Indian small non-banking finance companies are facing one of their sharpest cyber shocks in recent memory, with attackers using AI-enabled tools to exploit weak digital controls and siphon an estimated ₹300 crore in just two months. The scale of the losses, coupled with roughly 150 reported fraud cases, has raised alarm across the financial services ecosystem and intensified scrutiny of the methods, infrastructure and cross-border networks behind the attacks.
Attackers Exploit Weak Links
The pattern emerging from the incidents suggests that cybercriminals are not relying on one-off intrusions but on persistent, industrialised campaigns designed to identify and exploit operational weaknesses in smaller lenders. These NBFCs, many of which serve vehicle finance, EV financing and mobility-linked lending segments, often operate with leaner technology budgets than large banks and may have uneven cybersecurity maturity across branches, vendors and digital channels.
That gap appears to have been central to the losses. Attackers have reportedly targeted vulnerable systems, manipulated workflows and used automated techniques to scale fraud attempts rapidly. The involvement of AI toolkits has made the threat more difficult to contain, allowing criminals to refine phishing lures, automate reconnaissance and adapt attack patterns faster than traditional security teams can respond.
Industry observers say the attacks are not random. Instead, they appear to be coordinated, repeated and opportunistic, with fraudsters probing for weak authentication, poor access controls and gaps in transaction monitoring. In a sector where speed of disbursal is commercially important, such weaknesses can be costly. Once inside a system, attackers can move quickly to divert funds, alter records or impersonate legitimate users.
Chinese Platforms Under Scrutiny
Attention has now shifted to the possible use of Chinese hacking platforms and AI-enabled cybercrime toolkits, which investigators believe may be helping attackers lower the technical barrier to sophisticated fraud. While attribution remains complex and often slow, the growing focus on these platforms reflects a broader concern: cybercrime is becoming more accessible, more scalable and more commercially organised.
The use of such tools does not necessarily mean a single actor or group is behind every incident. But it does indicate that Indian financial institutions are confronting a more advanced threat environment, where ready-made malicious infrastructure can be rented, repurposed or deployed by multiple actors. That makes defense harder, because the same toolkit can be used across different campaigns, geographies and targets.
For NBFCs tied to automotive finance and the fast-growing EV ecosystem, the implications are significant. These lenders are central to vehicle purchases, fleet expansion and mobility financing, and any sustained disruption can affect disbursals, collections and customer confidence. The sector's digital expansion has improved reach and efficiency, but it has also widened the attack surface.
Urgent Call For Defences
The losses have triggered urgent calls for NBFCs to strengthen cybersecurity frameworks before the next wave of attacks lands. Experts say the immediate priorities should include tighter identity verification, stronger endpoint protection, continuous monitoring of suspicious transactions and more rigorous vendor oversight. Regular security audits, employee training and incident-response drills are also being viewed as essential rather than optional.
Beyond technical controls, lenders are being warned to treat cyber risk as a board-level issue. Smaller finance companies often focus heavily on credit risk, liquidity and asset quality, but the recent attacks show that operational resilience is now equally critical. A single breach can interrupt lending operations, damage customer trust and trigger regulatory scrutiny, all while causing direct financial losses.
The episode also underscores a larger shift in India's financial crime landscape. Fraudsters are increasingly blending cyber intrusion with financial deception, using AI to accelerate both. As digital lending deepens across automotive, EV and mobility finance, attackers are likely to keep targeting the weakest links in the chain.
For now, the message to NBFCs is stark: the threat is no longer theoretical, the losses are already material, and the next attack may be only a matter of time unless defenses are upgraded quickly and comprehensively.