Hyderabad: Cybercriminals are increasingly targeting the internal payment infrastructure of Non-Banking Financial Companies (NBFCs), exploiting security gaps to manipulate loan disbursements and siphon off funds through automated transactions, the Telangana Cyber Security Bureau (TGCSB) has warned.
The bureau has alerted NBFCs, fintech companies and banks, urging them to strengthen their cybersecurity systems and detect suspicious transactions before financial losses occur.
The warning followed a meeting held at the TGCSB headquarters in Hyderabad on November 12, involving financial institutions, the Department of Telecommunications (DoT) and the Reserve Bank of India (RBI). The discussions focused on vulnerabilities in payment systems, compromised application programming interfaces (APIs) and emerging fraud techniques.
According to the bureau, fraudsters spend five to 12 days studying an institution’s internal processes, payment mechanisms and network weaknesses before launching attacks. They reportedly target vulnerable APIs, exploit stolen credentials and manipulate trusted payment channels to make fraudulent transactions appear genuine.
Once inside the system, criminals deploy automated scripts to initiate multiple payouts, often outside regular banking hours. Large amounts are divided into smaller transactions and transferred through multiple mule accounts, making detection and intervention difficult.
Addressing the meeting, TGCSB Director Shikha Goel stressed that financial institutions must focus on preventing fraud rather than responding after money has been stolen.
The bureau advised institutions to conduct regular security audits, strengthen API protection, introduce transaction limits and deploy real-time fraud monitoring systems. It also directed them to suspend automated disbursements and switch to manual operations if suspicious activity is detected.
Institutions have been urged to report cyber incidents promptly and coordinate with banks, law enforcement agencies and CERT-In. Citizens who encounter financial cyber fraud can contact helpline 1930 or register complaints at www.cybercrime.gov.in.
