Around 20 financial institutions were affected by cyberattacks earlier this month, with hackers allegedly exploiting stolen partner-bank credentials and vulnerabilities in payment APIs to siphon off funds. According to reports from The Economic Times, the attacks may have involved AI-assisted hacking tools, prompting a critical advisory from the Indian Computer Emergency Response Team (CERT-In). In response to the attacks, banks, non-banking financial companies (NBFCs) and fintech firms restricted payment and disbursement application programming interfaces (APIs).
The attacks were allegedly facilitated by a technology platform originally developed by a Chennai-based software company, which had vulnerabilities in its API controls. As reported by The Economic Times, the platform had deficiencies in its security architecture, particularly around payout APIs, allowing transactions to be initiated without the checks that should ordinarily precede a disbursement, including customer verification. The platform's inadequate security controls and weak know-your-customer (KYC) checks raised concerns over the adequacy of merchant verification and transaction monitoring.
In its October 9 advisory, CERT-In flagged multiple attacks in which hackers bypassed customer verification, loan sanction and payment authorisation controls to execute fraudulent transfers. According to The Economic Times, the agency identified indications of AI-assisted offensive tools being used alongside custom scripts, potentially allowing attackers to identify vulnerabilities and execute fraudulent transactions more rapidly. Attackers were compromising internet-facing applications and stealing payment aggregator, gateway and partner-bank API credentials, which were subsequently used to initiate transfers directly from financial institutions' own authorised infrastructure.
The fraudulent transactions involved fictitious loan references, payments exceeding prescribed limits and transfers to mule accounts across multiple banks. As reported by The Economic Times, funds were rapidly transferred through IMPS and NEFT channels and withdrawn, complicating recovery efforts. Following the CERT-In warning, affected entities have moved to disable vulnerable interfaces, block unauthorised access and strengthen transaction controls. The identity of the technology provider and the extent of financial losses could not be independently established.
CERT-In has advised financial institutions to suspend compromised APIs, rotate credentials, introduce multi-factor authentication and enforce maker-checker approvals for fund transfers. According to The Economic Times, the agency has also recommended real-time transaction monitoring, limits on fund transfers, beneficiary verification and reconciliation of payouts against approved loan or payment records. The immediate priority is to ensure that every payout is linked to a verified customer and an authorised transaction, with banks and fintechs required to review their third-party integrations and ensure security checks cannot be bypassed even when valid API credentials are used.
