CERT-In weekly summary
CERT-In updates 5-11 October 2026: BFSI payment API attacks
CERT-In warned NBFCs, fintechs and payment firms that attackers are calling disbursal APIs with stolen credentials to move funds.
The week in brief
What changed
Advisory CIAD-2026-0046 says attackers use stolen credentials to call payment and disbursal APIs from whitelisted infrastructure, bypassing KYC, beneficiary checks and transaction limits at NBFCs, digital lenders, fintechs, PSPs and wallets. Entities should enforce MFA, keep API keys in secret managers, add maker-checker on fund movements and report incidents to CERT-In or CSIRT-Fin.
Complied AI condensed the week's CERT-In records into the points above. Use the inline links to check each underlying update.
View all 1 records