| ➡️ Click here to Join Whatsapp News Group - Get instant updates of all Banking News |
Central Bank of India has reported that ₹13.97 crore was transferred from its settlement account with the Reserve Bank of India (RBI) through 187 unauthorised transactions between October 15 and October 17. The bank has alleged that unknown persons gained unauthorised access to the central Structured Financial Messaging System (SFMS) server operated by Indian Financial Technology and Allied Services (IFTAS), a wholly owned subsidiary of the RBI.
According to the complaint filed by the bank’s General Manager (Treasury), the money was transferred to 36 bank accounts. The case was registered at the Nodal Cyber Police Station in Mumbai. This incident comes just days after the State Bank of India (SBI) confirmed a data leak involving the personal information of hundreds of customers.
How Many Unauthorised Transactions Took Place?
According to the First Information Report (FIR), the unauthorised transfers took place over three days.
- October 15: 6 transactions
- October 16: 88 transactions
- October 17: 93 transactions
A total of 187 transactions were reported, involving ₹13.97 crore.
What Is the SFMS System?
The Structured Financial Messaging System (SFMS) is used by banks to exchange financial messages securely. It carries payment messages between banks through the RBI’s Real Time Gross Settlement (RTGS) and National Electronic Funds Transfer (NEFT) systems. IFTAS operates the central SFMS infrastructure involved in this process.
The complaint alleges that unknown persons gained unauthorised access to the central Structured Financial Messaging System (SFMS) server operated by Indian Financial Technology and Allied Services (IFTAS), an RBI subsidiary. However, the exact technical method used to carry out the transfers has not yet been established by the information available.
How Was the Money Transferred?
According to the bank’s complaint, unknown persons allegedly gained unauthorised access to IFTAS’s central SFMS server through the SFMS server connected to the bank’s core banking system. The complaint alleges that this access was used to divert money from Central Bank of India’s settlement account with the RBI. The bank has stated that the transfers were not initiated through its normal banking channels.
The bank’s internal investigation reportedly found no record of the 187 transactions in its branches, internet banking, mobile banking or other banking channels. The transactions were also not found in the bank’s core banking system, its RTGS settlement account records or its SFMS server records.
According to the complaint, partial traces of 10 of the 36 beneficiary accounts were found in SFMS database logs. However, the corresponding transaction IDs were not available in the bank’s records. The bank also stated that the accounts identified as the senders of the money in the 187 transactions did not belong to Central Bank of India.
How Does a Normal RTGS Transaction Work?
The bank’s complaint explained the normal process for an RTGS payment as follows:
- A customer submits a payment request to the bank.
- The bank enters the payment details into its core banking system and debits the customer’s account.
- The amount is credited to the bank’s RTGS settlement account.
- A payment message is sent from the bank’s SFMS server to IFTAS’s central SFMS server.
- The corresponding amount is debited from the bank’s settlement account maintained with the RBI as part of the settlement process.
The bank suspects that the alleged fraud involved unauthorised access to the central SFMS infrastructure, allowing money to be diverted from its RBI settlement account without the transactions appearing in its normal records.
Bank has informed the authorities
Central Bank of India said it immediately informed the following authorities and organisations about the incident:
- Reserve Bank of India (RBI)
- Indian Financial Technology and Allied Services (IFTAS)
- Daksh portal
- National Critical Information Infrastructure Protection Centre (NCIIPC)
- Indian Computer Emergency Response Team (CERT-In)
What Have the Police Said?
The police have registered a case against unknown persons for alleged cheating and personation. The investigation is expected to examine how the alleged unauthorised access occurred, how the funds were moved to the 36 bank accounts and who was responsible.
Could Hackers Have Bypassed the Core Banking System?
One possible explanation is that attackers gained control of a banking server or compromised an authorised account used to send financial messages. If they managed to submit payment instructions that passed the relevant security checks, the payment system might have processed them even though the corresponding transactions had not been entered into CBS. Another possibility is that a software vulnerability or configuration weakness allowed unauthorised access to the payment messaging infrastructure. These are possible technical scenarios, not confirmed findings in the Central Bank of India case.
The central issue is the reported mismatch between the transfers and Central Bank of India’s internal transaction records. If the payments were settled without corresponding authorised entries in the bank’s core banking system, investigators must establish how the instructions entered the payment process and passed its controls.
