Breaches and incidents
MobiKwik (India): Rs 40 crore paid out after failed transactions were marked successful
MobiKwik told exchanges that registered merchants and users in Haryana obtained unauthorised settlements on 11 and 12 Sep 2025.
- Disclosed
- Verification
- Confirmed by two or more outlets
What happened
- MobiKwik told exchanges that registered merchants and users in Haryana obtained unauthorised settlements on 11 and 12 Sep 2025; FIR for Rs 40 crore, about Rs 14 crore recovered, net impact about Rs 26 crore (Inc42). Gurugram Police said six were arrested (five from Nuh, one from Palwal) and 2,500 accounts identified and frozen (Inc42; MediaNama).
- Root cause per MobiKwik’s 18 Sep update: a “limited internal processing error” in which failed transactions were incorrectly marked successful, fixed within 45 minutes; “not a cybersecurity breach”. MediaNama, citing police, says a September software update let users send more than their wallet balance and complete transactions with a wrong PIN; police were probing insider involvement. The accounts conflict.
- Attacker: merchants and users clustered around Nuh district, per company and police.
- Response: FIR, debit freezes and liens on recipient accounts, recovery under way.