India’s cyber agency says hackers are stealing payment credentials and misusing payout APIs from trusted systems to move money to mule accounts within minutes, urging financial firms to tighten authentication, monitoring and transaction controls immediately.
India’s Computer Emergency Response Team (CERT-In) has cautioned non-banking financial companies (NBFCs), fintech firms, digital lending platforms, payment service providers and wallet operators about attack campaigns that exploit payment and disbursement APIs to carry out unauthorised transfers.
In an advisory issued on October 9, CERT-In’s financial-sector unit, CSIRT-Fin, said attackers break into internet-facing applications and exposed APIs to steal credentials linked to payment gateways, payment aggregators and partner banks. They then trigger fund-transfer APIs directly from the victim’s own whitelisted infrastructure, which lets them slip past checks built into the application.
How the attacks work
According to the advisory, such intrusions can sidestep controls on loan creation, know-your-customer (KYC) verification, loan sanction, beneficiary validation, balance sufficiency and per-transaction limits.
The agency noted the use of dummy transaction or loan reference numbers, transfers above prescribed limits, and payments routed to mule accounts spread across several banks, from where the money is withdrawn.
Possible entry points include flaws in internet-facing applications and server middleware, outdated or unauthenticated APIs, and unrestricted file uploads. Attackers may also exploit static API tokens hard-coded in source code, plaintext credentials kept in configuration files or databases, and remote services lacking multi-factor authentication (MFA). The advisory also pointed to supply-chain compromises of code repositories involving forged commits.
Once inside, intruders may plant web shells and backdoors to stay on the network, study payment databases and API integrations, and harvest credentials needed to start fraudulent payments. CERT-In observed several high-value transfers executed in quick succession through the IMPS and NEFT channels.
Recent incidents show a sharp drop in the gap between the first breach and the fraudulent transfer, the agency said. It also flagged the possible use of AI-assisted offensive tools and custom scripts, with attacker IP addresses mostly tied to hosting infrastructure.
What firms should do
CERT-In has asked financial entities to enforce MFA across payment platforms, administrative portals, banking APIs and remote access services. They should keep an inventory of all APIs, switch off unused endpoints and replace long-lived static tokens with stronger authentication.
Other recommendations include cryptographically linking the stages of a transaction, adding maker-checker approvals for transfers, and validating every payout against sanctioned records. Transactions with invalid reference numbers should be rejected, and per-transaction and daily limits enforced at the API level.
The agency also advised beneficiary verification, real-time transaction monitoring, secure credential storage, restricted outbound network traffic, and centralised logging with at least 180 days of retention.
Organisations that spot suspicious activity should disable compromised accounts, suspend affected APIs, preserve forensic evidence, rotate credentials and report the incident at the earliest to CERT-In/CSIRT-Fin at incident@cert-in.org.in.
