Moneyview recovered Rs 2.345 crore after Rs 48.32 crore fraud

Moneyview disclosed that its material subsidiary, WFPL, had recovered Rs 2.345 crore as of June 30, 2026 from a cyber incident involving Rs 48.32 crore. Attackers exploited application programming interface, or API, vulnerabilities with banking partners to initiate unauthorised debits from outside WFPL’s infrastructure, while further recovery efforts continued.

How much of the Moneyview cyber-fraud loss has been recovered?

Moneyview reported a recovery of Rs 2.345 crore by June 30, 2026, against an aggregate Rs 48.32 crore involved in the cyber incident. The recovery followed assistance from law-enforcement agencies after investigators traced diverted funds through three layers of intermediary bank accounts and froze those accounts to prevent further dissipation.

WFPL recognised an exceptional gain of Rs 33.2 lakh during the three months ended June 30, 2026 relating to partial recovery of cyber-incident losses. The Rs 48.32 crore aggregate amount was disclosed as exceptional items in Moneyview’s restated consolidated financial information, separating the incident from its ordinary operating results.

The amount recovered is distinct from the amounts covered by court claims. WFPL’s Rs 2.345 crore figure represents recovery achieved by June 30, 2026, whereas claims seek release of balances in frozen accounts and remain dependent on the investigation and court proceedings.

How did the Moneyview cyber-fraud incident occur?

Moneyview said the cyber-fraud incident arose from vulnerabilities in APIs with WFPL’s banking partners, not from access to WFPL’s own infrastructure. An API is a software interface that enables systems to exchange data and instructions; attackers used the vulnerabilities to initiate several unauthorised transactions from WFPL bank accounts.

On August 9, 2025, an employee acting for WFPL filed a first information report, or FIR, with the Cyber Crime Police Station in Bengaluru. The complaint cited Sections 66, 66(C), 66(D) and 72 of the Information Technology Act, 2000, and Sections 318(4) and 319(2) of the Bharatiya Nyaya Sanhita, 2023.

The disclosed recovery mechanism depends on tracing transfers after money left WFPL accounts. Authorities identified three layers of intermediary accounts, froze those accounts, and enabled WFPL to make claims before the Bangalore City Magistrate Court. Further recovery therefore depends on funds remaining in the identified accounts, court outcomes and any additional tracing by investigators.

What claims and court orders has Moneyview obtained?

Moneyview’s subsidiary filed four claims against first-layer accounts for Rs 3.82 crore, based on balances available in fraudulent accounts. The Bangalore City Magistrate Court passed orders in the complainant’s favour on September 9, 2025 and October 14, 2025 to de-freeze those accounts. The disclosure does not say that the full Rs 3.82 crore had been received by June 30, 2026.

WFPL filed another 14 claims for Rs 2.324 crore against second- and third-layer accounts during the ongoing investigation. Eleven claims involving Rs 1.974 crore remained pending, while three court orders aggregating Rs 34.9 lakh had been passed in WFPL’s favour.

The categories in the table are court claims, not separate confirmed recoveries. The first-layer orders and the three favourable orders relating to later layers support release of identified balances, but WFPL reported only Rs 2.345 crore as recovered as of June 30, 2026.

Has Moneyview faced regulatory action over the incident?

Moneyview stated that WFPL had received no show-cause notice, penalty or adverse direction from any regulatory authority, including the Reserve Bank of India, or RBI, and CERT-In, as of the red herring prospectus date. This status distinguishes the criminal recovery proceedings initiated by WFPL from regulatory enforcement action against WFPL.

The matter was disclosed as outstanding criminal litigation by a subsidiary because WFPL initiated the FIR and recovery claims. Moneyview’s materiality policy set a litigation threshold of Rs 10.902 crore, calculated as 5% of the average absolute profit or loss after tax for the previous three financial years. The Rs 48.32 crore aggregate cyber-incident amount exceeded that threshold.

Moneyview listed nil outstanding criminal proceedings, material civil proceedings and regulatory actions against the company itself in the litigation section. For subsidiaries, the cyber incident was the disclosed criminal proceeding by WFPL, while material civil proceedings, tax proceedings and regulatory actions against subsidiaries were listed as nil.

What must happen for Moneyview to recover more funds?

Moneyview can recover additional funds if frozen balances are de-frozen through court proceedings, pending claims are decided in WFPL’s favour and investigators trace further diverted funds. The 11 pending claims involving Rs 1.974 crore form a disclosed pool still before the Bangalore City Magistrate Court, but they do not establish the amount that will ultimately be collected.

The first-layer claims illustrate why recoveries may differ from the aggregate incident amount. WFPL claimed Rs 3.82 crore based on balances available in the fraudulent accounts, while the incident amount was Rs 48.32 crore. The source says recovery efforts were ongoing as of June 30, 2026 and does not specify a timetable or target for further collections.

Conclusion

Moneyview’s disclosure records a Rs 48.32 crore cyber incident linked to banking-partner API vulnerabilities, with Rs 2.345 crore recovered by June 30, 2026. The recovery process has relied on law-enforcement tracing, frozen intermediary accounts and claims before the Bangalore City Magistrate Court, while the incident and partial recovery were reported as exceptional items.

The disclosed next developments are outcomes in the 11 pending claims worth Rs 1.974 crore and continuing recovery efforts involving traced accounts. Later updates could change the recovered amount or the status of claims; as of the prospectus date, WFPL reported no show-cause notice, penalty or adverse regulatory direction, including from RBI or CERT-In.