CERT-In warns of unauthorised transfers through payment APIs

CERT-In and CSIRT-Fin warned on 9 October of multiple campaigns targeting NBFCs, digital lending platforms, fintech businesses, payment providers and wallet operators. Their critical advisory said attackers used stolen credentials to trigger unauthorised transfers from the affected entities’ own whitelisted infrastructure.

The agency described failures in the controls connecting payments to approved loans, verified beneficiaries and transaction limits. Funds went to attacker-controlled mule accounts across multiple banks. The notice did not identify affected firms or disclose an aggregate loss.

The recommended response includes verifying payouts against approved records, enforcing ceilings at the API or payment stage, adding second-level approval and reconciling transfers with bank or aggregator statements. It also calls for stronger authentication and secure management of API credentials.

CERT-In noted possible use of AI-assisted offensive tools and shorter intervals between compromise and transfer. That remains an assessment of possible tooling; the notice does not prove that AI caused each attack or quantify the reduction in time.