Cybercrime is becoming an increasing concern for India's financial sector, with reports indicating that non-banking financial companies (NBFCs) have suffered losses of approximately ₹300 crore over two months. According to a report by The Economic Times, nearly 150 complaints or FIRs have been filed in connection with these alleged attacks.

The incidents have raised concerns about the cybersecurity preparedness of smaller financial institutions. Investigators are examining the possible use of artificial intelligence (AI) tools and hacking platforms in some cases, highlighting how emerging technologies can make cyberattacks easier to carry out.

The reported incidents also serve as a warning that financial fraud is no longer limited to fake links, stolen OTPs or deceptive phone calls. Criminals may exploit weaknesses in computer systems, misuse personal information and manipulate employees or customers to gain access to money.

How Did the Reported ₹300 Crore Fraud Take Place?

According to the report, several smaller NBFCs were targeted by cybercriminals who allegedly exploited technical vulnerabilities in their systems to divert funds.

One reported case involved an NBFC in Delhi that was attacked twice within a short period. The first incident allegedly resulted in a loss of around ₹7.5 crore, while the second caused a further loss of approximately ₹7.25 crore. The combined reported loss for the company was around ₹14.75 crore.

Investigations into several incidents are ongoing. Therefore, the precise methods used in every case and the identities of all those responsible have not been conclusively established.

Smaller financial institutions may face additional challenges when maintaining cybersecurity infrastructure, particularly if they lack sufficient technical expertise, regular security audits or adequate monitoring systems.

Are AI Tools Making Cybercrime Easier?

The reported investigation has drawn attention to hacking platforms and AI-assisted tools that may help criminals identify vulnerabilities, automate certain tasks and create convincing fraudulent communications.

Sources cited in the report have referred to platforms and tools including CyberStrike and Artex, along with AI models such as DeepSeek, Qwen, Kimi and GLM. Their alleged involvement and the role of each tool require careful assessment as investigations continue.

AI itself is not inherently malicious. These technologies have legitimate uses in software development, research and cybersecurity. However, criminals can misuse similar capabilities to make attacks more efficient or personalise scams.

For example, AI can help fraudsters produce convincing messages in different languages, imitate professional communication styles and create scripts for impersonation calls. When combined with stolen personal information, these techniques can make fraudulent requests appear genuine.

The technology does not necessarily make every attack technically sophisticated. In some cases, weak security controls, poor password practices and inadequate verification procedures may be enough for criminals to exploit an organisation.

How Cybercriminals Study Their Targets

According to officials quoted in the report, attackers may observe a financial company's operations before attempting to exploit its systems. This can involve identifying how payments are processed, examining exposed digital services and searching for security weaknesses.

Once a vulnerability is identified, criminals may attempt to gain unauthorised access, manipulate transactions or steal sensitive information.

Such attacks can be particularly damaging when organisations have not updated their software, secured access credentials or established effective systems for detecting unusual transactions.

Cybersecurity experts therefore emphasise the importance of regular security assessments, timely software updates, strong access controls and continuous monitoring. Companies should also have clear procedures for responding to suspected breaches and informing affected customers.

Cyber Fraud Targets People of Different Ages

Cybercrime does not affect only one age group. Fraudsters often adapt their tactics to exploit the circumstances and concerns of their targets.

Young adults may encounter fake shopping advertisements, fraudulent job offers and investment schemes promising quick returns. Working professionals may be approached with misleading stock market tips, cryptocurrency opportunities or counterfeit business proposals.

Older people may face scams involving alleged legal trouble, family emergencies or threats from individuals pretending to represent government agencies.

One particularly alarming method is the so-called digital arrest scam. Criminals impersonate police officers, investigators or other officials and claim that the victim is connected to a criminal case. They may use video calls, fabricated documents and threats of immediate arrest to pressure the victim into transferring money.

In reality, law enforcement agencies do not conduct legitimate arrests through video calls or require people to transfer money to prove their innocence.

Cybersecurity Concerns Extend Beyond India

The report also refers to a cyberattack involving a loan inquiry service in South Korea. According to cybersecurity firm Cyble, an attacker allegedly stole data and attempted to determine how the information could be sold.

Stolen loan details and personal information can be misused to make fraudulent calls more convincing. If a criminal knows a person's name, lending institution or loan amount, the victim may mistakenly believe the caller represents a legitimate financial organisation.

Cybersecurity professionals have consequently urged companies to alert customers when their information may have been exposed. Early warnings can help people recognise suspicious calls, messages and requests for payment.

SBI and CERT-In Highlight the Need for Vigilance

The report also mentions an advisory issued by the State Bank of India following the reported exposure of a dataset containing approximately 375,000 records on the dark web.

India's Computer Emergency Response Team, known as CERT-In, has highlighted concerns about increasingly coordinated attacks and the speed at which vulnerabilities can be exploited.

When organisations fail to address known security weaknesses, attackers may return repeatedly and cause further damage. Financial institutions therefore need to prioritise security alerts, conduct penetration testing and ensure that critical vulnerabilities are addressed promptly.

Banks and NBFCs should also prepare incident-response plans that clearly identify who is responsible for containing an attack, protecting customer data and communicating with regulators and affected individuals.

How Can Customers Protect Themselves?

Although companies are responsible for securing their systems, customers can also take precautions to reduce their exposure to cyber fraud.

• Never share your OTP, UPI PIN, passwords or banking credentials with callers.

• Verify the identity of anyone claiming to represent a bank, police department or government agency.

• Avoid transferring money under pressure or in response to threats of arrest.

• Do not trust investment offers that promise guaranteed or unusually high returns.

• Use strong, unique passwords and enable multifactor authentication wherever available.

• Keep your phone, computer and applications updated.

• Contact your bank through its official website, application or verified helpline if you receive a suspicious request.

If you suspect that money has been stolen, contact your bank immediately and report the incident through India's cybercrime helpline at 1930 or the official portal, cybercrime.gov.in.

Why Stronger Cybersecurity Is Essential for Financial Companies

The reported attacks underline the importance of treating cybersecurity as a core business requirement rather than an occasional technical exercise.

Financial companies need regular security audits, secure software development practices, employee training, transaction monitoring and effective backup systems. They should also assess third-party service providers and restrict access to sensitive information according to employees' responsibilities.

Artificial intelligence can help defenders identify suspicious activity and analyse threats, but it must be supported by sound security practices and human oversight.

As India's financial services become increasingly digital, protecting customer funds and personal information will require continued investment in technology, trained professionals and rapid incident response. The reported losses are a reminder that even a single weakness can have serious financial consequences when exploited by organised cybercriminals.