Mumbai Gold Loan Company Duped of INR 78.1 Lakh in 18 Unauthorised Transactions

Hackers allegedly stole INR 78.1 lakh from a gold loan company in Parel after gaining access to the loan management software. After that, they carried out 18 fraudulent fund transfers in less than an hour. Mumbai's Central Cyber Police registered a case on July 17 and launched an investigation into the incident.

The transactions took place on July 13 after the attackers allegedly accessed the company's Omnifin Loan Management System (LMS) and its connected payment interface without permission. Police believe the hackers misused the software's API-based connection with the company's banking system.

The API allows the company's loan management system to automatically send payment instructions to the bank. This process does not require any one-time password (OTP) or manual approval for every transaction. As per a report by TOI, API integration was connected through Paysprint Private Limited. The system is used as part of the company's regular operations to transfer loan amounts automatically after a loan is approved.

As per a report by TOI, all loan disbursements are made through the firm's current account. The hackers carried out 18 unauthorised transactions. Each transfer was reportedly between around INR 2 lakh and INR 7 lakh. The money was sent to multiple bank accounts located in different states, including Jammu and Kashmir, Kerala and Maharashtra.

The company detected the fraud on July 14 during its routine reconciliation process. Officials noticed transactions that did not match any approved loan or customer request. 

After this, the company informed the national cybercrime helpline 1930 about the incident. On July 16, it also filed a formal complaint against the holders of the beneficiary bank accounts and any other suspected accomplices.

Mumbai's Central Cyber Police registered an FIR on July 17. Investigators have sought account details from the banks where the money was transferred. They have also asked the banks to freeze the accounts. Police are seeing if anyone from the company or the banking system is involved. The investigation is ongoing.