INDUSTRY FACT FILE · NBFCS & LENDING

Threat Landscape: Top Cyber Threats Facing NBFCs and Lenders

The 18 most relevant cyber threats, attacks and industry challenges for NBFCs in India, and the impact each one has on lenders, borrowers and partners.

Lending fraud and cyber fraud increasingly overlap. RBI's Annual Report for 2025-26 shows that advances-related frauds were the largest category by value among frauds reported by banks and financial institutions, and reports based on Indian Cybercrime Coordination Centre (I4C) data put cyber-fraud losses across all channels at about ₹19,813 crore in 2025.

For NBFCs, the risk is amplified by partner-led origination, field forces using mobile devices and the rapid growth of digital lending apps—each of which handles borrower identity documents, bank details and loan decisions.

The list below is a practical assessment framework, not a statistical ranking. Priority varies by business model, technology exposure and existing controls.

The matrix is a qualitative guide for prioritising the first round of security reviews.

Figure 5: Qualitative threat relevance by NBFC segment (Codec Networks assessment).

4.1 Synthetic identity, document fraud and partner collusion

Fraud in NBFC lending often combines forged documents, synthetic or borrowed identities and collusion by dealers, DSAs or insiders. RBI's Master Directions on Fraud Risk Management in NBFCs (July 2024) require Upper and Middle Layer NBFCs to operate an early warning signal framework and red-flagging of accounts, supported by data analytics and market intelligence.

• Questions to test: Do onboarding checks go beyond OCR to verify identity, income and collateral? Are dealers, agents, devices and bank accounts linked analytically? Do early warning signals trigger red-flagging and forensic audit in time?
• Relevant services: onboarding and V-CIP controls review, fraud analytics, EWS framework review, forensic audit.

4.2 Fake lending apps and brand abuse

Rogue apps and websites impersonating legitimate lenders harvest borrower data and collect bogus fees, harming customers and the real NBFC's reputation. RBI's Digital Lending Directions require transparency about the digital lending apps a lender uses, including reporting them on RBI's CIMS portal.

• Questions to test: Is the NBFC monitoring app stores and the web for impersonation? How quickly can fake apps be taken down? Do borrowers know which apps are genuine?
• Relevant services: brand and rogue-app monitoring, anti-phishing and takedown support, DMARC review, customer communication.

4.3 Lending app, API and partner data exposure

Digital lending runs on APIs between apps, LSPs, bureaus, Account Aggregators and lenders. Broken authorisation or excessive data in responses can expose borrower files at scale. The 2026 Directions require VA at least six-monthly and PT at least annually for critical and customer-facing systems for Middle Layer NBFCs and above.

• Questions to test: Is every API tested for object-level authorisation and data minimisation in each release? Are LSP integrations assessed, not just contracted?
• Relevant services: application and API security testing, secure code review, LSP and partner assurance.

4.4 Ransomware and month-end disruption

Ransomware is most damaging when timed for disbursement or collection peaks. Middle Layer NBFCs and above must run DR drills for critical systems at least half-yearly, with DR operating for at least a full working day, and test BCP at least annually.

• Questions to test: Are backups isolated and restorable? Is EDR monitored around the clock? Has a ransomware scenario been rehearsed with the 6-hour reporting step?
• Relevant services: ransomware simulation, backup and DR testing, managed SOC, incident response retainer.

4.5 Field-agent devices and insider misuse

Microfinance and vehicle-finance field forces carry borrower data on tablets and phones, often offline. Lost devices, unrestricted exports and misuse by agents create data leakage and conduct risk.

• Questions to test: Are field apps hardened and data encrypted? Can devices be remotely wiped? Are bulk exports and unusual access by agents detected?
• Relevant services: mobile app security testing, device management and DLP review, insider threat simulation, SOC monitoring.

• Reporting clocks: cyber incidents to RBI on DAKSH within six hours of detection (HFCs to NHB) under the 2026 Directions; specified incidents to CERT-In within six hours.
• Fraud reporting: fraud classification, reporting and red-flagging obligations under RBI's fraud risk management directions for NBFCs.
• Evidence: ICT logs retained for 180 days in India under CERT-In's Directions.
• Privacy: once DPDP breach provisions commence in May 2027, personal data breaches must be intimated to the Data Protection Board, with a detailed report within 72 hours.
• Partners: bank co-lenders and funders may suspend arrangements or call for audits after a material incident.

• Which chapter of RBI's 2026 NBFC Directions applies to us, and where are our gaps?
• Could we detect, triage and report a material incident to RBI or NHB within six hours?
• Which partners—LSPs, DSAs, dealers, co-lenders—could hurt us most, and when were their controls last tested?
• Would our analytics spot a cluster of loans linked to the same dealer, device or account?
• Are fake apps or sites impersonating us right now?
• Is borrower data on field devices encrypted, minimised and remotely wipeable?

Note: Threat descriptions and relevance ratings are general guidance, not findings about any specific NBFC. RBI fraud figures relate to frauds of ₹1 lakh and above reported by banks and FIs in 2025-26; I4C figures cover all channels. Confirm regulatory obligations against official instruments.