Over three days in the middle of October, money moved out of an account that Central Bank of India holds with the Reserve Bank of India, in 187 separate transfers that the bank says it never authorised. On 15 October, six transfers went out. On 16 October, 88 more. On 17 October, another 93. By the time it stopped, ₹13.97 crore had gone, according to the bank’s complaint to the police.
Also Read: SBI Data Breach: State Bank of India Customers Have No DPDP Act Remedy
The account in question is not a customer account. Every bank in India keeps a settlement account with the RBI, which is the pool of money it uses to pay other banks when customers send money across the system through RTGS or NEFT. When a customer of one bank transfers money to a customer of another, the banks settle the difference between themselves through these accounts at the RBI. It is, in effect, the bank’s own money, held at the central bank, to keep the payment system running. That is the account the money left.
Central Bank of India has not said how or when it noticed. The transfers came to light during the bank’s internal examination, which in plain terms means someone checking the bank’s records against what the RBI’s records showed found that money had gone out without a matching instruction from the bank. Banks are expected to carry out this kind of check every day. Why 187 transfers over three days were not caught on the first day is the first question about the Central Bank of India fraud that the bank has not answered.
The RBI’s Own Subsidiary Runs the System the Bank Says Was Breached
To understand what the bank is alleging, two names need explaining.
SFMS, the Structured Financial Messaging System, is the messaging network that Indian banks use to send each other payment instructions for RTGS and NEFT. It does for payments within India roughly what SWIFT does for payments between countries: it carries the message that says “move this much money from here to there”. The money itself moves through the RBI’s settlement accounts; SFMS carries the instruction. Every bank has its own SFMS server connected to its core banking system, and all of them connect to a central SFMS server.
IFTAS, the Indian Financial Technology and Allied Services, is the company that runs that central server. It took over SFMS in 2016 and has been wholly owned by the RBI since 2019. In short, the messaging backbone of India’s bank-to-bank payments is run by a subsidiary of the central bank.
The bank’s complaint alleges that unknown persons got into IFTAS’s central SFMS server through Central Bank of India’s own SFMS server, the one attached to its core banking system. Once there, the complaint says, they generated 187 payment messages that moved money from the bank’s settlement account at the RBI to 36 bank accounts. The payer accounts named in those messages did not belong to Central Bank of India at all. The messages did not pass through any branch, any internet or mobile banking channel, or the bank’s core banking system. They simply appeared on the messaging network, and the money moved.
So the money in the Central Bank of India fraud was lost by the bank, not by customers, and it landed in 36 accounts across the banking system. Whether those accounts have been frozen, who holds them, and whether any of the ₹13.97 crore has been recovered, the bank and the police have not said.
No customer has lost a rupee. But the bank’s money is ultimately depositors’ money, and the sum is not the point. If the complaint is accurate, somebody was able to insert payment instructions into the system that every Indian bank relies on, from inside one bank’s connection to it, without leaving a trace in that bank’s own records. SFMS carries the instructions behind lakhs of crores of transfers every day. The question the Central Bank of India fraud raises is not what happened to roughly ₹14 crore. It is whether the same thing could be done from any other bank’s server.
Also Read: Inside the HDFC Bank Scandal That Triggered a Market Crash
187 Transfers, and the Bank’s Own Records Show None of Them
After the transfers surfaced, the bank’s internal team went looking for them. It checked branch records, internet banking, mobile banking and every other customer channel. It checked its core banking system. It checked its RTGS settlement records. It checked its own SFMS server. It found none of the 187 transactions in any of them.
The only traces were partial: entries for 10 of the transactions turned up in the SFMS database logs, but the transaction IDs on those entries did not match anything in the bank’s records. The bank’s own systems, in other words, have no record of instructing these payments, yet the payments were made.
Once the transfers came to notice, the bank says it informed the RBI, IFTAS, the RBI’s Daksh portal for reporting incidents, the National Critical Information Infrastructure Protection Centre and CERT-In. On 22 October, five days after the last transfer, the bank’s General Manager for Treasury filed a complaint with the Additional Director General of Police, Maharashtra Cyber. He later appeared before the police to record a statement.
Maharashtra’s Nodal Cyber Police have registered a First Information Report against unknown persons for cheating by personation. Police are examining the suspected unauthorised access to the messaging system, how the funds moved, and the 36 beneficiary accounts. A police officer told reporters that so little is known about how the transactions were generated that tracing the money is proving very difficult. That is a striking admission in a case where the entire trail should exist in a central server operated by the RBI’s own company.
The bank has made no public statement about the police complaint or the amount involved. The RBI has said nothing. IFTAS has said nothing.
Bangladesh Bank Lost $81 Million the Same Way. Union Bank Caught It in a Day
The shape of the Central Bank of India fraud is familiar to anyone who follows payment security. In February 2016, attackers used forged SWIFT messages to move $81 million out of Bangladesh Bank’s account at the Federal Reserve Bank of New York. The central bank’s own account was drained through the messaging system, exactly the pattern alleged here.
In July 2016, Union Bank of India came close to losing about $171 million the same way, after an employee opened an email that appeared to come from the RBI and carried malware that gave the attackers access to the bank’s SWIFT connection. The bank caught the discrepancy when it reconciled its accounts the next morning, and recovered almost all of the money. In February 2018, City Union Bank lost about $2 million through three fraudulent SWIFT transfers.
After those cases, and the Punjab National Bank fraud of February 2018 in which SWIFT messages were sent without entries in the core banking system, the RBI required banks to integrate SWIFT with their core banking systems and reconcile them daily. SFMS is the domestic equivalent of SWIFT. The Central Bank of India fraud appears to be the first reported case of it being used the same way.
Union Bank caught its breach at the next morning’s reconciliation. Central Bank of India let six transfers go out on 15 October, 88 on 16 October and 93 on 17 October before anything stopped. A settlement account at the RBI is meant to be reconciled daily. Either the reconciliation did not happen, or it happened and the transfers did not show up in the bank’s records, which is what the bank now says. If the second is true, the bank’s records and the RBI’s records disagreed for three days without anyone noticing, which is its own failure.
One Bank’s Server or the Whole System: Only the RBI Can Say
Almost everything the public knows about the Central Bank of India fraud comes from the bank’s complaint, and the bank is also the party whose controls failed. Its complaint says the intruders entered the central server through its own server. There are two possibilities, and they are very different.
If the attackers compromised only Central Bank of India’s SFMS server and used it to send messages that the central system accepted as genuine, the failure is at one bank, and the fix is at one bank. If the attackers reached the central IFTAS server itself, then every bank on RTGS and NEFT is exposed, and the RBI’s silence is not just a matter of communication. Nothing said so far settles which of these it is.
When exactly did Central Bank of India discover the transfers, and how? Who holds the 36 accounts that received the money, and has any of it been recovered? Has the RBI told other banks to check their SFMS servers? And has anything like this happened on SFMS before without being made public?
Until the RBI or IFTAS answers, the question that matters is not what happened to ₹14 crore, but whether the system that carries India’s bank-to-bank payments can be trusted.
Disclaimer : This story is auto aggregated by a computer programme and has not been created or edited by DOWNTHENEWS. Publisher: theprobe.in
