CERT-In Warns Fintechs of API Hijacking Risks

India's Computer Emergency Response Team (CERT-In), along with its finance-focused cybersecurity arm CSIRT-Fin, has alerted NBFCs, digital lending platforms, fintech firms, and payment service providers to sophisticated cyberattack campaigns. These attacks reportedly bypass Know Your Customer (KYC) requirements through API hijacking, leading to unauthorized fund transfers. The advisory suggests that attackers may be leveraging AI tooling for these operations.

The "critical" severity advisory, issued on October 9, details how threat actors compromise internet-facing applications and APIs. They then steal credentials for payment aggregators or partner banks and invoke disbursement APIs directly from the entity's own whitelisted infrastructure. This method circumvents application-level controls such as loan creation, KYC checks, and beneficiary verification.

Fraudulent transactions identified in the advisory often feature dummy reference identifiers, exceed per-transaction limits, and credit funds to attacker-controlled mule accounts across various banks. Funds are quickly moved through instant payment networks like IMPS and NEFT and withdrawn immediately. CERT-In notes a significant reduction in the time between initial compromise and fraudulent transfer, indicating advanced and rapid execution.

CERT-In recommends that entities enforce multi-factor authentication (MFA) on payment platforms and admin portals, replace static credentials with per-session authentication, and decommission unused APIs. The advisory also highlights the need for enhanced threat detection and improved monitoring capabilities.

While the technical recommendations are standard security practices, their effective implementation and the overall efficacy of CERT-In's reporting mechanism have been questioned by cybersecurity experts. Concerns include the potential for nominal compliance without robust security and the one-way flow of information to CERT-In without clear accountability for data confidentiality or tangible returns for reporting entities.