AI-Driven Fraud Campaign Targets Indian NBFCs, Losses Estimated at ₹300 Crore

• •Estimated ₹300 crore lost from Indian NBFCs due to API fraud since September 2026.
• •Attackers exploit compromised servers to bypass security checks and initiate fund transfers.
• •CERT-In has issued a critical advisory confirming the ongoing threat to the financial sector.

Since mid-September 2026, a financially motivated campaign has siphoned an estimated ₹300 crore from smaller Indian non-banking financial companies (NBFCs) through the theft of payment API credentials. Attackers exploit compromised internet-facing applications and APIs, using stolen credentials to initiate unauthorized fund transfers to mule accounts, bypassing standard checks. The campaign has led to around 150 complaints and FIRs, with a notable incident on October 5, where ₹3.93 crore was drained in 149 transfers from one NBFC's account. The tools used in these attacks are reportedly of Chinese origin, but this does not confirm the attackers' nationality. Investigations reveal significant security gaps in the affected NBFCs, which predominantly have annual turnovers of ₹1,000 crore or less. CERT-In has issued an advisory (CIAD-2026-0046) confirming the critical nature of the threat. Despite the scale of the attacks, many affected entities remain unnamed, and the full extent of the impact is still being assessed.