NexusSec.Lenders move money for a living, which makes their payment systems a direct target. This post reflects what was published up to 1 November 2026.
What was reported
On 29 October 2026, reports said smaller non-banking financial companies (NBFCs) had lost nearly ₹300 crore to cyberattacks over a two-month period, with about 150 complaints filed. The reports did not name the institutions, the methods used in individual cases or an official source, and they described the figures as reported rather than confirmed. Treat the number as an indication of scale, not an audited total.
How CERT-In says these attacks work
CERT-In's advisory CIAD-2026-0046, issued on 9 October 2026 and rated critical, describes threat actors exploiting payment and disbursement APIs for unauthorised fund transfers in BFSI entities. It covers NBFCs, digital lending platforms, fintechs, payment service providers and wallet operators. According to the advisory, attackers:
- compromise internet-facing applications, exposed APIs or privileged endpoints, and steal payment gateway and partner-bank API credentials;
- call disbursement and fund-transfer APIs from the entity's own whitelisted servers, bypassing checks such as KYC, beneficiary verification, balance checks and transaction limits;
- use dummy reference numbers and send money to mule accounts at several banks, where it is withdrawn quickly;
- get in through unpatched middleware, old APIs with unrestricted file uploads, hard-coded long-lived tokens, exposed source code, plaintext credentials and accounts without MFA, then install web shells and tamper with logs.
CERT-In adds that some incidents suggest AI-assisted tooling that shortens the time between break-in and fraud. See AI agents in cyber attacks.
What to fix first
From CERT-In's list of countermeasures, these are the ones that stop money leaving:
- MFA on payment platforms, admin portals, payment and bank APIs, and remote access.
- Maker-checker approval for every fund movement, with each payout checked against an approved record. Reject reference numbers that match nothing.
- Limits at the API: per-transaction and daily limits enforced at the API and payment stages, plus beneficiary validation such as penny-drop and name matching.
- No long-lived static tokens: authenticate every API session, and keep keys in a secrets manager or HSM with regular rotation.
- An inventory of every API, with unused and deprecated ones switched off.
- Outbound allow-lists on production servers.
- Real-time monitoring of transfers for unusual amounts, speed and new beneficiaries, and near-real-time reconciliation with bank and aggregator statements.
- Logs, EDR and testing: central logs kept for at least 180 days, tamper-protected EDR on servers and endpoints, and regular VAPT that includes API security testing.
If something looks wrong
CERT-In asks entities to disable affected accounts and APIs, preserve forensic evidence, rotate all credentials and report to CERT-In and CSIRT-Fin at incident@cert-in.org.in. For fraud already in progress, call your bank straight away and use the national cybercrime helpline 1930 or cybercrime.gov.in. Our incident response plan guide covers the first hours.
