Language Settings
Select Website Language

GDPR Compliance

We use cookies to ensure you get the best experience on our website. By continuing to use our site, you accept our use of cookies, Privacy Policy, and Terms of Service.

CERT-In Issues Critical Alert Over Payment API Attacks

2 hours ago

4

0

CERT-In Issues Critical Alert Over Payment API Attacks Targeting Financial Firms

CERT-In warns Indian financial firms of payment API attacks that could enable unauthorised fund transfers and financial fraud.

By News National Editorial Team

India’s Computer Emergency Response Team (CERT-In) has issued a critical cybersecurity advisory warning financial companies about attacks targeting payment and disbursement APIs. The advisory, dated October 9, 2026, identifies non-banking financial companies (NBFCs), digital lenders, fintech businesses, payment providers and digital wallet operators among the targets.

According to CERT-In, attackers have compromised exposed applications and APIs to obtain payment-related credentials and initiate unauthorised fund transfers. In reported attack methods, criminals allegedly bypassed normal application checks, including beneficiary verification, transaction limits and other approval controls.

The advisory also describes suspicious transfers using false transaction references and accounts allegedly controlled by attackers. Investigators and affected organisations need to establish the circumstances of each incident before attributing individual losses.

CERT-In has advised financial organisations to strengthen multi-factor authentication, review internet-facing APIs, rotate compromised credentials and introduce additional checks before releasing funds. Companies should also monitor unusual transactions, retain security logs and restrict access to sensitive systems.

The warning highlights the importance of securing the systems that connect lenders, payment gateways and banking partners. Even when an organisation has standard security controls, weaknesses in API authentication or transaction validation can create opportunities for fraud.

Financial institutions should review the full advisory and apply the recommended protections promptly. Customers should report suspicious transactions to their bank or payment provider through official channels.

Source: Official CERT-In Critical Advisory

Click here to Read More
Previous Article
Cyberattack Disrupts Refrigeration at French Supermarkets
Next Article
India and Singapore Strengthen Cybersecurity Cooperation

Related Cyber Security Updates:

Are you sure? You want to delete this comment..! Remove Cancel

Comments (0)

    Leave a comment