# CERT-In Alert: API Hijacks Bypassing KYC | FastKYC > CERT-In issued a critical advisory on 9 October 2026. Attackers are stealing payment API credentials and bypassing KYC, loan checks and limits. Source: https://www.fastkyc.com/blog/cert-in-api-hijacks-bypassing-kyc/ --- [Blog](/blog/)[Banking](/blog/topics/banking/) # How Attackers Are Bypassing KYC via API Hijacks: CERT-In Alert CERT-In issued a critical advisory on 9 October 2026. Attackers are stealing payment API credentials and bypassing KYC, loan checks and limits. Krithick TSoftware Engineer - 27 October 2026 - 2 min read On this page 1. [What CERT-In Observed](#what-cert-in-observed) 2. [How the Attack Typically Unfolds](#how-the-attack-typically-unfolds) 3. [Why This Matters for Lenders and Fintechs](#why-this-matters-for-lenders-and-fintechs) 4. [Key Recommendations from CERT-In](#key-recommendations-from-cert-in) 5. [Practical Takeaways for Compliance and Product Teams](#practical-takeaways-for-compliance-and-product-teams) 6. [Strengthen Your Onboarding and Transaction Controls](#strengthen-your-onboarding-and-transaction-controls) On this page 6 sections 1. [What CERT-In Observed](#what-cert-in-observed) 2. [How the Attack Typically Unfolds](#how-the-attack-typically-unfolds) 3. [Why This Matters for Lenders and Fintechs](#why-this-matters-for-lenders-and-fintechs) 4. [Key Recommendations from CERT-In](#key-recommendations-from-cert-in) 5. [Practical Takeaways for Compliance and Product Teams](#practical-takeaways-for-compliance-and-product-teams) 6. [Strengthen Your Onboarding and Transaction Controls](#strengthen-your-onboarding-and-transaction-controls) On 9 October 2026, CERT-In and its finance unit CSIRT-Fin issued a **Critical** severity advisory (CIAD-2026-0046). The warning is aimed at NBFCs, digital lending platforms, fintechs, payment service providers and wallet operators. The core issue is simple but serious: attackers are no longer just trying to fool the KYC process. They are skipping it entirely by calling payment and disbursement APIs directly. ## [What CERT-In Observed](#what-cert-in-observed) Threat actors compromise internet-facing applications, exposed APIs or privileged endpoints. They steal payment aggregator, gateway or partner-bank API credentials. Once they have valid credentials, they invoke the fund-transfer or disbursal APIs **from inside the organisation’s own whitelisted infrastructure**. Because the call comes from a trusted source, the usual application-level controls never run. These include: - Loan creation checks - KYC verification - Sanctions screening - Beneficiary verification - Balance sufficiency checks - Per-transaction limits Fraudulent transfers often carry dummy reference numbers, exceed normal limits, and land in mule accounts across multiple banks. Funds are withdrawn quickly via IMPS or NEFT. CERT-In also noted the possible use of AI-assisted tools, which is shortening the time between initial compromise and actual fund movement. ## [How the Attack Typically Unfolds](#how-the-attack-typically-unfolds) 1. Attackers find an exposed application, deprecated API, weak authentication or hardcoded credentials 2. They steal or harvest valid payment API tokens/credentials 3. They call the disbursal or fund-transfer API directly from a trusted network location 4. Application-level KYC, sanction and limit checks are completely bypassed 5. Money moves to mule accounts and is withdrawn immediately ## [Why This Matters for Lenders and Fintechs](#why-this-matters-for-lenders-and-fintechs) Strong KYC at onboarding is necessary, but it is no longer sufficient on its own. If the payment or disbursement layer can be reached with stolen credentials, the entire control chain can be skipped. This advisory highlights a shift from “identity fraud” to “process and API fraud”. The weakest link is often not the customer verification step, but the security of the systems that move money after verification. ## [Key Recommendations from CERT-In](#key-recommendations-from-cert-in) - Enforce multi-factor authentication (MFA) on payment platforms, admin portals and API access - Maintain a complete inventory of APIs and formally decommission unused or deprecated ones - Eliminate long-lived static tokens; use short-lived, per-session authentication - Require maker-checker or second-level approval for fund movements - Validate every payout against an approved loan or transaction record - Reject any reference ID that has no matching record in the system - Enforce transaction limits at the API layer itself, not only in the application - Restrict outbound traffic and improve logging (retain logs for at least 180 days) - Rotate credentials immediately if compromise is suspected and report to CERT-In/CSIRT-Fin ## [Practical Takeaways for Compliance and Product Teams](#practical-takeaways-for-compliance-and-product-teams) - Treat payment and disbursement APIs as high-risk assets - Ensure KYC and sanction checks cannot be bypassed by calling lower-level APIs - Add independent validation between the lending application and the actual fund-transfer service - Review third-party integrations and partner-bank API access regularly - Combine strong identity verification with robust API security and transaction monitoring Identity verification (PAN, Aadhaar, face match, liveness, bank account checks) remains the foundation. But the CERT-In advisory makes it clear that the systems surrounding those checks also need equal attention. ## [Strengthen Your Onboarding and Transaction Controls](#strengthen-your-onboarding-and-transaction-controls) Identity verification is the first line of defence. Make sure it is fast, accurate and difficult to spoof. - Real-time PAN, Aadhaar, face match and liveness checks - Bank account verification - Built for lending and fintech workflows - CERT-In - API Security - KYC Bypass - Fintech Fraud - Digital Lending Written by Krithick T, Software Engineer Krithick develops verification solutions at FastKYC, helping businesses simplify identity, financial, GST, and document verification across digital onboarding, KYC, KYB, and compliance workflows. ## Frequently Asked Questions (FAQs) What is the CERT-In advisory about? It warns that attackers are stealing payment API credentials and calling fund-transfer APIs directly, completely bypassing KYC and other application-level controls. When was the advisory issued? 9 October 2026. It carries a Critical severity rating. Who is affected? NBFCs, digital lending platforms, fintechs, payment service providers and wallet operators. How do attackers bypass KYC in these cases? They do not attack the KYC process itself. They skip it by invoking the payment or disbursement API with stolen valid credentials from a trusted network location. What are dummy reference numbers? Fraudulent transactions often use fake loan or transaction reference IDs that do not exist in the organisation’s records. Are AI tools being used in these attacks? CERT-In noted the possible use of AI-assisted offensive tooling, which appears to be reducing the time between compromise and fund transfer. What is the most important immediate step? Enforce MFA, remove long-lived static tokens, maintain an API inventory, and ensure every fund movement is validated against an approved record. Does this mean KYC is no longer important? No. Strong KYC is still essential. The advisory shows that KYC must be protected by equally strong controls on the systems that move money after verification. Should incidents be reported? Yes. Suspicious activity should be reported promptly to CERT-In/CSIRT-Fin at incident@cert-in.org.in. How can FastKYC help in this context? Strong, real-time identity verification (PAN, Aadhaar, face match, liveness, bank account checks) reduces the risk of synthetic or mule identities being onboarded in the first place. Combined with proper API security, it forms a more complete defence. ## Previous articles [All articles](/blog/) 1. 26 October 2026[Transportation](/blog/topics/transportation/) ### [FASTag Verification: Lookup, Status and Toll History](/blog/fastag-verification/) FASTag verification helps businesses check tag status, vehicle details and recent toll history. Explore available data, use cases and limitations. - [Harsine K U](https://www.linkedin.com/in/harsine) - 3 min read 2. 23 October 2026[Passport](/blog/topics/passport/) ### [Passport Verification : What It Is and How It Works for Businesses](/blog/passport-verification-api-how-it-works/) Learn how a Passport Verification API works and how FastKYC helps businesses streamline passport checks and digital onboarding. - Akshitha A V - 2 min read ## Ready to integrate? Talk to our team and we will map the checks your flow actually needs. [Book a Demo](/book-demo/) [Browse All APIs](/apis/) - One API key for every check - Verified against official Indian records - Built for onboarding at scale