Central Bank of India has reported that approximately ₹13.97 crore was allegedly siphoned from its settlement account maintained with the Reserve Bank of India (RBI) through 187 unauthorised transactions between October 15 and October 17, 2026. The transfers reportedly reached accounts across 36 banks. Maharashtra Nodal Cyber Police have registered a case against unidentified individuals after receiving a complaint from the bank.
According to the complaint, the suspected fraud involved unauthorised access to the central Structured Financial Messaging System (SFMS) server operated by Indian Financial Technology and Allied Services (IFTAS), an RBI-owned subsidiary. The bank reportedly found no corresponding records for the disputed transactions through its normal banking channels. Investigators are examining how the funds were transferred, how the payment messaging infrastructure may have been compromised and who was responsible. The precise technical cause remains unconfirmed.
Key Takeaways
- Amount involved: Approximately ₹13.97 crore in allegedly unauthorised transfers.
- Number of transactions: 187 transfers over three days, from October 15 to October 17, 2026.
- Destination: Accounts across 36 banks.
- Suspected entry point: The complaint alleges unauthorised access involving IFTAS’s central SFMS server.
- Police action: Maharashtra Nodal Cyber Police have registered a case against unknown persons for alleged cheating and personation.
- Investigation: The bank has alerted the RBI, IFTAS and cybersecurity authorities.
- Important distinction: The reported amount is sometimes given as ₹13.96 crore in news coverage, while other reports cite ₹13.97 crore. The exact figure should be confirmed against official records.
What Happened at Central Bank of India?
The alleged fraud came to light after Central Bank of India identified a series of transfers that it said had not been authorised through its regular banking processes.
According to reporting by Hindustan Times, the bank’s General Manager for Treasury filed a complaint with Maharashtra’s cyber police. The complaint described 187 transactions processed over three days, with the money reportedly routed through the banking settlement infrastructure to accounts at 36 different banks.
The reported transaction breakdown was:
| Date | Number of reported transactions |
|---|---|
| October 15, 2026 | 6 |
| October 16, 2026 | 88 |
| October 17, 2026 | 93 |
| Total | 187 |
The concentration of transactions on October 16 and 17 forms part of the sequence investigators are examining.
The bank reportedly said its internal review could not identify the disputed transfers in its branch records, internet banking, mobile banking or other usual channels. It also said the accounts listed as originating accounts in the transaction information did not belong to Central Bank of India.
These findings raise questions about how the transfers were initiated and processed. They do not, by themselves, establish the precise vulnerability or method used by the suspected perpetrators.
How Was the Money Allegedly Transferred?
The complaint alleges that the incident involved the Structured Financial Messaging System, or SFMS, which banks use to exchange financial messages associated with payment systems.
According to the bank’s account of the suspected incident, unknown individuals gained unauthorised access to IFTAS’s central SFMS server through the SFMS server associated with Central Bank of India’s core banking system. The alleged access was then used to divert money from the bank’s settlement account with the RBI.
This is the allegation under investigation, not a confirmed forensic conclusion about the attack method.
The bank reportedly found no corresponding entries for the 187 transfers in its ordinary transaction records. Coverage by Free Press Journal also reported that partial traces associated with 10 transactions appeared in SFMS database logs, but the transaction identifiers did not match the bank’s records.
The mismatch is significant because payment systems normally rely on authenticated instructions and records that allow institutions to reconcile transfers. Investigators will need to establish how the disputed instructions were introduced, what security checks they passed and why the corresponding records were missing or inconsistent.
What Is SFMS, and Why Is It Important?
The Structured Financial Messaging System is a financial messaging infrastructure used by banks to exchange payment-related instructions. It supports communication associated with systems such as the RBI’s Real Time Gross Settlement (RTGS) and National Electronic Funds Transfer (NEFT) mechanisms.
IFTAS, a wholly owned subsidiary of the RBI, operates the central SFMS infrastructure involved in the complaint.
To understand the alleged incident, it helps to distinguish between the banking system that records customer transactions and the messaging infrastructure that carries payment instructions.
| Component | Role in a typical payment process |
|---|---|
| Core banking system | Records customer accounts and authorised payment entries |
| RTGS settlement account | Supports settlement of eligible large-value transfers |
| Bank’s SFMS server | Sends financial messages associated with payment instructions |
| Central SFMS infrastructure | Facilitates financial messaging between participating institutions |
| RBI settlement account | Holds funds used in settlement arrangements with the RBI |
These components work together, but they serve different functions. A discrepancy between payment messages and a bank’s internal records can therefore require investigation across multiple systems.
In this case, the complaint alleges that the suspected activity affected the messaging and settlement process. The investigation must determine how the transactions were processed and whether any security or reconciliation controls failed.
Police File FIR as Investigation Begins
Maharashtra Nodal Cyber Police have registered a case against unidentified individuals based on the bank’s complaint. The reported charges include cheating and personation.
The filing of an FIR begins a criminal investigation; it does not establish that any particular individual or organisation is guilty.
Investigators are expected to trace the destination accounts, examine available system logs and reconstruct the sequence of events that allowed the transfers to occur. Determining whether credentials were compromised, software weaknesses were exploited or another method was used will require technical evidence.
The bank reportedly informed several authorities and institutions after detecting the incident, including:
- Reserve Bank of India (RBI)
- Indian Financial Technology and Allied Services (IFTAS)
- Daksh Portal
- National Critical Information Infrastructure Protection Centre (NCIIPC)
- Indian Computer Emergency Response Team (CERT-In)
The involvement of financial and cybersecurity authorities reflects the importance of understanding both the movement of funds and the integrity of the payment infrastructure.
What Does the Incident Mean for Banking Cybersecurity?
The case highlights a central cybersecurity challenge for financial institutions: protecting not only customer-facing applications but also the interconnected systems that support payment processing and settlement.
Banks typically deploy multiple layers of controls, including authentication, access restrictions, transaction monitoring and reconciliation. An incident involving disputed payment instructions can prompt scrutiny of how those controls interact and whether suspicious activity can be detected quickly.
The reported lack of matching records is particularly relevant. Reliable reconciliation helps institutions compare authorised instructions, internal accounting entries and settlement activity. Differences between those records can provide important signals for detecting potential fraud.
However, the available reporting does not establish which specific control failed or whether a software vulnerability was responsible. Any explanation of the technical cause remains provisional until supported by findings from the investigation.
For financial institutions, the incident reinforces the importance of protecting messaging infrastructure, restricting privileged access, maintaining detailed audit logs and investigating inconsistencies between payment records and settlement activity.
Will Customers Be Affected?
The reported transfers were allegedly made from Central Bank of India’s settlement account with the RBI, rather than through ordinary customer-initiated transfers identified in the bank’s usual channels.
The bank’s complaint reportedly said that the transactions could not be matched to its regular records. The reported incident therefore differs from a case in which an individual customer discovers an unauthorised debit in a personal savings account.
Nevertheless, the complaint describes the funds as involving the bank’s customers’ money within the settlement process. The ultimate financial impact, recovery of funds and any consequences for customers will depend on the investigation and the bank’s subsequent disclosures.
Customers should not infer from the report alone that their individual accounts have been compromised. Anyone who notices an unexplained debit or suspicious banking activity should contact their bank through official channels and report it promptly.
The Bigger Picture
India’s digital financial infrastructure handles a large volume of electronic payments, making the security of interconnected banking systems a matter of public interest. The Central Bank of India case illustrates why cybersecurity investigations must look beyond mobile apps and customer logins to examine the messaging, authentication and settlement systems that support transactions between institutions.
The case also demonstrates the importance of distinguishing reported allegations from established findings. The number of transfers, destination accounts and discrepancies in transaction records have been described in news coverage, but the exact intrusion method, the people responsible and the ultimate recovery of funds remain unresolved publicly. The findings of investigators will be essential to understanding what happened and whether broader safeguards need to change.
FAQs
1. How much money was involved in the Central Bank of India incident?
Reports put the amount at approximately ₹13.97 crore. Some outlets report ₹13.96 crore, so the final figure should be checked against official records.
2. How many unauthorised transactions were reported?
The bank reportedly identified 187 disputed transfers between October 15 and October 17, 2026. The funds were allegedly routed to accounts across 36 banks.
3. What is the suspected method used in the incident?
The bank’s complaint alleges unauthorised access involving IFTAS’s central SFMS server through the messaging server associated with the bank’s core banking system. The precise technical method has not been publicly established.
4. What is IFTAS?
Indian Financial Technology and Allied Services is a wholly owned subsidiary of the Reserve Bank of India. It operates financial technology infrastructure, including the central SFMS system mentioned in the complaint.
5. Has anyone been arrested or found guilty?
The reports available at publication say police registered a case against unknown persons for alleged cheating and personation. The case registration does not establish guilt, and the investigation is ongoing.
Looking Ahead
The next important developments will be the results of the forensic investigation, the tracing of beneficiary accounts and any official clarification about the precise amount involved. Investigators will also need to establish how the disputed payment instructions passed through the financial messaging and settlement process without matching the bank’s regular records.
For the banking sector, the incident may prompt closer examination of payment-message authentication, access controls and reconciliation procedures. Until authorities establish the cause, the most accurate conclusion is that Central Bank of India has reported a significant suspected fraud and that the technical and criminal investigations remain underway.
Get the day’s top stories in your inbox
One concise email. No spam, unsubscribe anytime.
