CERT-In issued a critical warning on October 9, 2026, about hackers bypassing KYC in fintechs. Attackers are directly invoking disbursal APIs from whitelisted infrastructure, completely sidestepping application-level controls like KYC and transaction limits. The advisory suggests AI-assisted tools are making these fraudulent transfers faster and harder to trace.
How We Got Here
CERT-In, through its CSIRT-Fin arm, issued the critical advisory on October 9, 2026, targeting NBFCs, digital lenders, and payment platforms. This warning addresses "multiple cyber attack campaigns" where threat actors compromise internet-facing applications to steal credentials.
The Numbers
- Hackers steal payment aggregator and partner-bank API credentials to execute direct fund transfers.
- Transactions feature dummy reference IDs, exceed per-transaction limits, and route funds to attacker-controlled mule accounts across multiple banks.
- Funds are quickly transferred via IMPS and NEFT rails and immediately withdrawn.
- Attackers delete or truncate logs, tamper with EDR tools, and perform "anti-forensic cleanup" to obscure their activities.
- CERT-In advises entities to enforce MFA on payment platforms, use per-session authentication, and decommission unused APIs.
What Happens Next
🇮🇳 Why This Matters for India
For the thousands of digital lending and payment platform founders in Bangalore and Pune, this advisory means urgent, costly re-evaluation of their core API security stacks.
The Take
The immediate losers here are the smaller fintechs and NBFCs, who lack the robust in-house security teams and budget to implement these fixes quickly. Expect a wave of consolidation or outright shutdowns for firms that can't pass a rigorous API security audit within the next 12 months.
Source:
MediaNama ↗