Plug cyber loopholes before fraudsters strike: Shikha Goel

Hyderabad: Telangana Cyber Security Bureau Director Shikha Goel on Thursday directed Non-Banking Financial Companies and FinTech firms to implement proactive measures to prevent cybercrime incidents rather than merely reacting after frauds occur.

In view of a recent series of Artificial Intelligence assisted cyber attacks targeting payment and loan disbursement systems of NBFCs nationwide, the bureau convened an urgent coordination meeting with representatives from NBFCs, FinTech platforms, banks, the Department of Telecommunications, and the Reserve Bank of India at its Hyderabad headquarters on Thursday.

Addressing the stakeholders, Shikha Goel emphasised that the responsibility of financial institutions must extend beyond post-incident fraud reporting. She urged firms to prioritise preventing fraudulent transactions directly at the source, detecting suspicious activities in real time, and disrupting illicit fund movements through mule accounts.

Explaining the modus operandi observed nationwide, Goel noted that fraudsters specifically target smaller NBFCs possessing weaker cybersecurity frameworks. Attackers spend roughly 10 to 12 days studying internal operational processes and payment infrastructure, identifying whitelisted identities, payment Application Programming Interface credentials, and underlying software code vulnerabilities.

Once inside, cybercriminals exploit these weaknesses to gain unauthorised access, operating stolen credentials from trusted servers so malicious payout requests appear completely genuine. Automated scripts subsequently trigger payout transfers outside regular batch windows, repeatedly splitting funds into smaller denominations to bypass conventional fraud alert thresholds. The siphoned money is rapidly transferred via automated bulk transactions into layered mule accounts before security teams can intervene. To counter this threat, TGCSB advised financial institutions to conduct regular Vulnerability Assessment and Penetration Testing, fortify payment and disbursement APIs, and deploy real-time fraud detection alongside velocity checks and strict transaction limits.

In the event of an active breach, Goel instructed institutions to immediately switch to manual operations by shutting down automated loan disbursement software, requesting partner banks to freeze disbursement accounts, and clearing pending API calls. Systems should only be restarted after qualified cybersecurity specialists thoroughly test the infrastructure and patch every identified vulnerability.

ABOUT THE AUTHOR

The Hans India