Imagine waking up to find ₹14 crore missing from your bank account. Now imagine that bank is Central Bank of India, and the money disappeared from its settlement account with the Reserve Bank of India (RBI) itself. That's exactly what happened between October 15 and 17, 2026, when 187 unauthorized transfers siphoned off ₹13.96–13.97 crore to accounts across 36 different banks.
The weirdest part? The bank's own systems show no record of these transactions ever happening.
Here's the timeline. On October 15, six transfers went out. The next day, 88 more followed. On October 17, another 93 transfers left the building. The money flowed from Central Bank of India's RBI settlement account to beneficiary accounts at 36 different banks. The bank's General Manager (Treasury) filed a complaint with Maharashtra Cyber Police on October 22, and a case was registered against unidentified persons.
When the bank's internal team went looking for these transactions, they found nothing. No entries in branch records. No traces in internet or mobile banking. Nothing in the core banking system. No records in the RTGS settlement account. The SFMS (Structuredured Financial Messaging System) server came up blank too.
Only partial traces of 10 accounts appeared in SFMS database logs, and even those didn't match the bank's transaction IDs. The accounts named as payers in these transactions don't even belong to Central Bank of India.
The bank's complaint alleges something concerning: unknown persons gained unauthorized access to the Central SFMS server of Indian Financial Technology and Allied Services (IFTAS), an RBI subsidiary, through the SFMS server of Central Bank of India's core banking system.
IFTAS operates critical infrastructure. It runs SFMS, the messaging system that carries payment messages between banks through the RBI's RTGS and NEFT systems. It also manages INFINET, a closed user group network for the banking sector. If someone compromised this messaging layer, they could theoretically inject payment instructions that look legitimate but never passed through a bank's normal processing channels.
Here's the thing: this is just an allegation in the FIR. The actual entry point—whether it was Central Bank of India's server, IFTAS's central systems, or something else entirely—has not been established by any investigation yet.
Let's put this in perspective.
On capital adequacy, the bank reported a total CRAR (Capital to Risk-weighted Assets Ratio) of 18.28% as of June 2026, comfortably above regulatory requirements. Even if the entire amount were written off with no recovery, it would barely move the needle—perhaps 0.01 percentage point or less on CRAR. Investor Presentation +1
Liquidity coverage ratio (LCR) sat around 156% in June 2026, down from over 210% a year earlier but still well above minimum requirements. An outflow of this size over three days is immaterial to liquidity metrics. Transcript
The filing doesn't quantify any impact on profit, net worth, or capital ratios. Other
How do 187 transfers over three days go unnoticed? The bank did detect the irregularities during internal examination—that's how they found the problem. The issue is that their own systems recorded nothing.
In a normal RTGS payment, the bank enters the customer's slip in its core banking system, debits the customer's account, and credits its RTGS settlement account. A message then goes from the bank's SFMS server to IFTAS's central SFMS server, and the RBI settlement account is debited.
If these unauthorized messages bypassed the bank's core systems entirely, monitoring tools that rely on internal transaction records would have had nothing to flag. The money left the RBI account without corresponding internal entries.
This raises questions about reconciliation practices. How often does the bank compare its RBI settlement account statement against internal ledgers? Were there alerts on unusual outflows from the settlement account? These details haven't been disclosed.
Recovering funds from 36 different banks is complicated. Police are tracing beneficiary accounts and examining the movement of funds. But here's the reality: banks cannot unilaterally reverse completed RTGS credits to other banks' customers.
The general process involves police tracing the money, placing liens or freezes on accounts connected to the offence under Section 106 of the BNSS (Bharatiya Nagarik Suraksha Sanhita, 2023), and seeking magistrate orders for attachment under Section 107. Funds are then returned to the victim through court orders.
With 36 recipient banks, coordination becomes a nightmare. Each bank must be asked separately to trace, hold, and report on beneficiary accounts. Funds may have already moved onward through layered transaction chains. Courts have emphasized that freezes should be proportionate—liens on specific disputed amounts rather than blanket account freezes.
No recovery steps, freezes, or timelines have been reported for this specific case yet.
This matters because SFMS is a shared messaging layer for RTGS and NEFT. A flaw in this infrastructure could in principle affect many banks. Whether this incident reveals such a flaw depends entirely on the forensic findings.
The RBI's recent notifications through October 2026 don't mention this incident. Any regulatory scrutiny of SFMS security protocols across other banks using IFTAS infrastructure remains speculative at this point.
The bank says root-cause analysis and corrective measures are underway. External experts are supporting the investigation. Police are examining suspected unauthorized access to the messaging system and tracing beneficiary accounts. Other
For the broader banking system, this incident will likely prompt closer examination of how banks secure their SFMS interfaces and reconcile RBI settlement accounts. Independent reconciliation of settlement account statements, tighter controls on messaging endpoints, and tamper-resistant logging are standard practices that may come under scrutiny.
The ₹13.97 crore loss itself is financially immaterial for a bank of this size. But the questions it raises about the integrity of India's payment messaging infrastructure are anything but small.
Markets are closed for the weekend. When trading resumes on Monday, investors will be watching not just the numbers, but what this incident reveals about vulnerabilities in the systems that move money across India's banking system.
