₹14 Crore Banking Fraud: 187 Unauthorised Transfers Reported — Is UPI the Next Target?

Central Bank of India has reported 187 allegedly unauthorised transfers worth approximately ₹14 crore between October 15 and 17, 2026. The complaint points to suspected misuse of interbank financial messaging infrastructure. Here is what the reports actually say, how RTGS and NEFT messaging works, whether UPI is at risk, and what customers should know.

Last updated: October 25, 2026

What happened in the Central Bank of India case?

A reported banking fraud involving approximately ₹14 crore has raised fresh questions about the security of India’s financial infrastructure.

According to Hindustan Times, the Central Bank of India approached Maharashtra Nodal Cyber Police after reporting 187 allegedly unauthorised transfers involving 36 bank accounts. The transfers reportedly took place between October 15 and October 17, 2026, using the bank’s settlement account maintained with the Reserve Bank of India (RBI).

The complaint alleges that unidentified individuals gained unauthorised access involving the Central Structured Financial Messaging System (SFMS) server operated by Indian Financial Technology and Allied Services (IFTAS), a wholly owned RBI subsidiary.

The case is under investigation. The precise technical mechanism behind the alleged transfers and the final financial impact have not been conclusively established in the reports reviewed.

The important point: This is a reported incident involving alleged unauthorised transfers and interbank messaging infrastructure. It should not be described as proof that India’s entire banking settlement network has been hacked.

Sources: Hindustan Times and NDTV Profit.

How much money was involved? ₹13.96 crore or ₹13.97 crore?

The two publications report slightly different amounts.

Reported detail	Information available
Amount reported by Hindustan Times	₹13.96 crore
Amount reported by NDTV Profit	₹13.97 crore
Number of allegedly unauthorised transfers	187
Destination accounts	36 bank accounts
Period covered	October 15–17, 2026
Police action	Case registered against unknown persons

The most responsible way to present the figure is approximately ₹14 crore, while acknowledging the small discrepancy between the published reports. The exact amount should be updated if the bank or investigating authorities publish a definitive figure.

Did the RBI lose ₹14 crore?

No such conclusion is established by these reports.

The Central Bank of India is a commercial bank. The Reserve Bank of India is India’s central bank and banking regulator.

According to the reporting, the disputed transfers were routed through the Central Bank of India’s settlement account maintained with the RBI. The reports do not establish that ₹14 crore was lost from the RBI’s own funds.

Hindustan Times says the debited funds belonged to the bank’s customers rather than representing the bank’s own funds. However, there is an important additional detail: a report published by The Economic Times on October 19 said the bank had disclosed a technical glitch affecting its RTGS outward payment system and had stated that no customer suffered financial loss.

These statements need to be considered together. The earlier disclosure and the subsequent police complaint describe different aspects of the incident, and the final financial impact requires clarification from the bank or investigators.

Sources: Hindustan Times and The Economic Times.

What happened during the three days?

NDTV Profit’s report breaks down the 187 allegedly unauthorised transfers as follows:

Date	Number of reported transfers
October 15, 2026	6
October 16, 2026	88
October 17, 2026	93
Total	187

The arithmetic is consistent: 6 + 88 + 93 = 187.

According to the complaint described in the reports, the bank’s internal examination did not find corresponding records for these transfers through its usual branch, internet banking, mobile banking, core banking and other banking channels.

NDTV Profit also reported that partial traces relating to 10 accounts were found in SFMS database logs, but the corresponding transaction IDs were absent from the bank’s records.

These details are part of the reported complaint. They should not be confused with a final forensic finding about how the incident occurred.

What is SFMS, and why does it matter?

The Structured Financial Messaging System, or SFMS, is used to exchange structured financial messages between banks.

When a bank sends an eligible payment instruction through a payment system, the relevant messaging infrastructure helps transmit the instruction between participating institutions. Such messages form part of the wider process that enables payments to be processed and settled.

The reported case is significant because the complaint alleges that unauthorised activity involving central SFMS infrastructure enabled transfers that could not be reconciled with the bank’s usual internal records.

Investigators will need to determine how the messages were generated or processed, what access was obtained, which controls may have failed and how the funds moved to the destination accounts.

It is too early to conclude that every institution connected to SFMS is affected or that the entire system has been compromised.

RTGS vs NEFT vs UPI: What is the difference?

India uses several electronic payment systems. They are related to the wider banking ecosystem, but they do not all perform the same function.

Payment system	How it works	What customers should know
RTGS	Settles eligible transfers individually in real time	Commonly used for high-value transfers
NEFT	Processes electronic transfers through batches settled at regular intervals	Used for transfers across participating banks
UPI	Enables instant account-to-account payments through participating banks and UPI applications	Widely used for everyday digital payments
SFMS	Supports the exchange of structured financial messages between banks	Messaging infrastructure is not the same thing as a consumer payment app

The RBI’s official RTGS FAQs and NEFT information explain these systems. NPCI provides details about UPI through its official UPI FAQs.

The distinction matters because a reported incident involving financial messaging associated with RTGS and NEFT does not automatically establish that UPI’s infrastructure has been breached.

Is UPI the next target after the alleged RTGS incident?

There is no verified evidence in the reports reviewed that UPI is the next target in this case or that a UPI attack is imminent.

The question is understandable because UPI has become a major part of everyday payments in India. Millions of people use it to pay merchants, transfer money to family members and complete online purchases.

However, predicting the next target requires evidence. The reported incident does not establish a connection to a planned attack against UPI.

UPI is operated by the National Payments Corporation of India (NPCI) and connects users through participating banks and payment applications. It has its own system components and security controls.

That does not mean UPI is invulnerable. Like other digital payment systems, it can face risks involving compromised credentials, malicious applications, social engineering, vulnerable connected systems and attacks on service providers.

The correct conclusion is that the case raises questions about the security of interbank messaging and banking controls. It does not prove that UPI is about to be breached.

Could a cyberattack affect multiple banks at once?

Yes, in principle. Shared technology providers and interconnected financial infrastructure can create risks that extend beyond a single institution.

India has previously experienced disruptions involving banking technology providers.

In 2024, a suspected ransomware incident affecting C-Edge Technologies disrupted services for a number of cooperative banks and regional rural banks. NPCI took precautionary action involving the affected provider’s access to retail payment systems.

That incident illustrates why banks must assess third-party risks and maintain the ability to isolate affected systems. However, it is a separate incident and should not be treated as evidence that the October 2026 case has the same cause.

Further reading: The Economic Times — banking technology disruption in 2024.

What are the main cybersecurity risks for digital payments?

The alleged transfers are still under investigation. Until the technical findings are available, it would be misleading to attribute the incident to a particular vulnerability.

Nevertheless, several general cybersecurity risks are relevant to banks and payment providers.

1. Unauthorised access to sensitive systems

If an attacker obtains access to an account or system with excessive privileges, they may be able to perform actions beyond those normally permitted.

Banks need strong authentication, restricted access, continuous monitoring and rapid revocation of compromised credentials.

2. Weaknesses in connected technology

Banks depend on internal software, external technology providers and interconnected systems. A weakness in one component can create risks for other components.

Security testing, independent audits, vendor assessments and clear incident-response procedures are important safeguards.

3. Inadequate reconciliation and anomaly detection

Banks need to identify discrepancies between payment instructions, internal accounting records and settlement records.

Automated alerts, independent verification and rapid escalation can help institutions detect suspicious activity and investigate inconsistencies.

This is a general security principle, not a finding that a particular control failed in the current case.

4. Fraudulent UPI requests and social engineering

Many payment scams target users rather than the underlying banking network.

Fraudsters may impersonate bank officials, offer fake refunds, send malicious links or persuade victims to approve transactions. A successful scam does not necessarily mean that UPI’s core infrastructure has been hacked.

5. Third-party and API vulnerabilities

Application programming interfaces (APIs) allow software systems to communicate. Poorly secured APIs or compromised partner credentials can create opportunities for unauthorised activity.

Financial institutions need strict access controls, monitoring, regular security testing and effective oversight of external providers.

Is your bank account safe? What should you do now?

The reported incident does not establish that ordinary UPI users’ accounts have been compromised. There is no reason to panic or stop using digital payments solely because of this report.

However, these precautions are useful for anyone who uses UPI, NEFT or RTGS.

1. Never share your UPI PIN or OTP. Do not disclose confidential banking credentials to callers claiming to be bank employees.

2. Verify the recipient before paying. Check the displayed name and payment details carefully before authorising a transfer.

3. Do not enter your PIN to receive money. A UPI PIN is generally used to authorise a payment, not to accept an incoming payment.

4. Avoid unknown links and applications. Do not install remote-access or screen-sharing software at the request of an unverified caller.

5. Review your transaction history. Check bank statements and alerts regularly, and contact your bank immediately if you see an unfamiliar transaction.

6. Use official bank contact channels. Avoid phone numbers sent by strangers or displayed on suspicious websites.

7. Report suspected cyber fraud promptly. In India, call the national cybercrime helpline at 1930 and file a complaint through the official National Cyber Crime Reporting Portal.

Reporting quickly may help the bank and authorities take action, but it does not guarantee that the money will be recovered.

What should banks and payment operators do next?

The immediate priority is to establish what happened and prevent any further unauthorised activity.

Important measures include:

• Completing a forensic investigation of the relevant systems and access logs.
• Establishing how the disputed transfers were initiated and processed.
• Reconciling transaction messages against internal records and settlement records.
• Reviewing privileged access, authentication and approval controls.
• Assessing connected systems and third-party technology providers.
• Monitoring for related suspicious transactions.
• Coordinating with the RBI, IFTAS, law enforcement and the appropriate cybersecurity agencies.
• Publishing verified updates when doing so will not compromise the investigation.

These are recommended measures, not claims about actions that have already been completed.

Customers should look for further statements from the Central Bank of India and relevant authorities rather than rely on social media speculation about the cause or likely next target.

Final verdict: Is UPI next after NEFT and RTGS?

The Central Bank of India case is a serious reported incident. According to the police complaint described by multiple publications, 187 allegedly unauthorised transfers worth approximately ₹14 crore were routed to 36 bank accounts between October 15 and 17, 2026.

The complaint alleges unauthorised access involving the central SFMS infrastructure operated by IFTAS. However, the exact technical cause, final financial impact and complete sequence of events have not been conclusively established in the reports reviewed.

The bank’s earlier disclosure of an RTGS technical glitch and its statement that no customer had suffered financial loss should also be considered when assessing the incident.

Most importantly, there is no verified evidence that UPI is the next target or that UPI has been compromised in this case.

The incident reinforces the importance of secure interbank messaging, effective transaction reconciliation, strong access controls and rapid incident response. For customers, the sensible approach is to remain alert, protect banking credentials and report suspicious transactions promptly.

The investigation—not speculation—will determine what actually happened and what security lessons banks need to apply.

Frequently Asked Questions

1. How much money was involved in the Central Bank of India case?

Hindustan Times reported ₹13.96 crore, while NDTV Profit reported ₹13.97 crore. The safest summary is approximately ₹14 crore, pending an authoritative final figure.

2. How many unauthorised transfers were reported?

The complaint described in media reports alleges 187 transfers to 36 bank accounts between October 15 and 17, 2026.

3. Did the RBI lose ₹14 crore?

The reports describe transfers through the Central Bank of India’s settlement account maintained with the RBI. They do not establish a ₹14 crore loss from the RBI’s own funds.

4. Was the entire RTGS system hacked?

That conclusion is not established. The complaint alleges unauthorised access involving central SFMS infrastructure. Investigators must determine the precise mechanism and scope of the incident.

5. Is UPI going to be hacked next?

There is no verified evidence linking this incident to an imminent attack on UPI. UPI has its own infrastructure and controls, although all digital payment systems face cybersecurity risks.

6. Should I stop using UPI?

This report alone is not a reason to stop using UPI. Use trusted payment applications, verify recipients, protect your PIN and report suspicious transactions immediately.

7. What should I do if money is debited without my permission?

Contact your bank immediately, report the transaction through the relevant payment application’s complaint mechanism, call 1930 and submit a complaint at cybercrime.gov.in.

Sources and further reading

1. Hindustan Times — Central Bank of India reports ₹13.96 crore loss in 187 unauthorised transactions
2. NDTV Profit — Central Bank of India flags ₹13.97 crore in unauthorised transactions
3. The Economic Times — Central Bank of India reports technical glitch in RTGS outward system
4. RBI — RTGS FAQs
5. RBI — NEFT FAQs
6. NPCI — UPI FAQs
7. National Cyber Crime Reporting Portal

Disclaimer: This article is for informational and educational purposes only. It distinguishes reported allegations from established findings and reflects the cited reporting available as of October 25, 2026. The investigation may establish further facts or revise the reported figures. Readers should consult official bank and regulator communications for subsequent updates.