◆ cyber.cashlessconsumer.in
Agentic work Human-supervised AI on Zo Computer ▸ what this means

Everything on this site is agentic cyber work: AI agents running on Zo Computer plan the probes, execute read-only scans, analyse the results and draft the findings — predominantly on GLM 5.3 Flash — the cheapest flash-tier model available, run with Zero Data Retention. A human steers and monitors every stage. No scan runs, no finding is disclosed and no text is published without human review and sign-off.

The machine does the legwork at speed and scale; the intent, the ethics and the accountability are human.

cyber / CBI · SFMS
🛡️ Claim verification · payment-systems incident

₹13.97 crore moved without a sender record

In mid-October 2026, 187 payment instructions moved money out of Central Bank of India's own settlement account at the Reserve Bank of India, to 36 accounts across the banking system. The bank says its systems contain no record of ever sending them — and alleges entry through the central messaging server run by IFTAS, the RBI's wholly-owned technology subsidiary. IFTAS says no system of theirs was compromised. Both cannot be the whole story. We registered the incident, separated the corroborated from the merely claimed, and found a disclosure gap that does not depend on who is right.

All breach verifications
TL;DR — the explainer
  • SFMS is India's domestic SWIFT. Since 2001, every inter-bank RTGS and NEFT payment instruction travels as a structured, PKI-signed message on it. The hub is run by IFTAS, a company wholly owned by the RBI (it took over from IDRBT in 2016).
  • The money itself moves at the RBI. SFMS carries instructions; settlement happens in each bank's account at the RBI. Whoever can get a valid message accepted is the sender, economically — which is why message authenticity is everything.
  • Three sanctioned doors (RTGS Regulations 4.21): the thick-client member interface over INFINET (the closed RBI-promoted network), a bank-gateway Web-API, and a browser PO module for small members — with public-internet access contemplated, so “INFINET-only” needs an asterisk.
  • Every message carries an IDRBT-CA digital certificate, and the certificate rulebook says the key signing certificate belongs on a smart card or hardware token — by design, a stolen password alone should not move money.
  • The gap: no public circular specifically mandates MFA for the SFMS console itself. Member-edge practices are enforced by audit, not by the hub — and how well that works varies by bank.

First, the three systems — a 90-second explainer

1. The settlement account. Every bank keeps a current account with the RBI. When customers of different banks pay each other over RTGS or NEFT, the banks settle among themselves through these accounts. It is the bank's own money — the working float of the payment system — not any customer's deposit.

2. SFMS. The Structured Financial Messaging System is the network that carries payment instructions between Indian banks — the domestic equivalent of SWIFT, in service since 2001, ISO 20022-based, carrying RTGS, NEFT, letters of credit and bank guarantees. Every bank runs its own SFMS server wired into its core banking system, and all of them connect to one central SFMS server.

3. IFTAS. The Indian Financial Technology and Allied Services — a Section 8 company incorporated 2015, which took over SFMS, INFINET and the banking community cloud from IDRBT on 1 April 2016, and has been wholly owned by the RBI since March 2019. The messaging backbone of Indian bank-to-bank payments is run by the central bank's own subsidiary.

The alleged fraud, in one sentence: messages appeared on this network saying "pay from Central Bank of India's settlement account", the money moved — and the bank's own systems show no record of ever having composed or sent those messages.

Doors and keys — what the rulebook actually requires

The complaint turns on one question: how hard is it, by design, to compose a payment message on a member connection? The governing documents are public, so we read them: the RTGS System Regulations v1.0 (Oct 2024), the certificate rulebook of IDRBT-CA — the RBI-promoted authority whose digital certificates sign every SFMS message — and the RBI circular that defines INFINET and SFMS membership as the entry ticket to payment systems. How that door is kept in practice at a member bank is a question for evidence, not rulebook — we put what one bank's real internal documentation shows in the Analysis tab. (That documentation comes from our separate Bank of Baroda leak verification; not the accused bank.)

Three documented doors into RTGS

Regulation 4.21 of the RTGS Regulations v1.0 defines how members reach the system. There are three access channels, not one:

  • Thick-client / member-interface members connect over a dedicated, RBI-approved telecom medium — in practice INFINET, the closed financial network built by IDRBT and now run by IFTAS.
  • Web / REST-API members connect through their own bank gateway — the core-banking-to-SFMS bridge.
  • The "PO" module is browser-based, for members averaging 100 or fewer RTGS payments a day — and the rulebook contemplates public-internet access for it, under conditions the Bank is to prescribe.

So "INFINET-only" needs a qualification. All three channels ride INFINET or any other network the Bank approves; the closed financial network is the default, but the rulebook itself carries an internet door. What the rulebook does not publish is which member uses which door.

The keys: every message carries a certificate

SFMS is PKI-protected. Each message is signed with a digital certificate from IDRBT-CA (a licensed Certifying Authority since 2002). Its published Certification Practice Statement v3.2 (2012) defines Class 2 certificates for individuals and Class 3 for individuals and servers — the latter requiring physical appearance before a Registration Authority. For the System Certificate — the machine identity authenticating a bank gateway to the hub — §2.12.3 says the private key should be held in a secure token or smart card, with a hardware security module recommended for applications processing high-value transactions. In the designed model, sending a payment instruction requires a physical key object bound to a verified identity. A stolen password alone should not be enough — where that model is actually enforced.

What the rulebook does not say

  • There is no public circular that specifically mandates multi-factor authentication for SFMS console logins — as of 26 Oct 2026 we found none. Annex 10 of the RTGS Regulations (Oct 2024) does require MFA for "users, applications, systems", a ban on internet-facing critical systems, and patch currency — but as generic participant duties, audited annually, not as product rules.
  • There is no public register of which member bank uses which access channel, and no published MFA standard for the SFMS console itself.
  • Certificate practice is set by a document from 2012 (CPS v3.2); what banks do inside their estates is their own affair until an audit says otherwise.

If you bank with Central Bank of India — or anywhere

  • No customer lost a rupee. This was the bank's own settlement float, not deposits. Your account and your money are not what was attacked.
  • Don't conflate this with the SBI story. SBI the same week confirmed ~3,897 customer records found on the dark web — a data-leak incident, a different failure class. Two state-owned banks, two different things, one confusing news cycle.
  • Expect phishing riding the headlines. "Your RTGS failed", "your account is part of the bank fraud", "re-verify your KYC" — the bank will never ask for credentials or OTPs by call, SMS or link. Verify only through the official app or the number printed on your passbook. Report attempts to 1930 or cybercrime.gov.in.
  • The systemic question is the regulator's to answer: if instructions can appear on the messaging network without a sender record anywhere, could the same be done from any other bank's server? SFMS carries lakhs of crores a day. That question deserves a public answer, not a two-party blame standoff.

The incident itself — what the police complaint says, our verification verdicts, the disclosure gap, one bank’s estate documentation, and method & sources — is in the Analysis tab.