into a vault or cracked a core banking system. Instead, attackers took over the systems lenders use to pay out loans, and used them to send the money to themselves.

By late October, officials told The Economic Times that smaller NBFCs had lost an estimated ₹300 crore this way in about two months, with roughly 150 complaints and FIRs filed [1]. Most victims were lenders with annual turnover of ₹1,000 crore or less. Mumbai saw about 30 complaints, Delhi more than 25 and Chennai 15 to 16. The ₹300 crore is an investigators' estimate; no official total has been published yet.

CERT-In issued two Critical advisories within a week. The first, on 9 October, warned NBFCs, digital lenders, fintechs and wallets that their payment and disbursal APIs were being abused [2]. The second, on 15 October, warned that attackers were using AI agents to move faster than ever [3]. Neither names a victim, and neither do we: the lenders below are described by type and city.

The cases so far

These are the cases reported in enough detail to learn from. Where we know the details, they look strikingly alike: the attacker gets in, and within an hour or two hundreds of small transfers have gone out to mule accounts. Only a small share of the money has been frozen.

• NBFC, Hyderabad (19 Oct): ₹3.34 crore in 183 transfers over 87 minutes to 52 accounts after attackers reached its systems and API; ₹40 lakh blocked [4].

• NBFC, Delhi (Sep–Oct): ₹7.5 crore in a first breach, then ₹7.25 crore more days later [1].

• About 20 banks, NBFCs and fintechs (early Oct): hit through partner-bank credentials and weak payout APIs on one platform built by a Chennai software firm [5].

• Loan-disbursal account, Delhi (5 Oct): ₹3.93 crore in 149 debits in one morning after malware on a server; part converted to USDT [6].

• AePS payments fintech, Navi Mumbai (2 Oct): ₹1.98 crore in 57 transfers over 94 minutes, with no valid credentials or OTP [7].

• Payments fintech, Noida (13 Sep): ₹2.42 crore in 497 transfers to 58 accounts across 28 banks after its server and API portal were tampered with [8].

• Large NBFC, Delhi (21 Aug): ₹12.84 crore in 317 debits to 34 mule accounts; internal server suspected; ₹1.7 crore frozen [9].

• Gold-loan NBFC, Mumbai (13 Jul): ₹78.1 lakh in 18 payouts in about an hour through its loan software's bank API link, found at next-day reconciliation [10].

  
  

None of this is new, which is perhaps the most worrying part. In August 2025 a Bengaluru digital lender lost about ₹49 crore in 1,782 transfers over two and a half hours [11]. A month later a Hyderabad payments fintech lost ₹1.4 crore when attackers sent requests to its partner bank from the company's own trusted servers [12]. What changed this year is the speed and the number of victims.

How the attacks work

The clever part is that the attackers never need to fool the bank. The bank trusts the lender's payout system, so once that system is in the wrong hands, every transfer looks legitimate. CERT-In's advisory and the police cases describe the same seven steps [2].

1. They find a way in. Usually something ordinary: an app or server that hasn't been patched, an old or test API nobody switched off, an API key left in the code, a password in a config file, or an admin login without two-factor authentication.

2. They settle in and watch. They plant a hidden backdoor and learn how the lender pays out loans and which accounts the bank trusts. Officials quoted by ET say this takes 10 to 12 days [1].

3. They take the keys. On the lender's servers they find the API keys for the payment gateway and the partner bank.

4. They pay themselves. Using those keys from the lender's own servers, they call the payout API directly. Loan creation, KYC, approval and limits are skipped, and the transfers carry made-up reference numbers.

5. They move fast. Quick IMPS and NEFT transfers, often ₹50,000 to ₹2 lakh each, go to dozens of mule accounts and are withdrawn almost at once.

6. They cover their tracks. Logs get deleted and security software gets tampered with.

7. They come back. Lenders that only partly fixed the problem were hit again within days, and harder [3].

AI is making all of this quicker. CERT-In says AI-driven attack tools have cut the time from getting in to stealing money from days to hours [3]. ET's sources name two toolkits, CyberStrike and Artex; CERT-In itself names none.

Why it worked

The heart of the problem is simple: one stolen key could move money, and nothing else stood in the way. The bank trusts the lender's server, not each transaction, so whoever controls the server controls the payouts. And the keys that unlock those payouts often sat in code, config files or databases, long-lived, rather than locked in a vault and issued fresh for each session.

Once inside, there was little to stop a payout. The payout API didn't check that a real, approved loan stood behind each transfer, which is why made-up reference numbers went straight through. Limits, checks on new beneficiaries and a second person's approval were often missing, or lived only in the app the attackers went around.

Nobody was watching closely enough, either. In several cases the theft came to light only through a bank alert or the next day's reconciliation, after 50 to 500 transfers had gone out. Old and test APIs stayed online, admin panels lacked two-factor login, and lenders that closed only the obvious hole were hit again.

What this means if you run a lending platform

If you build lending software or act as a lending service provider, you sit on the payout path for every lender you work with. A single weak integration can become every client's incident, as the 20 institutions hit through one shared platform found out.

RBI's 2026 cybersecurity directions for NBFCs, issued on 31 July, ask lenders to control their vendors, use maker-checker and audit trails, require two-factor login for privileged users, and test critical and customer-facing systems with a vulnerability assessment every 6 months and a penetration test every 12 months [10]. Incidents must reach RBI on DAKSH within 6 hours of detection. When getting in and getting paid can happen in the same afternoon, a test once or twice a year leaves long stretches in which a new opening can be found and used.

A checklist for your own setup

• Do we know every API we have, and have we switched off the old and test ones?

• Are admin panels and API docs off the public internet, with two-factor login everywhere?

• Are gateway and bank API keys in a secrets vault, rotated, and scanned for in every code change?

• Does our payout API refuse any transfer without an approved loan and a real reference number?

• Are limits, new-beneficiary checks and a second approval enforced in the API itself, not just the app?

• Would we notice a burst of payouts within minutes, and do we reconcile in near real time?

• Are logs stored centrally for at least 180 days, and do we re-test after every fix?

• Have we practised the 6-hour report to RBI and CERT-In, and the 1930 call to freeze mule accounts?

Get your complete exposure report

If you can't answer every question above with confidence, start with what an attacker sees. NexusVoid maps everything you expose to the internet, including old and test APIs, leaked keys and unpatched software, tests whether your payouts can be hijacked, and hands you a fix for each finding. Our 24/7 monitoring then tests every newly disclosed vulnerability against your stack as it appears.

Get your complete exposure report →

References

1. Elets BFSI, citing The Economic Times. "Small NBFCs lose an estimated ₹300 crore to AI-powered cyberattacks in two months." 29 Oct 2026. bfsi.eletsonline.com

2. CERT-In. Advisory CIAD-2026-0046, "Threat actors exploiting payment and disbursement APIs for unauthorized fund transfers in BFSI entities." 9 Oct 2026. cert-in.org.in

3. CERT-In. Advisory CIAD-2026-0049, "AI agents as attack vectors." 15 Oct 2026. cert-in.org.in

4. Siasat. "Hyderabad NBFC loses Rs 3.3 crore in 87-minute cyberattack." 23 Oct 2026. siasat.com

5. The Economic Times, via fvbb. "Cyberattacks affect 20 financial institutions." 14 Oct 2026. fvbb.com

6. Millennium Post. "Seven arrested in Rs 3.9 cr cyber fraud; police uncover USDT, hawala links." 28 Oct 2026. millenniumpost.in

7. Free Press Journal. "Vashi fintech firm loses ₹1.98 crore in 57 unauthorised transfers within 94 minutes." 5 Oct 2026. freepressjournal.in

8. Amar Ujala. "Financial services company's server hacked; 2.42 crore siphoned off." 16 Sep 2026. amarujala.com

9. ThePrint. "An NBFC, 317 transactions and Rs 12.84 cr gone." 17 Sep 2026. theprint.in

10. Ministry of Cyber Affairs (independent news site, not a government portal). "API heists hit India's NBFCs." 26 Oct 2026. ministryofcyberaffairs.com

11. Deccan Herald. "Two Indians in Dubai use Hong Kong hackers to steal Rs 49 cr from Bengaluru loan provider." 2025. deccanherald.com

12. Siasat. "Cybercrime in Hyderabad: fintech firm duped of Rs 1.3 crore." 23 Sep 2025. siasat.com