CERT-In warns fintechs and NBFCs of KYC bypass via API hijacks

CERT-In and CSIRT-Fin issued a critical-severity advisory warning NBFCs, digital lenders, fintechs, payment providers and wallet operators about coordinated attacks enabling unauthorized fund transfers. Attackers steal payment gateway and partner-bank API credentials and call disbursal APIs directly, bypassing KYC, limits and beneficiary checks.

• The CERT-In advisory, dated October 9, 2026, carries a Critical severity rating
• Attackers invoke payment APIs from whitelisted infrastructure, bypassing KYC and transaction limits
• Funds are moved via IMPS and NEFT to mule accounts across multiple banks
• CERT-In cites possible AI-assisted tooling and log deletion by attackers