Stories
CERT-In Warns Fintechs and NBFCs of Cyberattacks Targeting Payment APIs
M
Moneycontrol•10-10-2026, 08:32
CERT-In Warns Fintechs and NBFCs of Cyberattacks Targeting Payment APIs
- •CERT-In has issued an advisory warning non-banking financial companies, fintech firms, and payment operators about cyberattacks exploiting payment and disbursement APIs for unauthorized fund transfers.
- •Attackers are compromising internet-facing applications and exposed APIs to steal credentials, bypassing application-level checks and controls like KYC verification and loan sanctions.
- •The breaches involve exploiting vulnerabilities such as unauthenticated APIs, static API tokens in source code, and lack of multi-factor authentication, leading to rapid fraudulent transfers via IMPS and NEFT.
- •CERT-In recommends enforcing multi-factor authentication, maintaining API inventories, disabling unused endpoints, cryptographically binding transaction stages, and implementing strict real-time monitoring.
Key Questions Answered
CERT-In warned that cyberattack campaigns are exploiting payment and disbursement APIs to carry out unauthorized fund transfers by stealing credentials for payment gateways, aggregators, and partner banks.
Attackers invoke fund-transfer APIs directly from an organization's whitelisted infrastructure using stolen credentials, bypassing checks related to loan creation, KYC verification, beneficiary validation, and per-transaction limits.
CERT-In recommends enforcing multi-factor authentication, maintaining an API inventory, disabling unused endpoints, replacing static tokens with strong authentication, cryptographically binding transaction stages, and introducing maker-checker approvals for fund transfers.
