India's non-banking financial companies (NBFCs) are facing an alarming wave of AI-enabled cyberattacks, with an estimated ₹300 crore reportedly stolen from predominantly smaller lenders within two months, according to The Economic Times. The incidents expose vulnerabilities in financial institutions' digital infrastructure.
In one particularly concerning case, a Delhi-based lender reportedly lost ₹7.5 crore in a cyberattack, followed by another ₹7.25 crore just days later. The repeated breach raises serious questions about incident containment, recovery procedures and continuous security monitoring.
Key Takeaways
-
₹300 crore exposure: Reported losses highlight escalating cyber risks across smaller NBFCs.
-
Repeat attacks: Two reported losses at one lender expose potential weaknesses in post-incident containment.
-
AI-enabled reconnaissance: Attackers can use automation to study payment workflows and trusted identities.
-
Continuous authentication: Identity, device and transaction verification must extend beyond initial login.
-
Security investment: Smaller lenders need stronger monitoring, rapid incident response and transaction-level fraud controls.
Cybercriminals are reportedly studying lenders' payment processes, trusted identities, software vulnerabilities and transaction workflows before launching attacks. Rather than relying solely on conventional hacking techniques, attackers seek to exploit legitimate business operations to execute fraudulent transfers.
Artificial intelligence potentially amplifies these threats by accelerating reconnaissance, identifying weaknesses and enabling highly customized attacks. Smaller NBFCs are particularly vulnerable because limited cybersecurity budgets, fragmented systems and inadequate monitoring can create opportunities for sophisticated fraud.
The repeated financial losses highlight a critical weakness in conventional incident response. Blocking one fraudulent transaction does not guarantee recovery when compromised credentials, malicious access or underlying vulnerabilities remain undetected.
Financial institutions must strengthen identity verification, transaction authentication, behavioral analytics and real-time anomaly detection. Zero-trust architecture, independent payment approvals and continuous monitoring are essential to prevent unauthorized transactions and contain recurring attacks.
The larger warning is that cybercriminals are increasingly targeting business processes, not merely technology systems. As AI lowers the cost of sophisticated attacks, NBFCs must move from reactive cybersecurity toward continuous digital trust verification, stronger governance and resilient fraud-prevention frameworks.
