Breaches and incidents
NBFCs, digital lenders and fintechs (India): CERT-In warns of payout-API abuse as small NBFCs report about Rs 300 crore in losses
CERT-In advisory CIAD-2026-0046, “Threat Actors Exploiting Payment and Disbursement APIs for Unauthorized Fund Transfers in BFSI Entities”, issued 9 Oct...
- Disclosed
- Verification
- Checked against a primary source
What happened
- CERT-In advisory CIAD-2026-0046, “Threat Actors Exploiting Payment and Disbursement APIs for Unauthorized Fund Transfers in BFSI Entities”, issued 9 Oct 2026, severity Critical, updated 2 Nov 2026, targets NBFCs, digital lending platforms, fintechs, payment service providers and wallet operators. Reports dated 29 Oct 2026 put losses at about Rs 300 crore over about two months across nearly 150 complaints and FIRs (about 30 in Mumbai, more than 25 in Delhi, 15 to 16 in Chennai), mostly at NBFCs with turnover up to about Rs 1,000 crore; a Delhi lender reportedly lost Rs 7.5 crore and then Rs 7.25 crore days later (CXO Digital Pulse; Asianet News). These figures are press estimates, not regulator data.
- Root cause per CERT-In: initial access through internet-facing applications and middleware, deprecated or unauthenticated APIs with unrestricted file upload, long-lived static API tokens hard-coded in source code, forged commits to code repositories, plaintext credentials and missing MFA; then web shells, theft of payment aggregator, gateway and partner-bank API credentials, and calls to disbursal and fund-transfer APIs “directly from the entity’s whitelisted infrastructure”, bypassing KYC, sanction screening, beneficiary verification and balance checks. Transfers carry dummy reference IDs and go by IMPS/NEFT to mule accounts; logs are deleted and EDR tampered with.
- Attacker: not attributed. Press reports name tools (CyberStrike and others) found in some investigations; that does not establish who is behind the campaign.
- Response: CERT-In mitigations include MFA on payment platforms and APIs, secrets in a vault or HSM, removing static tokens, maker-checker for fund movement, rejecting payouts whose reference IDs match no approved record, API-layer limits, penny-drop and name-match beneficiary validation, near-real-time reconciliation, outbound allow-listing, 180-day central logs and reporting to CERT-In/CSIRT-Fin.