India’s digital lending boom is facing a severe reality check. A coordinated wave of AI-assisted cyberattacks has reportedly hit small Non-Banking Financial Companies (NBFCs), draining an estimated ₹300 crore over the past two months. With nearly 150 official complaints filed, the attacks expose critical blind spots in the digital plumbing that connects apps to banks.
According to preliminary investigations cited by The Economic Times, these breaches are not simple phishing scams. They are highly sophisticated, targeted strikes using modern artificial intelligence. Hackers are allegedly studying how lenders process payments and approve loans. Once inside, they use the lender’s own trusted systems to quietly funnel cash out.
Key Highlights at a Glance
- ₹300 Crore Lost: Estimated funds stolen primarily from small-cap NBFCs with annual turnovers under ₹1,000 crore.
- AI Tools Deployed: Attackers reportedly used global hacking platforms like CyberStrike and open-source AI models to speed up intrusions.
- API Weaknesses: Hackers hijacked trusted "whitelisted" connections to bypass loan limits and KYC checks.
How Hackers Stole ₹300 Crore From Small NBFCs
The attackers are hunting the weakest links. They are primarily targeting smaller NBFCs with an annual turnover of ₹1,000 crore or less. These firms often lack the massive IT security budgets of top-tier banks but process high volumes of digital loans daily.
The pace of the attacks is alarming. Sources note that incidents surged over the last six weeks. One Delhi-based NBFC reportedly lost ₹7.5 crore in a primary breach. Just days later, before the firm could fully patch its systems, attackers struck again, siphoning another ₹7.25 crore. This devastating repeat-attack pattern proves that simply stopping a transaction is not enough if the digital back-door remains open.
Complaints are piling up across major financial hubs. Around 30 cases are logged in Mumbai, 25 in Delhi, and 15 in Chennai. However, these figures are just the tip of the iceberg, as single institutions may file multiple First Information Reports (FIRs) as the fraud unfolds.
| Attack Parameter | Reported Impact / Method |
|---|---|
| Total Estimated Losses | ₹300 Crore (Past 2 Months) |
| Target Profile | Mid-to-Small NBFCs (<₹1,000 Cr Turnover) |
| Primary Exploit | Compromised Payment APIs & Whitelisted Servers |
The AI Threat: DeepSeek, Qwen, and CyberStrike
The speed and scale of these attacks point directly to artificial intelligence. According to cybersecurity experts probing the incidents, criminals are deploying advanced toolkits like Artex and the CyberStrike hacking platform. They are also allegedly modifying open-source AI models, including DeepSeek, Alibaba’s Qwen, and Zhipu’s GLM, to map out vulnerabilities.
These AI bots do the heavy lifting. Instead of a human hacker spending weeks manually testing passwords, an AI agent can scan a lender's payment process in just 10 to 12 days. It learns exactly how the NBFC talks to its partner banks and payment gateways.
"Attackers are compromising internet-facing applications, exposed APIs, and privileged system endpoints to steal payment gateway credentials." — CERT-In Advisory CIAD-2026-0046
This is where the real danger lies. Modern digital lending runs on APIs (Application Programming Interfaces). Think of an API as a digital waiter that takes your loan request to the bank’s secure vault. The Indian Computer Emergency Response Team (CERT-In) found that attackers are hijacking these digital waiters. Because the request comes from the lender's own whitelisted (trusted) network, the system assumes it is safe. The hackers bypass crucial checks like loan limits, KYC verifications, and available balances.
While traditional banks focus on locking down massive physical asset portfolios, digital lenders are exposed in the cloud. We are seeing a stark contrast between safe physical asset funding and high-risk digital operations.
Vendor Risk and The Secondary Fraud Wave
The crisis extends far beyond the borders of India. Security analysts note that similar AI toolkits are currently assaulting financial hubs in Japan and South Korea, proving this is a highly coordinated regional threat. But the most alarming part for Indian consumers is what happens after the initial hack.
When hackers steal an NBFC's data, they don't just take the money. They take the borrower’s identity. The secondary fraud wave is arguably worse than the first. Using models like Qwen or Kimi, criminals can instantly generate flawless, perfectly translated phishing scripts in regional languages like Hindi, Marathi, or Tamil.
The hacker calls the borrower, pretending to be a bank agent. Because the hacker knows the exact loan amount and EMI date, the borrower trusts them completely and pays the fake account. This highlights the vital need for strict third-party oversight, especially as digital ecosystems grow larger and more interconnected.
Integration is a double-edged sword. Every time an NBFC connects its loan-management software to a payment aggregator, partner bank, or digital wallet, it creates a new door that must be guarded. If a third-party vendor’s security is weak, the entire NBFC network becomes vulnerable.
What NBFCs Must Do Next: The Regulatory Fix
The Reserve Bank of India (RBI) has laid out strict rules for this exact scenario. The November 2023 Master Direction on IT Governance mandates robust information-security controls for all covered entities, including small NBFCs. Firms can no longer treat cybersecurity as an afterthought.
To survive this wave of AI attacks, lenders must immediately shift their operational priorities. First, they must enforce strict API security. Not every internal server should have the power to disburse funds. Payment credentials must be rotated constantly.
Second, lenders need independent transaction validation. A payment request should never be approved simply because it comes from a "trusted" server. The system must verify the logic: Does this loan exist? Has KYC been completed? Is the amount within the daily limit?
Ultimately, technology is only as strong as the people running it. Human error remains a major factor in these breaches, making internal training an absolute necessity. Strong HR leadership is required to build a culture of security awareness across all departments.
The coming weeks will reveal the true scale of the damage. As authorities trace the stolen ₹300 crore, the pressure is on India's lending ecosystem to fortify its digital borders. Companies must act before the next AI-driven wave hits.
Frequently Asked Questions (FAQs)
Quick answers regarding the recent NBFC cyber fraud wave and its impact on the digital lending sector.
How much money was stolen from Indian NBFCs?
An estimated ₹300 crore has been reportedly siphoned from smaller Indian NBFCs over the past two months. Investigators have tracked approximately 150 complaints linked to these coordinated attacks.
Which financial firms are being targeted?
The attacks primarily target mid-to-small tier Non-Banking Financial Companies (NBFCs) with an annual turnover of ₹1,000 crore or less, exploiting their relatively limited cybersecurity infrastructure.
How are AI tools being used in these bank frauds?
Hackers use AI models like DeepSeek, Qwen, and platforms like CyberStrike to automate network scanning. This allows them to quickly find weak points in payment APIs and execute unauthorized transfers faster than humanly possible.
What is API hijacking in digital lending?
API hijacking occurs when hackers compromise a trusted digital connection within the lender's network. The system thinks the hacker is an authorized user, allowing them to bypass crucial loan limits and KYC checks.
What should consumers do to stay safe?
Consumers must stay alert for suspicious calls or messages regarding their loans. Never share OTPs or passwords, and always verify payment instructions directly through your lender's official app or verified customer care number.
Editorial & Legal Disclaimer: This report is published by News4Bharat for general informational and journalistic purposes only and does not constitute financial, investment, legal, or professional advice. All data, figures, and statements are sourced from public filings, regulatory notifications, and attributed third-party reports believed to be reliable at the time of publication; however, figures marked as approximate, provisional, or reported remain subject to official audit and revision. References to ongoing investigations, disputes, or regulatory actions reflect alleged or preliminary positions unless confirmed by a final judicial or statutory order. Readers are advised to verify details independently with certified professionals or primary regulatory records before making any financial or legal decisions.