Central Bank of India has told the police that ₹13.97 crore was siphoned from its settlement account with the Reserve Bank of India (RBI) through 187 unauthorised transfers between October 15 and 17. The bank alleges that unknown persons got into the central SFMS server of Indian Financial Technology and Allied Services (Iftas), a wholly owned RBI subsidiary, through the SFMS server of its core banking system.
SFMS, the Structured Financial Messaging System, carries the payment messages that banks exchange through the RBI’s RTGS and NEFT systems.
The money went into 36 bank accounts, according to the first information report (FIR) registered at the Nodal Cyber Police Station, Mumbai. The complainant is the bank’s general manager (treasury).
Deep Dive
How were the 187 unauthorised transfers from Central Bank of India allegedly made?
Why could Central Bank of India not trace the unauthorised transactions in its records?
What should customers do to reduce the risk of fraud after a banking cyber incident?
Six transfers were made on October 15, 88 on October 16 and 93 on October 17, the FIR stated.
According to the complaint, the bank’s internal team could not find any of the 187 transactions in any branch, in internet or mobile banking, or through any other channel.
Also Read | ₹95k to ex-staffer">Mohali: Consumer panel directs Central Bank to refund ₹95k to ex-staffer
Nor could it find them in its core banking system, its RTGS settlement account or the SFMS server. Partial traces of 10 of the accounts appear in SFMS database logs, the complaint stated, but the transaction IDs do not appear in the bank’s records.
{{/usCountry}}Nor could it find them in its core banking system, its RTGS settlement account or the SFMS server. Partial traces of 10 of the accounts appear in SFMS database logs, the complaint stated, but the transaction IDs do not appear in the bank’s records.
{{/usCountry}}A police officer, who asked not to be named, said little was known about the transactions, making it “very difficult to find how the money was siphoned off”.
The complaint says the accounts named as payers in the 187 transactions do not belong to Central Bank of India.
The bank maintains a settlement account with the RBI and a separate RTGS settlement account, and its system has an RTGS portal for such payments, the officer said.
Also Read | Nirmala Sitharaman urges regulators to speed up refunds of unclaimed bank deposits, shares and funds
In a normal RTGS payment, the complaint stated, the bank enters the customer’s slip in its core banking system and debits the customer’s account. The amount is credited to the bank’s RTGS settlement account.
A message then goes from the bank’s SFMS server to Iftas’s central SFMS server, and the amount is debited from the bank’s settlement account with the RBI.
The complaint alleges that unknown persons gained unauthorised access to Iftas’s central SFMS through the SFMS server of the bank’s core banking system, and diverted the money from the bank’s account with the RBI.
It says the fraud cheated the bank and the members of the public whose money is with it.
Also Read | RBI raises repo rate by 25 points in first hike in four years, loan EMIs may rise
The bank immediately informed the RBI, Iftas, the Daksh portal, the National Critical Information Infrastructure Protection Centre (NCIIPC) and the Indian Computer Emergency Response Team (CERT-In).
The police have registered a case of cheating and personation against unknown persons.