Cyberattacks have reportedly siphoned off an estimated ₹300 crore from non-banking financial companies (NBFCs) across India over roughly two months, with around 150 complaints or first information reports (FIRs) filed, according to a report by The Economic Times published on October 29, 2026. Smaller lenders have been among the main targets, with investigators identifying weaknesses in cybersecurity systems, payment interfaces and software used to process financial transactions.
The incidents have raised concerns about the growing use of AI-assisted hacking tools to automate parts of cybercrime, including identifying vulnerabilities and exploiting exposed systems. Officials have warned that these capabilities could make traditional fraud techniques associated with Jamtara-style scams easier to scale. The reported ₹300 crore figure remains an estimate based on sources cited by the newspaper, and investigations into several incidents are continuing.
Key Takeaways
- Reported losses: Fraudsters are estimated to have stolen around ₹300 crore from Indian NBFCs over approximately two months.
- Around 150 complaints: Sources cited by The Economic Times said nearly 150 complaints or FIRs had been filed.
- Smaller lenders targeted: Many affected institutions reportedly have annual turnover of around ₹1,000 crore or less.
- Payment-system weaknesses: CERT-In has warned of attacks involving exposed applications, stolen API credentials and unauthorized fund transfers.
- AI-assisted operations: Cybersecurity experts say AI tools may help attackers automate reconnaissance and exploit weaknesses more quickly.
- Repeated attacks: Some lenders have reportedly suffered multiple incidents within days, highlighting the importance of fixing vulnerabilities completely.
What Happened in the Cyberattacks on NBFCs?
According to The Economic Times, fraudsters are estimated to have diverted approximately ₹300 crore from NBFCs, particularly smaller lenders, across India during the preceding two months. The report cited officials and sources familiar with the investigations.
The attacks reportedly became more frequent over the six weeks leading up to the publication date. Some financial institutions were targeted more than once, suggesting that attackers were exploiting weaknesses that remained unresolved after an initial incident.
One Delhi-based lender reportedly lost ₹7.5 crore in an initial attack and another ₹7.25 crore several days later. The report also cited approximately 30 complaints in Mumbai, more than 25 in Delhi and 15–16 in Chennai, alongside cases from other locations.
These figures come from media reporting based on investigative sources. A consolidated official assessment of total losses, affected institutions and recoveries was not available in the cited coverage.
How Are Hackers Targeting Smaller NBFCs?
Officials quoted by The Economic Times said attackers sometimes spend 10–12 days studying an NBFC’s operations before attempting to divert funds.
During this period, they reportedly examine how payments are processed, which system identifiers are trusted and where software weaknesses may exist. Once they understand the workflow, they can attempt to exploit gaps between the institution’s internal records and its payment infrastructure.
The risks increase when a financial application has excessive privileges or when payment interfaces trust requests simply because they originate from an approved system.
In its October 9 advisory, CERT-In and CSIRT-Fin described campaigns targeting NBFCs, digital lenders, fintech companies, payment service providers and wallet operators. The agencies warned that attackers had exploited internet-facing applications and exposed APIs, stolen payment and banking credentials, and initiated transfers through trusted infrastructure.
| Security weakness | Potential consequence |
|---|---|
| Exposed or outdated applications | Attackers may gain unauthorized access |
| Stolen API credentials | Fraudulent requests may appear to come from a legitimate service |
| Weak transaction validation | Payments may proceed without all required checks |
| Excessive administrative permissions | A compromised account may affect critical systems |
| Inadequate monitoring | Suspicious transfers may remain undetected for longer |
The core problem is not necessarily an exceptionally sophisticated attack. Poorly protected interfaces and weak validation can create opportunities for criminals to bypass controls that should prevent unauthorized payments.
How AI Tools Could Make Cybercrime Easier to Scale
Cybersecurity experts cited by The Economic Times have raised concerns about the use of AI toolkits, including Artex and CyberStrike, alongside open-source AI models in attacks against financial systems.
The reported activity involves tools that may help attackers investigate targets, identify potential weaknesses and automate technical operations. AI can also assist with interpreting stolen information and preparing convincing messages for social engineering.
However, the distinction between assistance and autonomous execution matters. The reports do not establish that every attack was conducted entirely by AI or that the same tools were responsible for all reported losses.
CERT-In’s October 15 advisory separately described financially motivated campaigns in which publicly available AI-powered tools helped identify and exploit security weaknesses. The agency warned that the time between an initial compromise and resulting damage had fallen from days to hours in some observed activity.
This speed creates additional pressure on security teams. When attackers can automate repetitive tasks and run multiple operations in parallel, organizations may have less time to identify a breach, disable compromised credentials and stop unauthorized transactions.
Why Officials Are Comparing the Risk to Jamtara-Style Fraud
Jamtara, a district in Jharkhand, has become widely associated with phone-based phishing and other forms of social-engineering fraud. Such scams often rely on convincing victims that a caller or message is legitimate so they will disclose information, reveal authentication codes or authorize a transaction.
The current concern is that AI could make these techniques more targeted and easier to repeat.
An attacker who obtains customer or loan-related information may be able to create a message or phone script that appears credible because it references a real lender, loan application or financial transaction. AI systems can also help produce fluent messages in different languages.
That does not mean the reported NBFC attacks were all conventional phone scams. Many of the documented attack paths involved technical weaknesses in applications and payment APIs. The Jamtara comparison concerns the potential combination of technical exploitation with scalable social engineering.
For financial institutions, this creates a dual challenge: secure the systems that authorize payments and prepare customers to recognize deceptive communications that may appear increasingly personalized.
What CERT-In Has Recommended
CERT-In’s October 9 advisory provides specific recommendations for financial institutions facing these risks.
Strengthen authentication. Multi-factor authentication should protect administrative portals, payment systems, remote access and relevant APIs. Long-lived static credentials should be replaced with more tightly controlled authentication mechanisms where feasible.
Validate every payment. Institutions should ensure that a disbursement cannot proceed without the necessary loan approval, customer verification, beneficiary checks and transaction limits. A valid API credential should not, by itself, authorize an otherwise invalid transfer.
Control API access. Financial firms should inventory their APIs, remove unused interfaces and restrict access to services that do not need to be publicly reachable.
Protect credentials. API keys and other secrets should be stored securely rather than embedded in source code or exposed in configuration files. Compromised credentials should be revoked and rotated promptly.
Monitor transactions. Real-time alerts, transfer limits, beneficiary checks and independent reconciliation can help identify suspicious payments before additional funds are lost.
The agency also recommends preserving forensic evidence, isolating affected systems and reporting relevant incidents to CERT-In and CSIRT-Fin.
What RBI Cybersecurity Rules Mean for NBFCs
The Reserve Bank of India has established technology-risk and cybersecurity requirements for NBFCs under its regulatory framework. The RBI’s IT governance, risk, controls and assurance directions issued in November 2023 became effective in April 2024 for NBFCs in the middle, upper and top regulatory layers.
The RBI also issued revised fraud-risk management directions for NBFCs in July 2024, covering areas including fraud prevention, detection and reporting.
These frameworks make cybersecurity a governance responsibility, not simply an IT maintenance task. Institutions need appropriate controls, audits, incident-response procedures and oversight of technology risks.
Smaller lenders may face resource constraints, but the reported incidents show why payment security and access management are fundamental operational requirements. The appropriate controls will depend on an institution’s regulatory classification, systems and risk exposure.
The Bigger Picture
The reported losses highlight how weaknesses in financial infrastructure can create opportunities for fraud even when attackers do not use entirely new techniques. Exposed applications, stolen credentials and insufficient payment validation can undermine the controls that financial institutions rely on to protect money.
AI-assisted tools may increase the speed and scale at which attackers discover and exploit these weaknesses. Yet technology is only one part of the problem: persistent vulnerabilities, excessive access privileges and incomplete incident response can leave organizations exposed to repeat attacks. For NBFCs, strengthening the underlying security architecture may be just as important as tracking emerging AI tools.
FAQs
1. How much money has reportedly been stolen from Indian NBFCs?
The Economic Times reported on October 29, 2026, that approximately ₹300 crore had been siphoned off from NBFCs over roughly two months. The figure is an estimate attributed to sources familiar with the investigations, not a consolidated official tally.
2. Why are smaller NBFCs being targeted?
Reports indicate that many affected lenders have weaknesses in their cybersecurity infrastructure, applications and payment systems. Smaller institutions may have fewer resources for security operations, but the specific vulnerabilities differ from one organization to another.
3. What role is AI playing in these cyberattacks?
Experts say AI-assisted tools can help attackers investigate systems, identify weaknesses and automate some technical tasks. AI can also support social engineering. The available reporting does not establish that AI alone caused the losses or that every incident used the same tools.
4. What does “Jamtara-style fraud” mean in this context?
The phrase refers to the risk of combining technical attacks with familiar social-engineering techniques, such as deceptive calls and phishing messages. AI could make such messages more personalized and easier to produce at scale.
5. How can NBFCs reduce the risk of similar attacks?
They can secure exposed applications and APIs, enforce strong authentication, protect credentials, validate every payment independently, impose transaction limits and monitor transfers in real time. Regular security testing and complete remediation after incidents are also important.
Looking Ahead
Investigations will determine the full scale of the reported losses, the institutions affected and the extent to which particular hacking platforms or AI tools were involved. Financial firms will also need to assess whether their existing payment controls can withstand attacks that combine stolen credentials, automated reconnaissance and direct access to transaction interfaces.
For India’s financial sector, the priority is to make unauthorized transfers harder to execute and easier to detect. Stronger API security, stricter credential management, rapid incident response and customer awareness can help reduce both direct financial losses and the risk of follow-on fraud.
Get the day’s top stories in your inbox
One concise email. No spam, unsubscribe anytime.
