Western Capital Advisors Reports ₹19.06 Crore Loss in 699 Unauthorized IMPS Transfers from ICICI Bank Accounts
Spandana Sphoorty loses ₹7.80 crore, Vivifi India Finance hit for ₹3.34 crore in 183 rapid transfers; CERT-In flags Crafty Falcon AI campaign targeting NBFCs, fintechs and banks including State Bank of India data exposure
MUMBAI, Nov. 16 – Western Capital Advisors Private Limited has reported a suspected cyber-related financial fraud involving 699 unauthorized IMPS transfers totaling approximately ₹19.06 crore ($2.03 million) from five of its bank accounts maintained with ICICI Bank, according to filings with the National Stock Exchange.
The company disclosed on Oct. 15 that the figure had been revised upward from an earlier estimate of ₹18.96 crore linked to 695 debits, following further examination and reconciliation of bank transactions. The unauthorized debits occurred between Oct. 8 and Oct. 9. Western Capital said it had notified the Reserve Bank of India, lodged complaints on the National Cyber Crime Reporting Portal, reported the incident to CERT-In, and instructed ICICI Bank to seek recall of the funds and freezing of beneficiary accounts. Investigations remain ongoing.
The incident forms part of a wider surge of artificial intelligence-assisted cyberattacks on Indian non-banking financial companies (NBFCs), fintech platforms and banks. Authorities estimate that roughly ₹300 crore ($32 million) has been siphoned from smaller lenders in the past two months, with nearly 150 complaints or FIRs filed.
The Indian Computer Emergency Response Team (CERT-In) has designated the threat actor “Crafty Falcon” and described the campaign as active and ongoing. In advisories issued in early November, CERT-In and the Indian Cyber Crime Coordination Centre (I4C) said attackers are using publicly available AI tools to automate reconnaissance, vulnerability exploitation and fund transfers “at machine speed.” The tools named include ARTEX, PentAGI, Cairn and CyberStrikeAI. Security researchers have linked at least two of the tools to activity previously observed against South Korean banks.
Attackers typically spend 10–12 days studying a target’s payment systems, identify whitelisted IDs or API credentials, then invoke the institution’s own disbursement or payout interfaces. They often begin with micro-value test transactions of ₹1 before executing rapid batches of larger transfers. Funds are moved via IMPS and National Electronic Funds Transfer (NEFT) into networks of mule accounts and, in some cases, onward to gaming or betting platforms. Operations are frequently timed for weekends, holidays or periods of reduced monitoring.
Other reported cases include Spandana Sphoorty Financial, which saw roughly ₹7.80 crore transferred to dozens of beneficiary accounts in early November, and Hyderabad-based Vivifi India Finance, which lost ₹3.34 crore through 183 unauthorized transactions within about 90 minutes. State Bank of India separately disclosed that personal data of nearly 3,900 customers had been exposed. Telangana Cyber Security Bureau has held briefings with NBFCs, fintechs and banks, warning that smaller institutions with weaker controls remain especially exposed.
The Reserve Bank of India has tightened oversight of fintech and NBFC application programming interfaces and sought evidence of compliance with existing cybersecurity norms, including preparedness for AI-related risks. I4C has advised institutions to suspend automated payouts during suspected incidents, prune unused APIs, enforce transaction limits and velocity controls, and conduct red-team exercises against machine-speed attack scenarios.
The Indian cases form part of a broader global pattern. IBM’s 2026 Cost of a Data Breach Report found that one in four malicious breaches involved AI, a 56% increase year-on-year, with AI-enabled incidents costing an average of about $6 million, roughly $1 million more than the global average. Financial services ranked among the most expensive sectors. CrowdStrike has reported an 89% rise in AI-enabled adversary activity between 2024 and 2025, with average “breakout” times falling to 29 minutes. Similar AI-driven tooling has been documented against banks in South Korea and other markets. Deepfake-related fraud alone has generated cumulative reported losses approaching $4 billion worldwide since 2020, according to Surfshark research, with the pace accelerating sharply from 2024 onward.
India’s own cyber-fraud reporting infrastructure has recorded more than 5.3 million complaints on the National Cyber Crime Reporting Portal over three financial years, with reported amounts exceeding ₹56,000 crore. Digital payment fraud volumes continue to rise even as overall bank fraud case counts have fluctuated.
Authorities stress that while many of the AI tools were originally designed for legitimate security testing, their public availability has lowered the barrier for financially motivated actors. CERT-In has continued to receive reports of successful attacks even against entities that received earlier restricted advisories and attempted remediation, underscoring the need for comprehensive, rather than partial, fixes to exposed APIs, credential management and monitoring.
Western Capital, Spandana Sphoorty and other affected firms have said investigations remain ongoing in coordination with banks and regulators. No official aggregate recovery figures for the recent NBFC wave have been released.