India’s smaller non-banking financial companies (NBFCs) are emerging as the soft underbelly of the country’s digital lending and payments ecosystem. An estimated ₹300 crore has been siphoned from NBFCs, largely smaller lenders, through cyberattacks over roughly the past two months, with close to 150 complaints and first information reports (FIRs) already filed, according to a report in The Economic Times on 29 October 2026 that cited officials and people familiar with the investigations.
The figure is an estimate attributed to sources; a consolidated official assessment of the losses and the number of institutions affected has not been made public.
Repeat attacks on weaker defences
According to the report, the attacks have become far more frequent over the last six weeks, and some lenders have been hit more than once. In one case, a Delhi-based NBFC is said to have lost ₹7.5 crore in an initial breach and a further ₹7.25 crore only days later.
Most of the affected entities are NBFCs with an annual turnover of around ₹1,000 crore or less, where investigators have found gaps in cybersecurity infrastructure, audit cycles and controls. About 30 complaints have reportedly been registered in Mumbai, more than 25 in Delhi and 15 to 16 in Chennai, with further cases from other cities. India had 8,502 NBFCs registered with the Reserve Bank of India as of 15 October, underlining how wide the exposure could be.
Officials quoted in the report said attackers typically study a target for 10 to 12 days, mapping how payments are made, which IDs are whitelisted and where weaknesses sit in application code, before moving funds out.
AI toolkits lower the barrier for fraudsters
Where probes have been completed, agencies have reportedly traced the attacks to a Chinese hacking platform called CyberStrike. Experts cited by ET said AI toolkits such as Artex and CyberStrike, paired with open-source large language models, are putting attack techniques that are not especially sophisticated within easy reach of fraudsters. Officials warned this could pave the way for “Jamtara-style” social engineering, in which callers armed with a borrower’s name, lender and loan amount can sound entirely legitimate.
Industry voices echoed the concern. Mandar Patil, Executive Vice President at cyber intelligence firm Cyble, advised affected firms to warn customers before phishing calls begin. Manish Mimani, Founder and CEO of Protectt.ai, said such tools make it easier to generate targeted lures, clone mobile apps or payment flows, and combine social engineering with technical exploits at scale.
CERT-In has already sounded the alarm
On 9 October, the Indian Computer Emergency Response Team (CERT-In), together with CSIRT-Fin, issued a critical advisory flagging multiple campaigns against NBFCs, digital lenders, fintech companies and payment service providers. The advisory said attackers were exploiting vulnerabilities in applications and payment APIs, stealing banking credentials and pushing unauthorised fund transfers through infrastructure that financial institutions already trust. It recommended disabling compromised APIs, rotating credentials, enforcing multi-factor authentication and maker-checker approvals, and tightening transaction monitoring.
CERT-In has also said that AI-driven attack frameworks have shrunk the time between initial intrusion and financial damage from days to hours, and that organisations that did not fully patch weaknesses were attacked again within days.
Why it matters for fintech and digital lending
Smaller NBFCs are deeply wired into India’s digital credit stack, from co-lending and lending service provider partnerships to UPI-led collections and API-based disbursals. The RBI’s IT governance directions, effective April 2024, already require NBFCs in the middle, upper and top layers to maintain information-security controls, audits and business-continuity arrangements. The latest spate of losses is likely to sharpen scrutiny of how consistently those controls are applied, particularly at smaller lenders, and to accelerate demand for API security, fraud analytics and real-time transaction monitoring across the fintech ecosystem.
Source inputs: The Economic Times, Moneycontrol, CERT-In advisory.
