Indian financial cybersecurity teams faced a two-front October as the Indian Computer Emergency Response Team (CERT-In) documented API credential abuses at roughly twenty banks, non-banking finance companies and fintechs, and State Bank of India opened a forensic review of customer data that appeared on the dark web. Aditya Banerjee’s security desk ties the threads through a common lesson: partner integrations that move money must treat API keys like vault combinations, not developer convenience.
API advisory CIAD-2026-0046
CERT-In’s 9 October advisory, referenced in Economic Times and ETCISO coverage, described attackers stealing payment-aggregator and partner-bank API credentials from internet-facing apps, then initiating transfers from the institution’s own authorised infrastructure. Fraudulent flows used fictitious loan references, exceeded limits and routed funds through IMPS and NEFT to mule accounts before withdrawal.
The agency recommended suspending compromised APIs, rotating secrets, enforcing multi-factor authentication, maker-checker approvals, beneficiary verification and real-time monitoring. It also noted indications that AI-assisted tooling may have accelerated vulnerability discovery—without naming specific products—alongside custom scripts.
How attacks bypassed controls
People familiar with investigations told the Economic Times that weaknesses in payout API controls allowed disbursements without full customer verification on at least one software platform used by multiple lenders. CERT-In warned that credentials embedded in source code and outdated interfaces could let attackers bypass application safeguards even when front-end checks existed.
Affected entities reportedly disabled vulnerable interfaces and tightened transaction mapping after the advisory. Exact loss figures were not independently verified by InfoHandle; banks seldom disclose fraud totals in real time.
SBI dark-web dataset
State Bank of India said in an exchange filing reported 21 October that threat intelligence from the Defence Cyber Agency and CERT-In flagged about 375,000 records on the dark web. Preliminary analysis identified 3,897 customer records containing personally identifiable information such as mobile numbers, dates of birth, addresses and loan-lead metadata.
SBI activated incident response, engaged a CERT-In-empanelled forensic firm and stated that core operations continued normally. The lender emphasised that authenticity and completeness of the dump required further investigation—common when criminals mix stale and fabricated rows to raise extortion pressure.
Sector response
Non-bank lenders told ETCISO they were reviewing third-party loan origination stacks and API scopes, especially endpoints that can trigger outbound payments without a human authoriser. NBFC associations circulated CERT-In checklists requiring 180-day log retention and outbound traffic restrictions.
The episodes land after MeitY’s synthetic-media rules and a busy festival season when phishing volumes rise. Security chiefs said they are pairing API gateway rate limits with behavioural analytics on loan-reference numbers that do not match core banking records.
What customers should do
Retail users should enable transaction alerts, avoid sharing one-time passwords with callers claiming to be bank partners, and report unauthorised debits within the zero-liability windows card networks publish. Business correspondents must not store API keys in mobile note apps—a recurring finding in post-incident audits.
Institutions must file incidents to CERT-In and CSIRT-Fin at incident@cert-in.org.in when suspicious outflows appear, preserving disk images before rebooting compromised servers.
Outlook
RBI supervision and SEBI cyber circulars already expect board-level ownership; October’s twin headlines will feed into Q3 risk committee decks. Banerjee’s desk will track whether SBI’s forensic report triggers mandatory customer notifications under evolving digital personal data norms.
Until then, the verified facts are contained: twenty institutions warned on APIs, SBI probing thousands of exposed rows, and CERT-In demanding cleaner payout plumbing across the funnel that moves rupees from lender cores to customer accounts.
RBI and board oversight
The Reserve Bank’s supervised entities already face vulnerability assessment mandates; October’s incidents will appear in Q3 cyber returns to regulators. Boards that treated API security as a developer ticket rather than a treasury control are revisiting segregation of duties between loan origination and disbursement modules this weekend.
Customers should treat unsolicited loan-disbursal SMS confirmations as red flags, especially when amounts do not match apps they opened themselves.
Payment aggregators must re-certify webhook endpoints before Diwali shopping peaks, a quiet IT task with loud consequences if skipped.