What is alleged
The Central Bank of India has told the Nodal Cyber Police Station in Mumbai that 187 unauthorised transfers moved Rs 13.97 crore out of its settlement account with the Reserve Bank of India between 15 and 17 October 2026, according to MediaNama's summary of a Hindustan Times report. Six transfers happened on 15 October, 88 on 16 October and 93 on 17 October. The money reportedly went to 36 recipients. Police have registered a case against unknown persons for cheating and personation. The Hindustan Times figure is reported as Rs 13.96 crore, so the exact total should be treated as approximate until the bank or the police publish a reconciled number.
The bank's complaint describes the normal flow for a Real Time Gross Settlement (RTGS) payment. The customer's account is debited in the core banking system. A message then goes from the bank's own Structured Financial Messaging System (SFMS) server to the central SFMS server run by IFTAS, an RBI subsidiary, and on to the bank's RBI settlement account. The complaint alleges that unknown persons used the bank's SFMS server to reach IFTAS's central server and route the money out.
IFTAS disputes that. It says there is no compromise of any system it manages and calls SFMS safe and secure. The bank's own clarification note, as reported, points to a technical issue in its RTGS interface environment, says no customer accounts were affected and says its core banking system remains secure. The bank has informed the RBI, NCIIPC and CERT-In. None of those bodies has said anything publicly, according to the MediaNama report.
So the central question, whether the weakness sat inside the bank's perimeter or the shared infrastructure, is unresolved. Everything below should be read with that caveat.
The strongest case for tougher rules
The argument for stronger mandates is serious. A settlement account sits at the base of the payments system. A shared messaging network connects every bank to it, so one weak endpoint can become a path to central money. Reports also say that ten accounts appeared in SFMS logs without matching transaction IDs in the bank's records, and that the payer accounts listed did not belong to the bank. If true, ordinary reconciliation did not catch the activity for at least three days. A regulator could reasonably say that voluntary good practice is not enough here and that prescriptive, uniform controls on every connected institution are justified.
Why the rules already exist
The difficulty with that argument is that India already has most of the mandates it needs. The RBI's Master Direction on Digital Payment Security Controls, dated 18 February 2021, requires board-approved payment security policies, vulnerability assessments at least half-yearly, penetration tests at least yearly, rule-based fraud monitoring and alerts, and reconciliation of digital transactions in real time or near real time, and no later than 24 hours after settlement files are received. Those requirements are written mainly around customer-facing channels. Whether they reach a bank's interbank messaging gateway as directly as they reach its mobile app is a question this incident raises.
Incident reporting is also covered. CERT-In's directions of 28 April 2022, issued under section 70B(6) of the Information Technology Act, 2000, require covered entities to report cyber incidents within six hours of noticing them and to keep system logs for a rolling 180 days, as secondary summaries of the directions describe them. The RBI also runs DAKSH, launched on 6 October 2022, which it describes as covering cyber incident reporting and analysis for supervised entities. By its own account, the bank used these channels.
The gap, then, is not a missing law. It is the lack of any public, structured account of what happened. Two institutions are giving incompatible descriptions of the same event, and the public has no neutral technical finding to test either one against.
What a proportionate response looks like
The temptation after an incident like this is to add controls to every institution. That would raise compliance costs for hundreds of banks, cooperative banks and fintechs, and it might not touch the specific failure. A proportionate response would be narrower.
- A joint forensic finding. A neutral review, with CERT-In and the RBI both participating, should establish whether the entry point was the bank's SFMS server, the IFTAS central server, or credentials and configuration on the bank's side. Because the RBI both supervises banks and owns IFTAS, an independent technical reviewer would make the result more credible.
- A published summary. A short public postmortem that omits exploitable detail would let other banks check their own SFMS and RTGS interface environments. Without it, every connected institution has to guess whether it shares the weakness.
- Targeted controls at the gateway. Transaction-level anomaly detection on settlement messages, such as sudden bursts from one account to many new beneficiaries, is cheaper and more specific than blanket mandates. The reported ramp from six transfers to 88 and then 93 over three days is exactly the pattern such rules are meant to catch.
- Reconciliation that runs against the central ledger. The missing transaction IDs reportedly seen in the SFMS logs suggest that comparing the bank's records with the central record should happen sooner and be checked more often.
None of this needs new legislation. It needs the RBI and CERT-In to use the powers they already have, and to be open about what they find.
The innovation stake
India's digital payments infrastructure is a competitive advantage, and trust in it is the asset at risk. If the response is secrecy, with each side defending its perimeter and no findings published, the damage is larger than Rs 13.97 crore. The cost of that damage is paid by every bank and fintech that depends on the same rails. If the response is evidence-led, a fair finding in either direction helps. If the fault was in the bank's configuration, other banks can fix theirs. If it was in shared infrastructure, the operator can patch it before a bigger event.
The bank, IFTAS and the RBI should resolve the factual dispute first, and regulators should then decide whether any rule truly needs to change. Legislating ahead of the facts would be the wrong order.