How Attackers Are Bypassing KYC via API Hijacks: CERT-In Alert

On 9 October 2026, CERT-In and its finance unit CSIRT-Fin issued a Critical severity advisory (CIAD-2026-0046). The warning is aimed at NBFCs, digital lending platforms, fintechs, payment service providers and wallet operators.

The core issue is simple but serious: attackers are no longer just trying to fool the KYC process. They are skipping it entirely by calling payment and disbursement APIs directly.

What CERT-In Observed#

Threat actors compromise internet-facing applications, exposed APIs or privileged endpoints. They steal payment aggregator, gateway or partner-bank API credentials.

Once they have valid credentials, they invoke the fund-transfer or disbursal APIs from inside the organisation’s own whitelisted infrastructure.

Because the call comes from a trusted source, the usual application-level controls never run. These include:

• Loan creation checks
• KYC verification
• Sanctions screening
• Beneficiary verification
• Balance sufficiency checks
• Per-transaction limits

Fraudulent transfers often carry dummy reference numbers, exceed normal limits, and land in mule accounts across multiple banks. Funds are withdrawn quickly via IMPS or NEFT.

CERT-In also noted the possible use of AI-assisted tools, which is shortening the time between initial compromise and actual fund movement.

How the Attack Typically Unfolds#

1. Attackers find an exposed application, deprecated API, weak authentication or hardcoded credentials
2. They steal or harvest valid payment API tokens/credentials
3. They call the disbursal or fund-transfer API directly from a trusted network location
4. Application-level KYC, sanction and limit checks are completely bypassed
5. Money moves to mule accounts and is withdrawn immediately

Why This Matters for Lenders and Fintechs#

Strong KYC at onboarding is necessary, but it is no longer sufficient on its own. If the payment or disbursement layer can be reached with stolen credentials, the entire control chain can be skipped.

This advisory highlights a shift from “identity fraud” to “process and API fraud”. The weakest link is often not the customer verification step, but the security of the systems that move money after verification.

Key Recommendations from CERT-In#

• Enforce multi-factor authentication (MFA) on payment platforms, admin portals and API access
• Maintain a complete inventory of APIs and formally decommission unused or deprecated ones
• Eliminate long-lived static tokens; use short-lived, per-session authentication
• Require maker-checker or second-level approval for fund movements
• Validate every payout against an approved loan or transaction record
• Reject any reference ID that has no matching record in the system
• Enforce transaction limits at the API layer itself, not only in the application
• Restrict outbound traffic and improve logging (retain logs for at least 180 days)
• Rotate credentials immediately if compromise is suspected and report to CERT-In/CSIRT-Fin

Practical Takeaways for Compliance and Product Teams#

• Treat payment and disbursement APIs as high-risk assets
• Ensure KYC and sanction checks cannot be bypassed by calling lower-level APIs
• Add independent validation between the lending application and the actual fund-transfer service
• Review third-party integrations and partner-bank API access regularly
• Combine strong identity verification with robust API security and transaction monitoring

Identity verification (PAN, Aadhaar, face match, liveness, bank account checks) remains the foundation. But the CERT-In advisory makes it clear that the systems surrounding those checks also need equal attention.

Strengthen Your Onboarding and Transaction Controls#

Identity verification is the first line of defence. Make sure it is fast, accurate and difficult to spoof.

• Real-time PAN, Aadhaar, face match and liveness checks
• Bank account verification
• Built for lending and fintech workflows