Payment APIs enable applications, banks, payment gateways and other financial services to exchange data and initiate transactions. However, when these interfaces have inadequate access controls, weak authentication, insufficient transaction validation or exploitable vulnerabilities, attackers may be able to misuse them to perform unauthorised actions.

Understanding how these weaknesses are exploited is essential for identifying security gaps, strengthening controls and reducing the risk of similar incidents.

The most concerning aspect of these attacks is that the attackers reportedly used legitimate credentials and trusted infrastructure to initiate unauthorised transactions.

According to CERT-In, the attack chain involved several stages:

• Initial access: Attackers exploited exposed internet-facing applications, vulnerable middleware and privileged endpoints.

• Credential discovery: They targeted deprecated or unauthenticated APIs, long-lived static API tokens embedded in source code, and credentials stored in plaintext configuration files or databases.

• Persistence: After gaining access, attackers established web shells or backdoors to maintain their presence within compromised environments.

• Credential theft: They mapped payment databases and integrations to obtain payment gateway, payment aggregator and partner-bank API credentials.

• Unauthorised transfers: Using valid credentials from trusted infrastructure, attackers called disbursement and fund-transfer APIs directly, bypassing application-level checks.

• Rapid movement of funds: Transactions reportedly carried dummy reference identifiers and moved through IMPS and NEFT to mule accounts across multiple banks.

• Covering their tracks: Attackers deleted or altered logs and tampered with endpoint security tools to make detection and investigation more difficult.

The weakness was not necessarily a complete absence of security controls. It was that critical checks could be bypassed when attackers interacted directly with the APIs.

For example, a lending application might verify a loan's approval status before initiating a disbursement. If the underlying payment API does not independently verify that approval, a compromised credential could potentially be used to trigger a transfer without the required business validations.

This is why securing the application alone is not enough. The API must enforce the necessary authentication, authorisation and transaction-level controls independently.

Separately, reporting by the Ministry of Cyber Affairs described a case in which Delhi Police's Intelligence Fusion and Strategic Operations (IFSO) unit arrested five individuals, including a private bank relationship manager in Jaipur, in connection with the alleged theft of ₹12.8 crore from an NBFC's corporate account.

According to that report, the funds moved through 317 unauthorised transactions involving 34 first-layer mule accounts. A portion was reportedly converted into USDT cryptocurrency, while approximately ₹1.7 crore had been frozen.

The report also noted that investigators were examining a possible Dubai connection.

Source: Ministry of Cyber Affairs, 10 October 2026. This is secondary reporting; the case should not be treated as conclusively linked to the specific campaign described in CERT-In's advisory.

APIs are central to modern financial services. They connect lending platforms with banks, payment gateways with merchants, and wallets with settlement systems. They also enable customer verification, account information exchange and automated financial transactions.

That connectivity makes digital finance faster and more accessible. It also creates additional points that attackers can target.

The challenge is particularly relevant to India's financial ecosystem, where digital lending, UPI-linked services and third-party integrations support increasingly interconnected business processes.

Akamai's 2026 financial services research reported that banking accounted for 83% of attacks directed at API endpoints in 2025. The finding underlines the importance of API security in a sector where exposed interfaces can provide access to sensitive information and critical financial operations.

Source: Akamai, Financial Services Security Trends

The Application-Layer Security Gap

A customer-facing application may enforce loan eligibility, KYCrf checks and approval workflows. However, if the underlying payment API fails to validate these controls independently, attackers with compromised credentials may bypass the intended process.

This can lead to:

• Disbursements without approved loans.

• Transfers exceeding transaction limits.

• Payments to unverified beneficiaries.

• Repeated unauthorised transactions.

• Unintended access through compromised third-party integrations.

Authentication alone is not enough. APIs must independently enforce authorisation, transaction validation and financial controls to prevent unauthorised activity.

The Possible Role of AI-Assisted Attack Tools

CERT-In also highlighted the possible use of AI-assisted offensive frameworks and large numbers of custom scripts in the observed campaigns.

Automation can help attackers probe numerous endpoints, identify weak configurations and repeat exploitation attempts at scale. However, the advisory's reference to AI-assisted tools should be understood as a possible factor in these campaigns, not proof that AI was responsible for every stage of the attacks.

The practical implication for defenders is clear: security controls must be capable of identifying automated abuse, unusual transaction sequences and suspicious API behaviour, rather than relying exclusively on known attack signatures.

Third-Party Integrations Can Widen the Exposure

Financial institutions rarely operate in isolation. They depend on technology vendors, payment aggregators, lending platforms, implementation partners and other service providers.

These relationships can introduce vulnerabilities through shared credentials, connected environments, exposed interfaces or compromised software supply chains.

The Economic Times reported that the attacks affected multiple institutions, while the broader incident reporting highlighted concerns around interconnected technology environments. The precise role of third parties should be assessed on the available evidence rather than assumed in every case.

For security leaders, the lesson remains important: the security of an institution's digital financial operations depends partly on how securely its integrations are designed, monitored and maintained.

CERT-In's advisory specifically identifies several categories of organisations exposed to these attack techniques.

The level of exposure will vary by organisation. However, any business that uses APIs to initiate, authorise or process financial transactions should assess whether its controls remain effective when an API is accessed directly, outside the normal user interface.

CERT-In's advisory provides specific recommendations for reducing the risk of unauthorised fund transfers. These measures should be treated as practical security priorities, with implementation tailored to each organisation's architecture and risk profile.

1. Strengthen authentication and credential management

• Enforce multi-factor authentication (MFA) for payment platforms, administrative portals, payment and bank APIs, and remote access services.

• Replace long-lived static API tokens with per-session authentication mechanisms.

• Store API keys and credentials in secure secret-management solutions or hardware security modules (HSMs).

• Establish credential-rotation procedures and rotate exposed credentials immediately.

• Remove hardcoded credentials from source code and check repositories for exposed secrets.

Authentication should be combined with least-privilege access and appropriate authorisation checks. A valid credential should not automatically grant unrestricted access to financial operations.

2. Maintain complete API visibility

• Maintain an accurate inventory of APIs across production environments.

• Identify deprecated, unused, unauthenticated and externally exposed endpoints.

• Formally decommission APIs that are no longer required.

• Remove unnecessary internet exposure from internal applications and administrative interfaces.

• Separate development, testing and production environments to reduce the risk of cross-environment compromise.

An incomplete API inventory makes it difficult to establish which interfaces are exposed, who can access them and whether they enforce the intended controls.

3. Enforce transaction-level safeguards

• Apply per-transaction and cumulative daily transfer limits at the API or payment-processing layer.

• Require maker-checker approval or an appropriate second level of verification for fund movements.

• Reject payouts when the supplied loan or transaction reference does not correspond to an approved record.

• Cryptographically bind multi-stage transaction workflows so that a disbursement cannot proceed without the required preceding validations.

• Apply beneficiary verification, including penny-drop and account-name matching checks where appropriate.

• Implement velocity limits to detect unusually frequent or rapid transfers.

These controls help ensure that an API cannot be used to circumvent the financial institution's approval and validation processes.

4. Improve monitoring and detection

• Apply rate limiting and behavioural anti-automation controls to identify suspicious API activity.

• Monitor transaction velocity, unusual amounts and payments to newly added beneficiaries.

• Restrict outbound traffic from production servers through appropriate allow-listing.

• Implement near-real-time monitoring of fund transfers and reconcile system records against bank or payment aggregator statements.

• Conduct regular vulnerability assessment and penetration testing (VAPT), with explicit coverage of API security.

• Deploy endpoint detection and response (EDR) solutions with tamper protection on servers and endpoints.

• Maintain centralised logs for at least 180 days, as recommended by CERT-In.

Monitoring should connect technical activity with financial events. An unusual API call becomes more meaningful when it can be correlated with a payment request, an approval record, a beneficiary change or a sequence of rapid transfers.

5. Prepare for a rapid incident response

If suspicious activity is detected, CERT-In recommends immediate action to contain the incident and prevent further unauthorised transactions.

Organisations should be prepared to:

• Disable compromised accounts and suspend affected APIs.

• Rotate exposed credentials and revoke compromised tokens.

• Preserve relevant logs and forensic evidence.

• Investigate potential persistence mechanisms, including web shells and backdoors.

• Review transactions, identify affected beneficiaries and coordinate appropriate containment with banking and payment partners.

• Report suspicious activity related to the campaign to CERT-In/CSIRT-Fin at incident@cert-in.org.in, providing relevant logs and details at the earliest.

Incident response procedures should clearly assign responsibilities across security operations, fraud teams, technology, compliance and business leadership. Delays in coordination can allow unauthorised transfers to continue even after the initial compromise has been identified.

Source:CERT-In Advisory CIAD-2026-0046 — Official advisory and recommended actions

The API attacks are part of a wider cybersecurity challenge facing India's financial services industry.

A joint report by the Boston Consulting Group (BCG) and the Data Security Council of India (DSCI), released in 2026, found that reported cyber incidents in the country's BFSI sector had more than doubled, from 1.4 million in 2021 to 2.9 million in 2025. It also reported that Indian BFSI organisations experienced cyberattacks at 1.6 times the global average.

The findings highlight the pressure on financial institutions as digital services, interconnected platforms and technology dependencies continue to expand.

Source: DSCI and BCG - Cyber Threats Escalate Across Indian Financial Institutions as AI Reshapes the Cybersecurity Landscape

Additional findings from CYFIRMA's Cyber Threat Landscape Report India – BFSI 2026 identified 46 data-breach incidents, 37 data-leak incidents and 33 credit-card-related incidents between March and August 2026. These are reported incident counts within the report's dataset, not a complete census of every incident affecting India's financial sector.

Source: CYFIRMA — Cyber Threat Landscape Report India – BFSI 2026

India's digital transformation has delivered significant benefits. The challenge is to ensure that security measures evolve alongside the systems enabling it.

Every new API, integration and automated workflow creates a need for clear ownership, appropriate access controls, continuous monitoring and reliable incident response. Security cannot depend solely on the assumption that a trusted application or internal server will always behave as expected.

For CISOs, security architects and technology leaders, the CERT-In advisory calls for action across three immediate priorities.

1.      Validate API security end-to-end: test whether authentication, authorisation and transaction checks can be bypassed.

2.      Connect security monitoring with fraud detection: correlate API activity with approvals, beneficiaries and transfers.

3.      Review third-party access continuously: assess credentials, permissions and incident-response arrangements.

The October 2026 attacks highlight an important reality for India's financial sector: a payment system can be exposed even when its customer-facing application appears secure.

The risk increases when long-lived credentials, outdated APIs, incomplete transaction validation and excessive privileges combine within interconnected financial environments. AI-assisted tooling may accelerate the process, but the underlying weaknesses are familiar and preventable.

CERT-In has outlined practical measures that financial institutions can implement to reduce this exposure. The next step is to translate those recommendations into verifiable controls, test them against realistic attack scenarios and ensure that suspicious financial activity triggers a coordinated response.

For CISOs and security teams, the priority is not simply to secure more endpoints. It is to ensure that every API involved in a financial transaction verifies the caller, validates the transaction and operates within clearly defined limits.

As India's digital financial ecosystem continues to grow, building resilience will depend on how effectively institutions secure the connections that keep it running.

At 63SATS Cybertech, strengthening cybersecurity and resilience across India's financial ecosystem means addressing evolving threats such as API-targeted and credential-based attacks through threat intelligence, continuous monitoring and incident response tailored to BFSI environments. As threat actors operate at increasing speed, financial institutions need equally proactive defences to protect critical systems and transactions.

[1]  CERT-In Advisory CIAD-2026-0046 — Threat Actors Exploiting Payment and Disbursement APIs for Unauthorized Fund Transfers in BFSI Entities  |  Issued: 9 October 2026  |  Severity: Critical

[2]  Cyberattacks Affect 20 Financial Institutions — The Economic Times  |  Published: 15 October 2026

[3]  CERT-In Warns NBFCs and Fintech Firms of Cyberattacks Targeting Payment APIs — Moneycontrol  |  Published: 10 October 2026

[4]  AI-Assisted Attackers Hit Financial APIs from India to South Korea — Ministry of Cyber Affairs  |  Published: 10 October 2026

[5]  India's BFSI Sector Faces Cyberattacks at 1.6× Global Average — BCG & DSCI Report (via IANS)  |  Published: May 2026

[6]  FinTechs Confront Growing AI and Infrastructure Threats — Akamai 2026 Report (via IBS Intelligence)  |  Published: May 2026

[7]  Cyber Threat Landscape Report India – BFSI 2026 — CYFIRMA  |  Published: September 2026

[8]  India Blocks 9 Billion Cyberattacks as AI Hacking Surges — State of Application Security 2026 (via Indusface)

[9]  Stolen Bank Credentials and Weak APIs Expose 20 Financial Institutions — The420.in  |  Published: 15 October 2026