HYDERABAD: Fraudsters are targeting smaller NBFCs with weaker cybersecurity, studying their internal processes for 10 to 12 days before exploiting whitelisted IDs and payment API credentials, Telangana Cyber Security Bureau (TGCSB) officials said on Thursday.
The attackers identify vulnerabilities in payment systems and use stolen credentials from trusted servers to gain unauthorised access. Automated scripts then trigger fraudulent payouts outside normal batch windows, split transfers into smaller amounts to evade alerts and move funds into mule accounts.
Following AI-assisted cyberattacks on NBFC payment and loan disbursement systems across the country, TGCSB held a meeting with NBFCs, FinTech platforms, banks and officials from the Department of Telecommunications and the Reserve Bank of India.
TGCSB Director Shikha Goel said financial institutions must prevent fraud at source rather than merely report it. “The priority must be to prevent fraudulent transactions at the source, detect suspicious activities in real time and disrupt the movement of funds through mule accounts. Don’t just report fraud — stop it at the source,” she said.
TGCSB advised institutions to conduct regular vulnerability assessments and penetration tests, secure payment APIs and deploy real-time fraud detection, transaction velocity checks and limits.
If an attack is detected, institutions should switch to manual operations, shut down automated loan disbursement systems, ask banks to freeze the accounts and clear pending API calls.
Automated operations should resume only after cybersecurity experts have tested the systems and fixed vulnerabilities.
Institutions were also asked to report suspected fraud on 1930 or www.cybercrime.gov.in, alert beneficiary banks and I4C, report cyber incidents to CERT-In within six hours and notify the RBI through the DAKSH portal, wherever applicable. They should also maintain records of all high-risk payouts.