Central Bank of India has told the police that ₹ 13.97 crore was siphoned from its settlement account with the Reserve Bank of India (RBI) through 187 unauthorised transfers between October 15 and 17. The bank alleges that unknown persons got into the central SFMS server of Indian Financial Technology and Allied Services (Iftas), a wholly owned RBI subsidiary, through the SFMS server of its core banking system.
SFMS, the Structured Financial Messaging System, carries the payment messages that banks exchange through the RBI’s RTGS and NEFT systems. The complainant is the bank’s general manager (treasury). Nor could it find them in its core banking system, its RTGS settlement account or the SFMS server. In a normal RTGS payment, the complaint stated, the bank enters the customer’s slip in its core banking system and debits the customer’s account. The amount is credited to the bank’s RTGS settlement account. A message then goes from the bank’s SFMS server to Iftas’s central SFMS server, and the amount is debited from the bank’s settlement account with the RBI. The complaint alleges that unknown persons gained unauthorised access to Iftas’s central SFMS through the SFMS server of the bank’s core banking system, and diverted the money from the bank’s account with the RBI. The bank immediately informed the RBI, Iftas, the Daksh portal, the National Critical Information Infrastructure Protection Centre (NCIIPC) and the Indian Computer Emergency Response Team (CERT-In). The police have registered a case of cheating and personation against unknown persons.
The money went into 36 bank accounts, according to the first information report (FIR) registered at the Nodal Cyber Police Station, Mumbai . Six transfers were made on October 15, 88 on October 16 and 93 on October 17, the FIR stated. The bank’s internal team could not find any of the 187 transactions in any branch, in internet or mobile banking, or through any other channel, according to the complaint. Partial traces of 10 of the accounts appear in SFMS database logs, the complaint stated, but the transaction IDs do not appear in the bank’s records. The complaint says the accounts named as payers in the 187 transactions do not belong to Central Bank of India.
A police officer, who asked not to be named, said little was known about the transactions, making it “very difficult to find how the money was siphoned off”. The bank maintains a settlement account with the RBI and a separate RTGS settlement account, and its system has an RTGS portal for such payments, the officer said. It says the fraud cheated the bank and the members of the public whose money is with it.
