A Rs 14 crore bank heist, a Rs 5 number-plate leak, and AWS runs dry
Central Bank of India loses Rs 13.97 crore through the RBI's payment plumbing, the Transport Ministry orders audits after vehicle owner data sold for Rs 5, a PhonePe setting to switch off after travel, AWS says 2027 is largely sold out, and UPI's duopoly barely moves.
- Long Press · Daily Five25 Oct 202601 / 05
commentaryIndiaRs 14 crore slipped out through the pipe every bank shares
Central Bank of India says 187 unauthorised transfers took Rs 13.97 crore out of its settlement account with the RBI between October 15 and 17, and none of them exist in its branch, net banking or core banking records, as The Wire reported. That missing trail is the real story. Investigators suspect someone got into the SFMS messaging link that carries RTGS and NEFT instructions to IFTAS, the RBI subsidiary that runs it, and the money landed in 36 different banks. The complaint says no retail customer was debited directly, so this one lands on the bank rather than on you.
The questionHow was Rs 13.97 crore stolen from Central Bank of India's RBI account?
In one lineBetween October 15 and 17, 2026, 187 unauthorised transfers moved Rs 13.97 crore out of Central Bank of India's settlement account with the RBI into accounts at 36 banks. Investigators suspect a breach of the SFMS messaging link run by IFTAS. The bank's complaint says no customer account was directly debited.
The problem
Every bank's large interbank payments travel over the same messaging rails to the RBI. Customers never see that layer, and most of India's fraud conversation is about phones and OTPs, not about it.
What changed
Between October 15 and 17, 187 transfers (6, then 88, then 93) moved Rs 13.97 crore from Central Bank of India's RBI settlement account into accounts at 36 banks, none carrying the bank's usual internal transaction IDs, per The420. Mumbai's Nodal Cyber Police registered an FIR, and the bank alerted the RBI, IFTAS, NCIIPC and CERT-In.
The catch
Nobody has said how the attackers got in, and police admit they have very little to go on. Until IFTAS or the RBI explains what failed, every other bank on the same rails is left wondering whether the same door is open for it too, which is not a comfortable place for a payments system to be.
What it means for you
If you bank with Central Bank of India, nothing in the complaint points at customer accounts, so ignore any 'your account was affected, verify now' call that follows this headline. The thing worth watching is whether the RBI tells the public what broke.
Questions people ask
Is my money safe in Central Bank of India after the Rs 13.97 crore fraud?
Going by the bank's complaint, yes. The 187 transfers came out of the bank's own settlement balance at the RBI, not from retail accounts, and the complaint says the evidence doesn't show direct debits from individual customers. The loss sits with the bank while investigators work out how the payment instructions were sent.
What is SFMS and why does the Central Bank of India breach matter?
SFMS, the Structured Financial Messaging System, carries the payment messages banks send through the RBI's RTGS and NEFT systems, and it's run by IFTAS, an RBI subsidiary. If fake instructions got through it, the weak point is plumbing that every Indian bank depends on, which is why CERT-In and NCIIPC were alerted.
Who is investigating the Central Bank of India settlement account fraud?
Mumbai's Nodal Cyber Police Station registered an FIR against unknown persons for cheating and personation after the bank's treasury general manager complained. The bank also informed the RBI, IFTAS, the Daksh portal, NCIIPC and CERT-In. Police say tracing the money is hard because the initial data on the transfers is so thin.
SourcesThe Wire ↗The420 ↗
- Long Press · Daily Five25 Oct 202602 / 05
securityIndiaYour number plate was a Rs 5 lookup on Telegram
The Transport Ministry has ordered CERT-In forensic audits of VAHAN, SARATHI, e-Challan and PUCC after reports that vehicle owners' personal details were on sale for as little as Rs 5 per number plate, according to The420. An RTI reply shows 25,314 private companies held active login credentials and ran 1.708 crore searches over 33 months. I'm not sure 'leak' is even the right word. When that many companies hold legitimate keys to the database, someone reselling the answers was always going to happen, and no hacker was needed for it.
The questionWhy is CERT-In auditing VAHAN and SARATHI over a vehicle data leak?
In one lineOn October 24, 2026, the Transport Ministry ordered CERT-In forensic audits of VAHAN, SARATHI, e-Challan and PUCC after reports that vehicle owners' names, addresses and phone numbers were sold on Telegram for as little as Rs 5 per number plate. RTI records show 25,314 private firms held access credentials.
The problem
Your vehicle registration links your name, address and phone number to a plate anyone can read off the road. The government shares access to that database with tens of thousands of private companies.
What changed
A Telegram channel reportedly sold owner details, licence and challan records for fees as low as Rs 5 using only a registration number. On October 24 the ministry ordered CERT-In audits of the four portals, asked NIC to audit the logistics platform, asked app stores including Google to pull apps showing owner details, and put government data requests behind the Transport Secretary's sign-off.
The catch
The audits look at the portals, but the problem the RTI numbers describe is the access policy itself. Unless the 25,314 corporate logins are cut back hard, the same data will keep leaking out through the front door.
What it means for you
You can't opt out, so assume strangers can know your name and address from your plate. A caller quoting those details hasn't proved anything about who they are.
Questions people ask
What vehicle owner data was leaked from VAHAN in India?
Reports describe a Telegram channel offering owner names, addresses, phone numbers, driving licence and challan records and registration details for as little as Rs 5, using only a vehicle registration number. Two apps, Vehicle Information App and VehicleSetu, were flagged, though download numbers alone don't prove either did anything unlawful.
What has the government done about the VAHAN data leak?
The Transport Ministry told CERT-In to audit the four portals, asked NIC to audit access on the logistics platform, and asked app stores including Google to remove apps showing owner details. Government requests for logistics data now need the Transport Secretary's personal sign-off plus identity checks by digital signature or video.
Can I stop my vehicle details showing up in these apps?
Not really, and that's the uncomfortable part. The data comes from the government's own registration systems, so owners can't opt out. Treat any caller who knows your name, address and plate number as unverified, since those details were cheap to buy, and report fraud attempts on Sanchar Saathi's Chakshu.
SourcesThe420 ↗
- Long Press · Daily Five25 Oct 202603 / 05
tipIndiaBack from your trip? Switch UPI International off
PhonePe lets you switch UPI International off yourself from your profile photo, then Payment Management, International, deactivate, and your UPI PIN, according to PhonePe's help page. Left alone, it stays on for 90 days after you activate it. That's fine for a long trip and pointless for a long weekend in Bangkok, because it's one more spending channel left open on your account. On a day with two data and fraud stories in the brief, closing the doors you aren't using feels like basic hygiene.
The questionHow do I turn off UPI International in PhonePe?
In one lineIn PhonePe, tap your profile photo, open International under Payment Management, choose deactivate, confirm and enter your UPI PIN. PhonePe also turns UPI International off automatically 90 days after you activate it, so switching it off yourself matters when you're home sooner than that.
The problem
Most people turn on UPI International for one trip and forget it exists. PhonePe keeps it live for up to 90 days, long after you've unpacked.
What changed
The deactivate option sits in the same menu you used to turn it on: profile photo, Payment Management, International, deactivate, confirm, UPI PIN. PhonePe's help pages confirm both the steps and the 90-day automatic switch-off, and turning it back on takes the same four taps.
The catch
It won't protect you if someone already has your UPI PIN, since domestic payments still work. It just narrows what a stolen PIN can be used for.
What it means for you
Check it today if you travelled this year, and make switching it off part of unpacking. If you activated it in another UPI app instead, look for the same setting there.
Questions people ask
Does UPI International in PhonePe turn off automatically?
Yes. PhonePe's help page says UPI International switches off on its own 90 days after the activation date. That means a two-week holiday leaves it live for roughly another ten weeks unless you deactivate it yourself from Payment Management and then International in the app.
How do I turn UPI International back on in PhonePe for a trip?
Tap your profile photo, go to International under Payment Management, tap Activate next to the bank account you want to use abroad, and enter your UPI PIN. Do it a day before you fly so you're not fiddling with settings at a shop counter, then switch it off again once you're home.
- Long Press · Daily Five25 Oct 202604 / 05
hot takeEven AWS is out of AI capacity, so stop waiting for cheap
Amazon CEO Andy Jassy said on an a16z podcast on October 23 that AWS's 2027 capacity is 'largely sold out' and a good chunk of 2028 is gone too, as 24/7 Wall St. reported. Everyone keeps promising that AI is about to get cheap. The world's biggest cloud just said it has mostly booked out next year. For a startup in Bengaluru building on someone else's API, that means the price curve flattens and the rate limits stay, so I'd plan for scarcity rather than for a price war.
The questionIs AWS really sold out of cloud capacity for 2027?
In one lineLargely, yes. On an a16z podcast on October 23, 2026, Amazon CEO Andy Jassy said '2027 is largely sold out' and 'a good chunk of 2028' is too, with some capacity held back for on-demand customers and Bedrock. He also said he doesn't think the shortage ends in 2027.
The problem
AI companies have spent two years telling customers compute will keep getting cheaper. That only holds if supply keeps pace with demand, and right now it isn't.
What changed
Jassy said 2027 is 'largely sold out', that 'a good chunk of 2028 is sold out', and that he doesn't expect the shortage to end in 2027, per The Information. Amazon keeps some capacity for on-demand and Bedrock while big blocks go to AI labs and enterprises, and it plans roughly $220 billion of capex this year.
The catch
Those bookings depend on AI labs staying funded. If money tightens, long-term commitments can be renegotiated, and a shortage that looks permanent today could look very different in eighteen months.
What it means for you
If your product leans on an AI API, budget on current prices and design for rate limits and fallbacks across providers. Cheaper tokens may still come, just not on the timeline the pitch decks promised.
Questions people ask
Why is AWS running out of capacity in 2027?
AI labs and large enterprises are booking big blocks of compute years ahead. Amazon plans about $220 billion of capex in 2026 and its trailing free cash flow is a $7.6 billion outflow, per 24/7 Wall St., yet Jassy says demand still outruns supply and that Amazon could invest a lot more.
Will AWS selling out make AI tools more expensive?
No price rise has been announced. But Jassy himself called inference an order of magnitude too expensive for pervasive use, and with the large blocks already booked, smaller customers are left with on-demand capacity. Expect AI API prices to fall more slowly than the hype suggests, and budget on today's prices.
- Long Press · Daily Five25 Oct 202605 / 05
hot takeIndiaTwo apps still run 78% of UPI. Enforce the cap or drop it
PhonePe and Google Pay processed 77.8% of listed-app UPI volume in September 2026, down from 81.9% a year earlier, per MediaNama. PhonePe alone did 10.91 billion transactions. NPCI's 30% cap on any single app now has a December 31, 2026 deadline, and that date is itself an extension. Four points a year isn't competition fixing the market, it's drift. NPCI should either enforce the cap in January or admit the rule is decorative and drop it.
The questionWhat is PhonePe and Google Pay's UPI market share in September 2026?
In one lineIn September 2026, PhonePe handled 45.57% of listed UPI app volume and Google Pay 32.23%, a combined 77.8%, down from 81.9% a year earlier. Both sit above NPCI's 30% per-app cap, whose compliance deadline for existing apps has been extended to December 31, 2026.
The problem
UPI is public infrastructure, but two private apps, one of them owned by Google, carry most of it. NPCI's own answer to that concentration was a 30% volume cap per app.
What changed
September's numbers: PhonePe 10.91 billion transactions (45.57%), Google Pay 7.71 billion (32.23%), Paytm 1.94 billion (8.1%) and Navi 1.14 billion, out of 24.07 billion UPI transactions overall. The cap deadline for existing apps is December 31, 2026, measured on a rolling three-month basis.
The catch
A single month's table can't prove anyone breached the rule, and pushing people off an app they like is messy for everyone involved, which is exactly why the deadline keeps getting softer.
What it means for you
Nothing changes in your app on January 1 unless NPCI acts, and it hasn't said how it would. Keeping a second UPI app set up on a different bank account is still a sensible backup for the day one of them goes down.
Questions people ask
Will NPCI's 30% UPI market share cap actually apply in 2027?
On paper, the deadline for existing apps is December 31, 2026. The cap is measured as a rolling three-month share of overall UPI volume, so one month's table can't prove a breach. With PhonePe at 45.57% and Google Pay at 32.23%, meeting it would mean moving billions of monthly transactions elsewhere.
Which UPI app is third after PhonePe and Google Pay?
Paytm, with 1.94 billion transactions and an 8.1% share in September 2026, followed by Navi at 1.14 billion and super.money at 405.1 million. Everyone outside the top two together holds only about 22% of listed-app volume, which shows how slowly the challengers are closing the gap.
SourcesMediaNama ↗
Taps
Quick hits. One line each, for when a long press is too much.
- IndiaInc42 ↗
Jio Platforms IPO closes 22.19 times subscribed, institutions at 70.55x
Retail came in at just 2.72x on the Rs 30,213 crore fresh issue, so this was an institutions' book, per Inc42.
- IndiaInc42 ↗
Swiggy falls 24.5% in a week as new-age tech stocks shed $11 billion
Instamart's widening losses did it, and Swiggy now trades 54.7% below its Rs 390 IPO price, per Inc42.
- IndiaThe420 ↗
Mumbai chefs lured by fake hotel jobs say they were forced into Laos scams
They paid Rs 5.55 lakh to a recruiter. A destination that changes after you fly is the red flag, per The420.
- GlobalFlavio Copes ↗
Cursor's coding agents can now click and type inside desktop apps
Computer Use needs macOS Accessibility and Screen Recording permissions and can test builds in the iOS Simulator, per Flavio Copes.
- GlobalThe420 ↗
UK commits over £600 million to AI security, biosecurity and cyber defence
The biggest slice, £165 million, goes to AI biosecurity, with £120 million for the AI Security Institute, per The420.