INDUSTRY FACT FILE · NBFCS & LENDING

Five New Case Studies in NBFC Security

Original 2026 case studies, each written as a blog post, showing how current threats play out under RBI's 2026 NBFC Directions and how Codec Networks services break the attack chain.

In this document 1.  About these case studies 2.  Case Study 1: The Dealer Who Sold Cars That Did Not Exist 3.  Case Study 2: The Lending App That Was Not Ours 4.  Case Study 3: The Collection Agent's Phone 5.  Case Study 4: The Co-Lending Feed That Was Tampered With 6.  Case Study 5: Ransomware at Month-End

These five case studies were written for this document set and have not been published elsewhere. Each is a composite scenario combining attack techniques and control failures widely observed in lending with the regulatory obligations that apply to NBFCs in India as of October 2026—including RBI's 2026 NBFC cybersecurity Directions, the Digital Lending and Co-Lending Directions and the fraud risk management directions.

Important disclosure The organisations described are fictional and the scenarios are illustrative. They are not accounts of real incidents, and they are not Codec Networks client engagements or claims of achieved outcomes. Their value lies in showing how connected weaknesses form an attack chain, which controls break it, and which services test those controls.

Case study	Lender type	Core threat	Regulatory lens	Primary bundles
1. The Dealer Who Sold Cars That Did Not Exist	Vehicle finance NBFC	Dealer collusion and fictitious borrowers	Fraud Risk Directions; 2026 Directions	B8, B7, B4
2. The Lending App That Was Not Ours	Consumer finance NBFC	Rogue app and brand abuse	Digital Lending Directions; 2026 Directions	B7, B10, B6
3. The Collection Agent's Phone	NBFC-MFI	Field-device data leakage and insider misuse	2026 Directions; DPDP Act	B2, B6, B7
4. The Co-Lending Feed That Was Tampered With	Housing finance company	Partner data-exchange tampering	Co-Lending Directions 2025; 2026 Directions	B9, B3, B2
5. Ransomware at Month-End	Gold loan / diversified NBFC	Ransomware across branches and LMS	2026 Directions (DR, reporting); CERT-In	B7, B10, B8

A high-performing dealer turned out to be the centre of a fraud ring—and the signals had been in the data all along.

At a glance
Organisation	A Middle Layer vehicle finance NBFC (“Lender A”) sourcing most loans through dealers
Threat	Collusion between a dealer, agents and fraudsters to create fictitious borrowers
Why it is new	Tests the early warning signal and red-flagging framework required of Middle and Upper Layer NBFCs
Codec Networks services	Fraud analytics, EWS framework review, forensic audit, onboarding controls review (Bundles B8, B7, B4)

The scenario

A dealer became one of Lender A's top sources of two-wheeler and car loans within a few months. Applications arrived complete, with KYC documents, income proofs and bank statements that passed OCR checks.

In reality, many buyers did not exist. The dealer and two sales agents used borrowed identities and forged documents, and loan amounts were disbursed directly into the dealer's account.

After a few EMIs, a cluster of loans stopped paying at the same time. By then, the exposure had grown significantly.

Figure 8: Illustrative attack path for Case Study 1 and the controls that break it.

What went wrong

• Verification stopped at document format. Identities, addresses and employers were not independently verified.
• No link analysis. The same devices, phone numbers and IP addresses appeared across many applications.
• Dealer concentration was not monitored against normal volumes.
• Early warning signals were reviewed monthly and not linked to dealer-level patterns.

The impact

Lender A faced credit losses, fraud classification and reporting duties, an investigation of its dealer and agent controls and questions from its funding banks.

The regulatory lens

• RBI Fraud Risk Management Directions (2024): early warning signal framework and red-flagging for Upper and Middle Layer NBFCs, with data analytics and market intelligence.
• RBI 2026 NBFC Directions: Board-approved cyber and technology risk governance and access controls.
• PMLA: reporting obligations for suspicious transactions.

How Codec Networks would help

Need	Codec Networks response	Bundle
Spot the cluster	Analytics linking dealers, agents, devices, phone numbers and bank accounts	B7
Verify beyond OCR	Onboarding and document-verification controls testing	B4
Investigate	Forensic audit of the loan cluster and dealer relationship	B8

Key lessons Verify the borrower, not just the document. Link applications by device, phone and account. Monitor dealer concentration and velocity. Make early warning signals daily, not monthly.

A fake app with the NBFC's name collected fees and contacts from thousands of borrowers—and the real lender took the blame.

At a glance
Organisation	A consumer finance NBFC (“Lender B”) with a popular instant-loan app
Threat	Impersonation through a look-alike lending app and website
Why it is new	Tests transparency about genuine digital lending apps under the Digital Lending Directions and brand-monitoring capability
Codec Networks services	Brand and rogue-app monitoring, takedown support, anti-phishing, privacy response (Bundles B7, B10, B6)

The scenario

Fraudsters published an app with Lender B's logo and a near-identical name, promoted through social media advertisements.

Borrowers who installed it uploaded KYC documents, granted access to contacts and paid 'processing fees' for loans that never arrived. Some were harassed using their contact lists.

Angry posts and complaints named Lender B, which had no connection to the app.

Figure 9: Illustrative attack path for Case Study 2 and the controls that break it.

What went wrong

• No continuous monitoring of app stores and social media for impersonation.
• Slow takedown process without established contacts or evidence templates.
• Borrowers could not easily verify which apps were genuine.
• Complaints were not analysed as an early signal.

The impact

Lender B suffered reputational damage, a surge in complaints and regulatory attention, and had to run a public awareness campaign.

The regulatory lens

• RBI Digital Lending Directions (2025): lenders must report the digital lending apps they use on RBI's CIMS portal, supporting transparency about genuine apps.
• RBI 2026 NBFC Directions: Board-approved cybersecurity framework and incident handling.
• CERT-In Directions: reporting of specified incidents, including phishing and fake apps, within six hours.

How Codec Networks would help

Need	Codec Networks response	Bundle
Find impersonation fast	Continuous app-store, domain and social-media monitoring	B7
Take it down	Evidence packs and takedown support	B7
Protect borrowers	Customer awareness and privacy response workflow	B10, B6

Key lessons Monitor your brand as closely as your systems. Publish your genuine apps and partners clearly. Treat complaint spikes as security signals. Prepare takedown evidence in advance.

Borrower data on field devices was meant to make collections easier. It also made it easy to steal.

At a glance
Organisation	A microfinance NBFC (“Lender C”) with thousands of field officers using tablets
Threat	Unencrypted borrower data on field devices and misuse by agents
Why it is new	Combines field digitisation with upcoming DPDP safeguards and breach obligations
Codec Networks services	Mobile app security testing, device management and DLP review, SOC monitoring (Bundles B2, B6, B7)

The scenario

Lender C's collection app cached full borrower profiles—names, phone numbers, addresses, loan details and group information—on tablets so agents could work offline.

Several devices were lost without remote wipe. Separately, an agent exported borrower lists and sold them to a third-party recovery operator.

Borrowers began receiving aggressive calls from unknown collectors, and complaints and a social-media post exposed the leak.

Figure 10: Illustrative attack path for Case Study 3 and the controls that break it.

What went wrong

• Data on devices was unencrypted and not minimised.
• No mobile device management or remote wipe.
• Bulk exports were allowed without approval or monitoring.
• Agent access was not logged centrally.

The impact

Lender C faced borrower harm, conduct complaints, reputational damage and the prospect of DPDP obligations for personal data breaches once they commence.

The regulatory lens

• RBI 2026 NBFC Directions: information security and access controls appropriate to the NBFC's layer.
• DPDP Act and Rules: reasonable security safeguards and breach intimation once those provisions commence in May 2027.
• RBI microfinance and fair-practices expectations for borrower treatment and collections.

How Codec Networks would help

Need	Codec Networks response	Bundle
Harden the app	Mobile app security testing; encryption and offline-data minimisation review	B2
Control the data	MDM, remote wipe, export controls and DLP review	B6
Watch the agents	SOC monitoring of unusual agent access and exports	B7

Key lessons Store as little as possible on field devices. Encrypt everything and enable remote wipe. Make bulk exports an approved, logged event. Monitor agent access centrally.

A compromised file-transfer server sat quietly between an HFC and its bank partner—until the reconciliation broke.

At a glance
Organisation	A housing finance company (“Lender D”) co-lending with two banks
Threat	Tampering with loan data files exchanged with co-lending partners
Why it is new	Co-Lending Directions effective 1 January 2026 increase the volume of partner data exchange
Codec Networks services	Integration and file-integrity testing, partner assessment, infrastructure review (Bundles B9, B3, B2)

The scenario

Lender D shared approved loan files with its bank partners through an SFTP server protected only by a password.

An attacker compromised the server and altered selected files before the banks downloaded them, changing loan amounts and disbursement accounts.

Weeks later, reconciliation between the partners showed mismatches, and some funds had been diverted.

Figure 11: Illustrative attack path for Case Study 4 and the controls that break it.

What went wrong

• Password-only access to the transfer server, without MFA or allow-listing.
• No integrity checks on files exchanged.
• Reconciliation ran too infrequently to catch changes quickly.
• The integration had never been security-tested end to end.

The impact

Lender D faced partner disputes, financial losses, audit findings and a pause in new co-lending until controls were rebuilt. Because HFCs report cyber incidents to NHB, the incident also required regulatory reporting.

The regulatory lens

• RBI Co-Lending Arrangements Directions (2025): partner due diligence and agreed processes for jointly funded loans.
• RBI 2026 NBFC Directions: cyber incidents reported within six hours—to NHB for HFCs.
• RBI Outsourcing Directions (2025): oversight of technology arrangements.

How Codec Networks would help

Need	Codec Networks response	Bundle
Secure the exchange	Review of SFTP/API security, MFA, allow-listing and encryption	B3
Prove integrity	File signing and hashing, reconciliation controls testing	B2
Assure the partner link	End-to-end integration and partner security assessment	B9

Key lessons Protect partner data exchange like a payment channel. Sign or hash every file you exchange. Reconcile daily, not monthly. Test the integration, not just each side.

The attackers waited for the busiest day of the month. The real question was whether recovery had been rehearsed.

At a glance
Organisation	A Middle Layer NBFC (“Lender E”) with a large branch network
Threat	Ransomware encrypting the loan management system and branch servers
Why it is new	Tests the half-yearly DR drill, BCP testing and 6-hour reporting requirements of RBI's 2026 NBFC Directions
Codec Networks services	Managed SOC, ransomware simulation, backup and DR testing, incident response (Bundles B7, B10, B8)

The scenario

A phishing email compromised a branch workstation. Over several days the attacker escalated privileges and reached the loan management system and backup server.

Just before month-end, the attacker deleted reachable backups and encrypted the LMS and branch servers. Mandate presentations, disbursements and customer service stopped.

Lender E had to contain the attack, restore operations and report to RBI and CERT-In within six hours.

Figure 12: Illustrative attack path for Case Study 5 and the controls that break it.

What went wrong

• Alerts on unusual privileged activity were not investigated out of hours.
• Backups were on the same domain and reachable by the attacker.
• DR had not been exercised for a full working day.
• The incident playbook did not include regulatory reporting steps.

The impact

Lender E faced collection delays, customer complaints, recovery costs and supervisory questions about resilience and incident handling.

The regulatory lens

• RBI 2026 NBFC Directions (Middle Layer and above): DR drills for critical systems at least half-yearly, running on DR for a full working day; BCP tested at least annually; periodic backup restoration.
• Incident reporting: cyber incidents on DAKSH within six hours of detection; CERT-In notified.
• CERT-In Directions: 180-day log retention supporting investigation.

How Codec Networks would help

Need	Codec Networks response	Bundle
Detect early	24x7 SOC with EDR/XDR and privileged-activity use cases	B7
Prove recovery	Backup isolation testing, DR drill observation, ransomware simulation	B10
Respond and report	IR retainer, forensic RCA and reporting support	B8

Key lessons Watch privileged activity around the clock. Keep backups unreachable from the production domain. Run DR for a full working day, as RBI expects. Put the 6-hour report in the playbook.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com