Stolen Bank Credentials and Weak APIs Expose 20 Financial Institutions to Cyberattacks

As many as 20 financial institutions were reportedly affected by cyberattacks involving stolen credentials and vulnerable payment APIs.

The attacks, reported earlier in October 2026, allegedly involved the unauthorised transfer of funds through compromised application programming interfaces (APIs). Banks, non-banking financial companies (NBFCs) and fintech firms were among the affected institutions.

The Indian Computer Emergency Response Team (CERT-In) subsequently issued a critical advisory warning financial institutions about weaknesses in payment systems, authentication controls and API security.

How Were 20 Financial Institutions Targeted?

The attacks reportedly involved stolen credentials belonging to a partner bank and weaknesses in payment and disbursement systems.

According to people familiar with the developments, attackers exploited vulnerabilities in a financial technology platform originally developed by a Chennai-based software company. The platform was used by financial institutions to process payments and disbursements.

Its inadequate security controls allegedly allowed attackers to access payment-related functions and initiate unauthorised transactions.

The attacks may also have involved AI-assisted hacking tools and custom scripts, although their precise role has not been established.

The identity of the technology provider and the total financial losses could not be independently verified.

How Did Attackers Transfer the Money?

The suspected attackers allegedly exploited payment aggregator and partner-bank credentials to initiate transactions that bypassed normal security checks.

The compromised platform reportedly had weaknesses in its authentication and transaction-monitoring systems, particularly those governing payout APIs.

These weaknesses allegedly allowed transactions to proceed without adequate verification or approval.

Investigators and industry officials identified concerns involving insufficient know-your-customer (KYC) checks, weak payment verification and inadequate transaction controls.

The fraudulent transfers reportedly involved fictitious loan references, payments exceeding prescribed limits and transfers to multiple accounts across different banks.

Funds were rapidly moved through the Immediate Payment Service (IMPS) and National Electronic Funds Transfer (NEFT) systems, complicating recovery efforts.

FCRF Launches CP-FRM to Build India’s Next Generation of Fraud Risk Professionals

What Did CERT-In Find?

In its October 13 advisory, CERT-In flagged multiple attacks in which hackers bypassed customer verification, loan sanction and payment authorisation controls to execute fraudulent transfers.

The agency identified weaknesses in application interfaces and authentication processes that could allow attackers to conduct unauthorised transactions.

CERT-In warned that compromised internet-facing applications, stolen payment aggregator credentials and vulnerable partner-bank API credentials could be used to initiate transfers directly from financial institutions’ own authorised infrastructure.

Such attacks could allow fraudulent transactions to appear as though they originated through legitimate payment systems.

The agency also warned that outdated APIs, unsecured application interfaces and credentials embedded in source code could expose financial institutions to further attacks.

Why Are Payment APIs a Security Concern?

APIs allow banks, NBFCs and fintech platforms to exchange information and process financial transactions.

However, weaknesses in these connections can create opportunities for attackers to bypass security controls.

In the reported incidents, compromised credentials allegedly enabled access to payment functions that should have been protected by additional authentication and approval mechanisms.

The concern extends beyond stolen passwords. Attackers may exploit weaknesses in the application itself to circumvent conventional security checks, even when an institution has implemented controls elsewhere.

The incidents have raised questions about how financial institutions monitor third-party technology providers and secure systems connected to banking infrastructure.

What Security Measures Has CERT-In Recommended?

Following the warning, affected institutions reportedly moved to disable vulnerable interfaces, block unauthorised access and strengthen transaction controls.

CERT-In advised financial institutions to suspend compromised APIs, rotate exposed credentials and introduce multi-factor authentication.

The agency also recommended maker-checker approvals for fund transfers, requiring transactions to pass through separate initiation and authorisation stages.

Other recommended safeguards include real-time transaction monitoring, limits on fund transfers, beneficiary verification and reconciliation of payouts against approved loan or payment records.

These measures are intended to prevent attackers from exploiting compromised credentials to initiate fraudulent transactions without proper oversight.

What Does This Mean for Banks and Fintech Companies?

The incidents highlight the security risks associated with interconnected banking systems and third-party financial technology platforms.

A vulnerability in one payment application or service provider can potentially expose several institutions that depend on the same infrastructure.

The reported attacks also demonstrate how weak authentication, inadequate monitoring and insufficient transaction verification can enable fraudulent payments to move rapidly across multiple accounts.

For financial institutions, securing customer-facing applications alone may not be sufficient. Payment APIs, partner-bank connections, transaction approval mechanisms and third-party systems also require continuous security assessment.

The420 Cybersecurity Insight: “One Weak API Can Put Multiple Financial Institutions at Risk”

The reported attacks underline the importance of securing the systems that connect banks, NBFCs and fintech companies. Stolen credentials combined with weak payment authorisation controls can expose multiple institutions to fraudulent transactions. CERT-In’s recommendations place particular emphasis on stronger authentication, independent transaction approvals and continuous monitoring to prevent unauthorised fund transfers.

About the author — Ayesha Aayat writes on cybercrime, digital safety, and emerging online threats. Her work focuses on public awareness, legal clarity, and technology-driven risks.