Nearly 150 complaints have been filed after attackers spent weeks studying lenders’ systems before exploiting weaknesses in smaller non-banking finance companies.
India’s smaller non-banking financial companies have become the latest target of a wave of cyberfraud that has drained an estimated ₹300 crore from lenders in the past two months, according to people familiar with the matter quoted by ET. Nearly 150 complaints and first information reports have already been filed, and several firms have been hit more than once as attackers intensified their activity over the past six weeks.
The campaign has exposed how vulnerable smaller NBFCs can be when their digital defences are weaker than those of larger peers. According to the Economic Times, the hardest-hit firms were often those with turnover of about ₹1,000 crore or less. Investigators have found that the attackers typically spent 10 to 12 days studying a lender’s payment flows and internal systems before striking, allowing them to exploit gaps in controls and bypass routine checks.
ET reported that the tools behind the fraud included Chinese hacking platforms such as CyberStrike and Artex, alongside open-source AI models including DeepSeek, Alibaba’s Qwen, Moonshot’s Kimi and Zhipu’s GLM. The use of artificial intelligence appears to have made the attacks faster to prepare and harder to detect, with fraudsters relying on social-engineering methods that have been described as “Jamtara-style” scams, a reference to the Indian district that became synonymous with organised online fraud.
The Reserve Bank of India has already set out cybersecurity and technology-risk safeguards for NBFCs under a framework that took effect in April 2024, according to Moneycontrol and other outlets. Cybersecurity agencies are now advising affected lenders to harden their systems while investigations continue, as officials warn that the scale and repetition of the attacks point to a broader operational risk for smaller financial firms.
Disclaimer: This article is intended to inform and educate, not to recommend or endorse any financial product, investment or strategy. Please consider your own financial circumstances and seek professional advice where appropriate before making financial decisions.
