CERT-In warns fintechs of payment API hijacks moving money to mule accounts
Representative image: rupixen / Pixabay
CERT-In's critical advisory of October 9, 2026 warns NBFCs, lenders and payment firms that attackers are stealing payment API credentials to drain funds to mule accounts.
What Happened
India's national cyber security agency, CERT-In, issued a critical advisory on October 9, 2026 warning non-banking finance companies, digital lending platforms, payment service providers and wallet operators that attackers are hijacking their payment APIs to drain money into mule accounts. The advisory, numbered CIAD-2026-0046, was issued jointly with CSIRT-Fin, the computer security response team for India's financial sector. It says attackers are stealing the credentials that let a company's systems instruct payments, then using them to push transfers out directly, and it flags the possible use of AI-assisted attack tools.
Key Facts
- Advisory: CIAD-2026-0046, rated critical, issued on October 9, 2026 by CERT-In with CSIRT-Fin.
- Who is warned: NBFCs, digital lending platforms, payment service providers and wallet operators.
- Method described: theft of payment API credentials, followed by rapid transfers over IMPS and NEFT to mule accounts at several banks.
- Transfers reportedly carry dummy reference numbers, and attackers delete logs and tamper with endpoint security tools to hide their tracks.
- Controls targeted, according to reports: customer verification, loan creation and approval, beneficiary checks, balance checks and transaction limits.
- CERT-In flags possible use of AI-assisted attack frameworks, though reports note it does not say AI was used in every case.
- Recommended steps include multi-factor authentication, a full inventory of APIs, shutting unused ones, replacing static tokens, real-time monitoring and strict transaction limits.
Why It Matters
An API, or application programming interface, is how one piece of software talks to another. In fintech, APIs let a lending app create a loan, check a borrower and send money through the banking system in seconds. That speed is the product. It is also the weakness this advisory describes: if an attacker gets hold of the keys a company uses to call its own payment API, the system will treat their instructions as genuine.
What makes the pattern serious is that it goes around the safeguards fintechs rely on. Rather than tricking a customer, the attacker talks to the back end directly, skipping loan approval or beneficiary checks, and moves money in many quick transfers before anyone notices. Funds land in mule accounts, bank accounts rented or controlled by fraud networks, and are moved on again. Deleting logs makes it harder to trace what happened.
For India's start-up and fintech sector, the advisory is a reminder that security is part of the product, not an afterthought. Many young lending and payments companies build fast on cloud services and third-party integrations, and some still use long-lived static tokens or leave old test APIs running. CERT-In's list of fixes targets exactly those habits. Reports also describe a separate case in which an NBFC lost Rs 12.8 crore, with police alleging a syndicate organised through Telegram groups; that is a police allegation rather than an established finding.
Impact
Short-term: Fintechs, NBFCs and payment firms are expected to review their API keys, rotate static tokens, turn on multi-factor authentication and tighten transaction limits. CERT-In asks firms that spot suspicious activity to freeze affected accounts or APIs, preserve evidence and report to it promptly.
Long-term: Regulators and investors are likely to look harder at API security when assessing fintech companies. Start-ups that can show strong controls may find partnerships with banks easier to win.
Who is affected: Fintech start-ups, NBFCs, digital lenders, wallet and payment providers, their banking partners, and indirectly customers whose trust depends on these platforms staying secure.
Key Takeaway
CERT-In's October 9 critical advisory warns that attackers are stealing fintech payment API credentials to move money straight to mule accounts, and urges firms to lock down and monitor every API now.
Questions and Answers
What did CERT-In warn about on October 9, 2026?
In advisory CIAD-2026-0046, issued with CSIRT-Fin, it warned that attackers are stealing payment API credentials at NBFCs, lenders, payment providers and wallets, and using them to send money quickly to mule accounts.
What is a mule account?
A bank account used to receive and pass on stolen money, often rented from or opened in the name of someone else, so that the real criminals are harder to trace.
What should fintech companies do?
CERT-In recommends multi-factor authentication, a complete list of all APIs, closing unused ones, replacing static tokens, real-time monitoring and strict transaction limits, and quick reporting of any incident.
Are ordinary customers at risk?
The attacks target the companies' systems rather than individual users, but customers can be hit indirectly if a platform loses money or freezes services, so trust in a fintech's security matters.
Disclaimer: Prepared by the Peepals newsroom from publicly available sources with AI assistance. Information is accurate to the best of our knowledge at the time of publication and may change. Images may be representative. Not professional advice. Report an error via our contact page.
Sourced and fact-checked by the Peepals Global Editorial Team
Reported, fact-checked and published by the Peepals Global Editorial Team.
