CERT-In warns fintechs that attackers are draining payout APIs

CERT-In warns fintechs that attackers are draining payout APIs

9 October 2026: India's computer emergency response team has issued a critical advisory to non-banking financial companies, digital lenders, fintechs, payment service providers and wallet operators after a series of attacks in which money was moved out through their own payment APIs. Advisory CIAD-2026-0046, issued with the financial-sector team CSIRT-Fin, says attackers steal payment gateway and partner-bank API credentials and then call disbursal and fund-transfer APIs directly from the victim's whitelisted infrastructure, bypassing loan creation, KYC, sanction, beneficiary checks and per-transaction limits.

How the attacks work

CERT-In lists the ways in: exposed applications and middleware with known flaws; deprecated, unauthenticated or unused APIs with unrestricted file upload; long-lived API tokens hard-coded in source code; forged commits in source-code repositories; plaintext credentials in configuration files and databases; and services without multi-factor authentication. Once inside, attackers plant web shells, map the payment databases and integrations, take the bank and gateway credentials, and send payouts with dummy reference numbers that exceed normal limits. The money goes over IMPS and NEFT to mule accounts at several banks and is withdrawn at once. Logs are deleted or truncated and endpoint detection tools tampered with.

The advisory adds that the interval between first compromise and fraudulent transfer has fallen sharply in recent incidents, and that the evidence suggests "the possible use of AI-assisted offensive tooling".

What CERT-In asks firms to do

The recommended actions are specific to payment flows. Among them:

• Enforce MFA on payment platforms, admin portals, payment and bank APIs and remote access
• Keep a full API inventory and formally decommission deprecated and unused APIs
• Use per-session authentication on every API and remove long-lived static tokens
• Bind multi-stage transaction flows cryptographically, so a debit API cannot be called without the earlier validation steps
• Require maker-checker approval for all fund movement and validate every payout against approved records
• Set per-transaction and per-day ceilings at the API stage, with penny-drop and name matching for beneficiaries
• Restrict outbound traffic from production servers to an allow-list and keep secrets in a vault or HSM with rotation
• Keep centralised logs for at least 180 days and run tamper-protected EDR

Entities that see signs of the campaign are asked to disable compromised accounts, suspend affected APIs, preserve evidence, rotate credentials and report to CERT-In and CSIRT-Fin with the relevant logs.

Why software suppliers should read it too

The weaknesses CERT-In names, from hard-coded tokens to payout APIs that do not check the earlier steps of a loan, are often built into the lending and payment platforms that Indian fintechs buy rather than build. Firms using a vendor's loan management or disbursal system should ask the vendor how its APIs handle each point on the list, starting with step binding and static tokens.

Sources

• CERT-In: Advisory CIAD-2026-0046, Threat Actors Exploiting Payment and Disbursement APIs for Unauthorized Fund Transfers in BFSI Entities, 9 October 2026
• MediaNama: CERT-In warns fintechs of KYC and API hijacks, 14 October 2026