Small NBFCs reportedly lost ₹300 crore in two months; RBI is checking banks' API links

01What is reported, and who is saying it

The Economic Times puts the losses at about ₹300 crore over “the past two months or so”, with nearly 150 complaints or first information reports filed, mostly by smaller NBFCs. “Cyberattacks used to happen earlier also but for the past one and a half months, they have become rampant,” one unnamed person told the paper.¹ MediaNama, reading the same report, describes the targets as lenders with turnover of about ₹1,000 crore or less, and one Delhi-based lender as losing ₹7.5 crore in one attack and ₹7.25 crore a few days later.²

Reuters adds one documented case. Two Mumbai-based non-bank lenders lost about $2 million through more than 700 unauthorised instant transfers from accounts at ICICI Bank on 8 and 9 October, according to a police complaint Reuters reviewed; the attackers had compromised the API connection that carries loan-disbursement instructions to the bank. Neither the RBI nor ICICI Bank responded immediately to Reuters.⁴

02How a stolen API credential becomes a payout

CERT-In’s advisory CIAD-2026-0046, “Threat Actors Exploiting Payment and Disbursement APIs for Unauthorized Fund Transfers in BFSI Entities”, names no victim and no loss. It describes the path, and says the time between compromise and fraudulent transfer has shortened, with possible use of AI-assisted tooling; it does not say AI was used in any given case.³

03What the RBI is asking, and what its rules already require

Three people familiar with the discussions told Reuters the RBI raised its concerns in recent meetings with banks. It wants them to show that existing cybersecurity rules are implemented, to investigate weaknesses in their APIs, and to explain how they are preparing for AI-driven attacks.⁴

The reporting rules already exist, with a gap at the small end. The RBI’s NBFC Direction of 31 July 2026 requires reporting on its DAKSH platform “within six hours of detection” for Base Layer NBFCs with assets of ₹500 crore or more and for Middle, Upper and Top Layer NBFCs; its chapter for Base Layer NBFCs below ₹500 crore has no incident-reporting paragraph.⁵ Those smaller lenders still fall under CERT-In’s Directions of 28 April 2022, which require every body corporate to report listed incidents, including unauthorised access and attacks on digital payment systems, within six hours of noticing them.⁶

For a lender or fintech with a disbursement API, the advisory’s own controls are the checklist:³

• Maker-checker or a second-level check on every fund movement, and every payout matched to a sanctioned record.
• Per-transaction and per-day ceilings enforced at the API, not only in the loan application.
• API keys in a secrets manager or HSM, rotated; no long-lived static tokens; unused APIs formally retired.
• Near-real-time reconciliation with bank and aggregator statements, and logs kept for at least 180 days.

The regulation behind each of these is mapped in TechBag’s BFSI guide; the credential controls are compared in the privileged access guide; and our earlier piece, two CERT-In advisories in six days, reads advisory 0046 alongside its companion.