CERT‑In Warns of API‑Driven Fraud Campaigns Targeting Indian Fintech and NBFCs

\n\n

A new advisory from India’s Computer Emergency Response Team (CERT‑In) reveals a surge in attacks that hijack payment and disbursement APIs to move money illicitly. Attackers are breaching internet‑facing applications and unprotected APIs, stealing credentials for payment gateways, aggregators and partner banks, and then invoking fund‑transfer APIs straight from the victim’s whitelisted network, effectively sidestepping normal application checks. The campaign can bypass critical controls such as loan creation, KYC verification, beneficiary validation and per‑transaction limits, using dummy reference numbers, mule accounts and high‑value transfers via IMPS and NEFT.

Why it matters: The exploitation of exposed APIs turns routine financial services into a direct conduit for fraud, shortening the kill‑chain between initial breach and cash‑out. By compromising static tokens, plaintext credentials and even source‑code repositories, attackers achieve persistent access and can automate high‑value thefts at scale. For the Indian fintech ecosystem—a rapidly expanding sector that underpins millions of transactions—this represents a systemic risk to consumer confidence and financial stability.

What to watch next: CERT‑In’s mitigation roadmap calls for mandatory multi‑factor authentication on all payment‑related interfaces, comprehensive API inventories, decommissioning of unused endpoints, and replacing long‑lived static tokens with stronger, dynamic authentication methods. Additional safeguards include cryptographic binding of transaction stages, maker‑checker approvals, real‑time monitoring, and robust logging. Stakeholders should track the rollout of these controls across NBFCs and fintech platforms, monitor for emerging threats such as AI‑assisted attack tooling, and watch for regulatory responses that may mandate stricter API security standards. [[1]]

Sources

1. moneycontrol.com