The Mumbai Cyber Police have registered a First Information Report against unidentified persons after ₹13.97 crore was allegedly siphoned from Central Bank of India’s settlement account with the Reserve Bank of India. According to the state-run lender, the fraudulent transfers were executed across 187 separate transactions between October 15 and 17, with the money routed into accounts across 36 different commercial banks. The complaint, filed by the bank’s general manager in charge of treasury operations, states that an internal review failed to find any record of these transactions across its branches, internet banking, mobile banking, or core banking infrastructure.
No internal transaction records found
Investigators are examining how the transactions were initiated without generating standard internal logs. Under standard procedures, real-time gross settlement payments require debit entries in core systems, which then generate corresponding transaction identification numbers. While logs on the bank’s Structured Financial Messaging System database showed partial references tied to 10 accounts, none of the 187 transactions generated standard identification numbers within internal records or settlement accounts.
The unauthorised transfers were carried out over three consecutive days. Records indicate that six transactions occurred on October 15, followed by 88 on October 16 and another 93 on October 17. The absence of regular system records has prompted technical scrutiny over whether standard verification workflows were completely bypassed by the perpetrators.
Suspected breach of messaging infrastructure
The bank’s complaint alleges that the perpetrators gained unauthorised access to the central server of Indian Financial Technology and Allied Services, a wholly owned subsidiary of the Reserve Bank of India that manages interbank financial messaging. The intrusion is suspected to have occurred via the bank’s local messaging server, which connects its core banking system directly to the central clearing network.
In a normal transaction cycle, funds are debited from a customer’s account and credited to the lender’s RTGS settlement account before an outward instruction is transmitted to the central server. The central system then debits the bank’s settlement balance held with the central bank. Investigators believe this transfer channel was manipulated directly, although the exact method of entry into the messaging system remains under active inquiry.
Multiple agencies alerted as probe widens
The funds were dispersed into accounts across 36 different banks, leaving police to track the beneficial owners of those accounts and determine whether the money was further dispersed. A police official familiar with the probe indicated that limited initial data has made tracking the fund trail challenging. The complaint notes that while public interests are affected, available evidence has not established direct debits from individual retail customer accounts.
Central Bank of India has alerted key regulatory and cybersecurity authorities, including the Reserve Bank of India, IFTAS, the Daksh portal, the National Critical Information Infrastructure Protection Centre, and the Indian Computer Emergency Response Team. Investigators from Mumbai’s Nodal Cyber Police Station are currently analysing server logs, messaging transmission data, and beneficiary accounts to establish the origin of the breach and identify the perpetrators.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
