Telangana Cyber Security Bureau Tells NBFCs to Stop Fraud at Source, Not Just Report It

Fraudsters are studying smaller NBFCs' internal processes for 10 to 12 days before exploiting whitelisted IDs and payment API credentials, the Telangana Cyber Security Bureau said on Thursday, after meeting lenders, fintech platforms, banks and regulators. The New Indian Express reported the bureau's advice to stop fraud at source rather than only report it.

Inside the TGCSB Warning to Lenders

The Telangana Cyber Security Bureau is a Hyderabad-based Government of Telangana law enforcement agency constituted in 2025 that investigates cybercrime and runs the National Cyber Crime Reporting Portal, helpline 1930 and the Vyuha Labs innovation hub with IIIT Hyderabad. Its officials said attackers identify vulnerabilities in payment systems and use stolen credentials from trusted servers to gain unauthorised access. Automated scripts then trigger fraudulent payouts outside normal batch windows, split transfers into smaller amounts to evade alerts and move funds into mule accounts.

The meeting followed AI-assisted cyberattacks on NBFC payment and loan disbursement systems across the country, and drew NBFCs, fintech platforms, banks, the Department of Telecommunications and the Reserve Bank of India. TGCSB Director Shikha Goel said institutions must prevent fraud at source rather than merely report it. "The priority must be to prevent fraudulent transactions at the source, detect suspicious activities in real time and disrupt the movement of funds through mule accounts. Don't just report fraud — stop it at the source," she said.

The bureau advised regular vulnerability assessments and penetration tests, secured payment APIs and real-time fraud detection with transaction velocity checks and limits. On detecting an attack, institutions should switch to manual operations, shut down automated loan disbursement systems, ask banks to freeze the accounts and clear pending API calls. Automated operations should resume only after cybersecurity experts have tested the systems and fixed vulnerabilities.

Institutions were also asked to report suspected fraud on 1930 or www.cybercrime.gov.in, alert beneficiary banks and I4C, report cyber incidents to CERT-In within six hours and notify the RBI through the DAKSH portal wherever applicable. They should keep records of all high-risk payouts.

TGCSB's Recovery Record

According to akta.pro company records, the bureau recovered ₹212 crore from ₹1,235 crore lost to cyber fraud in 2025. The same records show ₹85.2 lakh frozen and recovered in full from a suspect's IDFC First Bank account in a digital arrest fraud case, and 45 individuals rescued from Myanmar scam operations through coordinated efforts with the Myanmar Army and Indian authorities.

Earlier Warnings and Losses

The Hindu reported on November 12, 2026 that the bureau warned NBFCs, fintech firms and banks about AI-assisted cyberattacks targeting payment systems and loan disbursement platforms. Deccan Chronicle reported on November 1, 2026 that cybercrime-related financial losses in Telangana fell 20.2% to ₹881.72 crore in the first nine months of 2026 from ₹1,104.42 crore in 2025, a drop the bureau attributed to its October awareness campaign reaching 15.48 million citizens. The Hindu reported on September 30, 2026 that Goel said nearly 60% of cybercrime losses in Telangana stem from stock-trading and investment frauds, with ₹455 crore recovered over two years.

What the Bureau Asked For Next

TGCSB asked institutions to report suspected fraud on 1930 or www.cybercrime.gov.in, alert beneficiary banks and I4C, and notify the RBI through the DAKSH portal wherever applicable.