India’s cyber defence agency says attackers are using stolen credentials and direct API calls to bypass safeguards and accelerate fraudulent transfers from non-bank lenders and payment providers.
India’s cyber defence agency has warned that a series of attacks on non-bank financial companies and other lenders may be speeding up because of the use of artificial intelligence, raising fresh concerns about the security of payment systems and application programming interfaces, or APIs, that link financial platforms. CERT-In said on 9 October that it had identified multiple intrusions affecting non-bank financial companies, digital lenders, fintech groups and payment providers, in which attackers stole credentials and used them to push through unauthorised transfers.
According to CERT-In, the campaign began with exploitation of weaknesses in internet-facing systems. Once inside, attackers obtained authentication details tied to payment providers and partner banks, then called APIs directly to bypass checks such as know-your-customer verification, loan approval controls and transfer limits. The agency said false transaction identifiers were used and funds were moved through accounts opened by the attackers at several banks before being withdrawn quickly.
CERT-In said the pace of the attacks had increased sharply in recent cases, cutting the time between the initial breach and the fraudulent transfer. That, it said, suggested the possible use of AI-enabled tools to automate or accelerate parts of the operation. The agency classified the threat as severe and urged financial institutions to adopt multi-factor authentication, dual approval for transfers and real-time transaction monitoring.
The warning comes against a wider backdrop of rising pressure on India’s financial sector. In a joint paper released by CERT-In, Mastercard and CSIRT-Fin, the organisations said API attacks on the country’s financial industry rose 62% by 30 June 2023 compared with 2022, with most incidents linked to security misconfigurations. The same paper said distributed denial-of-service attacks made up 34% of API attacks and recommended greater use of artificial intelligence and machine learning for live monitoring. Separately, a 2023 APCERT report said CERT-In handled 1,592,917 incidents and issued hundreds of alerts, advisories and vulnerability notes, underscoring the scale of the burden on India’s cyber defence system.
Outside India, recent industry data points to a broad rise in hostile activity. Check Point Research said organisations worldwide faced an average of 2,803 cyberattacks per week in September, up 16% from August and 48% from the same month a year earlier. That broader trend is likely to keep lenders, payment firms and regulators focused on hardening APIs and tightening controls around automated financial transactions.
Disclaimer: This article is intended to inform and educate, not to recommend or endorse any financial product, investment or strategy. Please consider your own financial circumstances and seek professional advice where appropriate before making financial decisions.
