India's banking and fintech sector is facing questions over the security of interconnected payment systems after cyberattacks reportedly affected 20 institutions in October 2026. A critical CERT-In advisory has identified how attackers used compromised credentials and trusted banking connections to initiate unauthorised transfers.
Cybercriminals reportedly targeted around 20 financial institutions in India earlier this month, exploiting stolen partner-bank credentials and weaknesses in payment systems to carry out unauthorised fund transfers. The incidents have raised concerns about the security of banking applications, digital lending platforms and the technology connections that allow financial institutions to process payments.
According to a 15 October report by The Economic Times, banks, NBFCs and fintech firms were among the affected organisations. People familiar with the incidents said the institutions restricted payment and disbursement application programming interfaces (APIs) after detecting suspicious activity.
The names of the 20 affected financial institutions have not been publicly disclosed or independently verified.
The development follows a critical warning from the Indian Computer Emergency Response Team (CERT-In), which documented multiple cyberattack campaigns against India's financial services sector.
In its 9 October 2026 advisory, CIAD-2026-0046, CERT-In said attackers had compromised exposed financial applications, stolen payment gateway and partner-bank credentials, and used those credentials to initiate transfers through systems that banks already trusted.
In some cases, the attackers bypassed checks that would ordinarily prevent a payment from proceeding, including Know Your Customer (KYC) verification, loan sanction, beneficiary validation, available balance verification and transaction limits.
The attacks come as India's wider cybersecurity threat count continues to rise. Official figures show that CERT-In tracked 29.44 lakh cybersecurity incidents in 2025, compared with 20.41 lakh in 2024. The increase of approximately 44.2% highlights the growing volume of threats facing the country's digital infrastructure, although these figures cover multiple sectors and types of cybersecurity incidents, not banking attacks alone.
Also Read | Why a Bank Fraud Detection System May Freeze Your Money Now
What we know about the affected institutions
| Type of institution | Reported involvement | Response reported |
|---|---|---|
| Banks | Included among reportedly affected financial institutions | Restricted payment and disbursement APIs |
| NBFCs | Included among reportedly affected financial institutions | Restricted vulnerable interfaces and strengthened payment controls |
| Fintech companies | Included among reportedly affected financial institutions | Blocked unauthorised access and reviewed transaction safeguards |
| Digital lending platforms | Specifically identified as targets in CERT-In's advisory | CERT-In advised validating disbursements against approved loans |
| Payment service providers | Identified as targets in CERT-In's advisory | CERT-In recommended stronger authentication and transaction monitoring |
| Digital wallet operators | Identified as targets in CERT-In's advisory | CERT-In recommended reviewing exposed APIs and credentials |
What Happened in the Cyberattacks on 20 Financial Institutions?
The latest incidents appear to have targeted the systems connecting financial institutions with banks, payment gateways and digital lending platforms.
These connections use APIs, which allow one software system to communicate with another. In digital lending, for example, an API can instruct a partner bank to transfer an approved loan amount to a customer's account after the lender completes the necessary checks.
Investigators and security teams are now dealing with a different type of risk: attackers who gain access to the payment connection itself and attempt to send transfer instructions without completing the normal approval process.
The Economic Times report cited a technology platform originally developed by a Chennai-based software company as a possible source of vulnerabilities in the affected payment infrastructure. According to a person familiar with the matter, weaknesses in the platform's payout controls allegedly enabled payments without the checks ordinarily required before disbursement.
However, the software provider's identity and the total financial losses have not been independently established.
CERT-In's advisory provides a broader account of the techniques identified across the attack campaigns. It describes attackers using compromised credentials from within a financial institution's own approved infrastructure to execute transfers that could appear legitimate to connected banking systems.
CERT-In October 2026 Advisory: What the Government Warned
CERT-In identified several ways in which attackers gained access to financial systems. These included internet-facing applications with security weaknesses, unused APIs without proper authentication, exposed passwords and long-lasting access tokens embedded in software.
In certain campaigns, attackers also tampered with software development repositories or gained access to remote services that lacked multi-factor authentication.
Once inside, they searched for credentials used by the institution to connect with payment gateways or partner banks. Those credentials allowed them to send payment instructions through the institution's own systems.
The most concerning finding was the ability to bypass checks meant to establish whether a payment was backed by an approved customer transaction.
CERT-In documented cases involving fabricated transaction references, payments exceeding prescribed limits and funds being credited to bank accounts controlled by attackers.
The agency also identified fraudulent transfers carried out through IMPS & NEFT. In some incidents, attackers attempted to delete system logs or interfere with security monitoring tools after executing transfers, making investigations more difficult.
Also Read | RBI cybersecurity guidelines for banks
How Hackers Exploited Banking APIs and Stolen Credentials
- Initial breach: Attackers exploited a vulnerable application, exposed API or stolen access credential.
- Payment access: They obtained credentials connecting the financial firm to a bank or payment provider.
- Bypassing approvals: Transfer instructions were sent without completing the usual customer and transaction checks.
- Unauthorised payout: Funds were directed to accounts controlled by attackers, sometimes using fabricated references.
- Withdrawal and concealment: Funds could be withdrawn rapidly, while attackers attempted to hide evidence of the transactions.
Source: CERT-In advisory CIAD-2026-0046. This summarises the observed attack methods and does not mean every step occurred at each of the 20 reportedly affected institutions.
Security gaps identified by CERT-In
| Security weakness | Risk for financial institutions |
|---|---|
| Exposed payment APIs | Attackers may access payment functions directly |
| Stolen bank API credentials | Fraudulent instructions can appear to come from a trusted institution |
| Inadequate loan verification | Payments may proceed without an approved loan |
| Weak beneficiary checks | Money can be transferred to unauthorised accounts |
| Missing transaction limits | Larger or repeated fraudulent payouts may pass unchecked |
| Unused or outdated APIs | Neglected software connections provide additional entry points |
| Insufficient authentication | Compromised accounts may give attackers access to payment operations |
| Weak monitoring and logging | Suspicious transactions may be detected late, and evidence may be lost |
Source: CERT-In
Cybersecurity Incidents in India: Latest Government Data
The latest attacks have emerged against a background of rising cyber incidents across India.
According to government data released by the Ministry of Home Affairs in March 2026, CERT-In tracked 29,44,248 cybersecurity incidents in 2025, compared with 20,41,360 a year earlier.
The number increased by approximately 9.03 lakh in a single year. Compared with 2021, reported and tracked incidents more than doubled.
Source: Ministry of Home Affairs, Parliament response, 24 March 2026
India's digital payment network is processing over 24 billion UPI transactions a month
The security warning comes at a time when digital payments are handling a growing share of everyday transactions in India.
Data from the National Payments Corporation of India (NPCI) shows that the Unified Payments Interface (UPI) processed 24.07 billion transactions in September 2026, with a total transaction value of approximately ₹29.37 lakh crore.
The number of banks live on UPI reached 756 during the month. The monthly figures show the scale of the digital payment network and the importance of keeping banking technology connections secure.
UPI transaction data, April to September 2026
| Month | Transactions (billion) | Value (₹ lakh crore) | Banks live on UPI |
|---|---|---|---|
| April 2026 | 22.35 | 29.03 | 713 |
| May 2026 | 23.20 | 29.90 | 720 |
| June 2026 | 22.72 | 28.92 | 731 |
| July 2026 | 23.66 | 29.88 | 741 |
| August 2026 | 24.51 | 29.82 | 752 |
| September 2026 | 24.07 | 29.37 | 756 |
Did hackers use artificial intelligence in the attacks?
CERT-In has identified indications of possible AI-assisted offensive activity in the campaigns targeting financial firms.
Its advisory noted the use of large numbers of custom scripts and a reduction in the time between the initial compromise of a system and the execution of fraudulent transfers.
However, the advisory does not establish that artificial intelligence was used in every attack or identify a particular AI system responsible for the incidents.
The warning follows the release of the Digital Threat Report 2025-26 on 13 July 2026 by the Ministry of Electronics and Information Technology, CERT-In, CSIRT-Fin and cybersecurity company SISA.
The report found that six of the seven threat predictions identified in its previous edition had already materialised. It also highlighted how stolen identities, compromised software connections and supply-chain weaknesses can allow attackers to operate through systems that appear to be functioning normally.
According to the government, the report identified a widening gap between the speed at which attackers can exploit technology and the pace at which organisations can strengthen their defences.
The report proposed an 18-month roadmap for improving cybersecurity controls, continuous monitoring and coordinated incident response across financial institutions.
Also Read | Top Digital Banks of India | Exclusive Ranking & Report
Security Measures Recommended by CERT-In
Following the attacks, CERT-In has urged financial institutions to review the systems that connect their applications to banks and payment providers.
A central recommendation is to make every transfer dependent on a valid, approved financial transaction. A banking API should not be able to release funds merely because the instruction comes from an authorised server.
The agency's recommendations include:
- Stronger authentication: Require multi-factor authentication for payment systems, administrative accounts, banking APIs and remote access.
- Review all APIs: Identify and disable unused, outdated or unsecured software connections.
- Link payments to verified records: Reject disbursements that do not correspond to an approved loan or other authorised transaction.
- Enforce payout limits: Apply transaction and daily payment limits at the payment-processing stage.
- Verify beneficiaries: Check recipient names and accounts before funds are released.
- Introduce second-level approvals: Require independent authorisation for fund movements.
- Protect bank credentials: Store sensitive access credentials securely and replace compromised or long-lasting tokens.
- Monitor transactions continuously: Detect unusual amounts, repeated transfers and payments to recently added beneficiaries.
- Reconcile bank records: Compare internal transaction records with bank and payment provider statements as close to real time as possible.
- Preserve security evidence: Maintain centralised logs for at least 180 days and protect monitoring systems against interference.
Also Read | UPI fraud and bank account safety
What do the cyberattacks mean for bank customers?
The reports do not establish that customers across the 20 affected institutions have lost money from their personal bank accounts. The confirmed technical warning concerns compromised institutional applications and payment credentials.
Nevertheless, the incidents underline the need for customers to monitor banking activity and report unauthorised transactions without delay.
Customers who notice an unfamiliar debit should immediately contact their bank through its official helpline or app, request that the transaction be investigated and secure any potentially compromised credentials.
Suspected financial cybercrime can also be reported through the national cybercrime helpline, 1930, or the government portal at cybercrime.gov.in.
Banking cybersecurity in India faces a test beyond password protection
The October attacks have brought attention to how financial institutions validate payments made through connected software platforms.
The concern is not limited to whether a criminal can steal a password. It is whether the financial system can detect and stop an unauthorised transfer when the instruction appears to come from a trusted application.
CERT-In's findings show why banking security must extend to every stage of a transaction, from customer verification and loan approval to beneficiary checks, payment authorisation and settlement monitoring.
With digital transaction volumes continuing to grow, the safeguards built into the systems connecting banks, NBFCs and fintech companies are becoming increasingly important.
The full impact of the reported cyberattacks has yet to be established. What is clear from the government's advisory is that financial institutions cannot depend on valid credentials alone as proof that a payment is legitimate.