CERT-In Advisory CIAD-2026-0046: Payment API Fraud and the Controls Lenders Need Now

On 9 October 2026, CERT-In issued a critical advisory, CIAD-2026-0046, warning that attackers are calling disbursal and fund-transfer APIs directly from inside NBFCs, digital lenders, fintechs, payment service providers and wallet operators. These calls skip KYC, sanctions, beneficiary, and limit checks, and send money to mule accounts over IMPS and NEFT.

This CERT-In advisory deserves close reading by anyone who owns a payout rail. It describes attackers already inside the lender’s infrastructure, holding valid partner-bank and payment aggregator credentials, moving money the lender’s own systems would never have approved.

The practical question is simple: if a disbursal call arrived tonight with no loan behind it, which control would stop it? Below: what the CERT-In advisory says, why it matters, and a checklist mapping each attack step to a control.

What the CERT-In advisory says

The CERT-In advisory, CIAD-2026-0046, is titled “Threat Actors Exploiting Payment and Disbursement APIs for Unauthorized Fund Transfers in BFSI Entities”. CERT-In rated it Critical, and it was issued with CSIRT-Fin, the finance-sector incident response unit.

The CERT-In advisory names five groups as affected: NBFCs, digital lending platforms, fintech firms, payment service providers and wallet operators. As MediaNama noted on 14 October, it names no victim and gives no count of incidents or amounts lost.

Three observations stand out: attackers invoke disbursal APIs “directly from within the entities’ own whitelisted infrastructure”, so IP allow-listing at the bank does not help; the time from compromise to fraud is shrinking; and CERT-In flags possible AI-assisted offensive tooling.

Incidents are to be reported to [email protected] with relevant logs. This sits alongside the existing CERT-In Directions of 28 April 2022, which require reporting of specified cyber incidents within six hours and retention of ICT system logs for 180 days.

How the attack chain works

The CERT-In advisory describes a four-stage pattern. Each stage offers a different place to break the chain.

1. Initial Access: Attackers exploit internet-facing applications and middleware, abuse deprecated or unauthenticated APIs (including unrestricted file upload), use long-lived static API tokens hard-coded in source code, forge commits into repositories, and harvest plaintext credentials from configuration files and databases. Systems without multi-factor authentication are a common entry point.
2. Persistence and Reconnaissance: They plant web shells and backdoors, map payment databases and API integrations, and steal payment aggregator, gateway, and partner-bank API credentials.
3. Fraudulent Transfers: They call disbursal APIs directly, bypassing loan creation, KYC, sanctions screening, beneficiary verification, balance checks, and per-transaction limits. Transfers use dummy reference numbers, breach limits, and move through IMPS and NEFT to mule accounts at multiple banks, where the money is withdrawn quickly.
4. Anti-Forensics: They delete or truncate logs and tamper with endpoint detection and response (EDR) tools.

The flaw being exploited: business checks live in the application layer, while the payout API trusts any authenticated caller.

Why this matters for lenders, PAs and wallets

Most Indian lending stacks were built for fast disbursal: the loan system approves, a disbursal service calls a partner bank or PA, and money lands in minutes. That design assumes only the loan system ever calls the disbursal service. The CERT-In advisory shows that assumption failing. Three consequences follow: – Fraud loss sits with the entity. Money sent to mule accounts over IMPS is hard to recall, and the advisory notes immediate withdrawal. – Regulatory exposure is layered. The same incident can trigger CERT-In reporting, RBI fraud reporting and, where personal data is accessed, obligations under the DPDP framework.

It also connects to RBI’s focus on mule accounts: MuleHunter.AI was announced in December 2024, and the 2026 draft KYC amendments on mule-account holds remain a draft. Lenders should not assume the receiving bank will catch the mule.

A control checklist mapped to the attack chain

The table below maps each stage the advisory describes to the controls it recommends. Ownership is indicative; your own RACI should decide it.

Two points are easy to miss. The CERT-In advisory asks for limits and validation at the API and payment stage, not only in the front end. And it asks for checks on all disbursement paths, including refunds, settlements, and manual payout tools.

Beneficiary verification: what it catches and what it does not

The CERT-In advisory names “penny-drop and name-to-account matching” as a beneficiary validation control. Beneficiary verification confirms that a bank account exists, is active, and is held by a person whose name matches the approved borrower or payee.

In the attack the advisory describes, the payout goes to a mule account that has no link to any approved borrower. A mandatory check that compares the destination account holder with the approved record would fail that payout, provided the check is enforced at the payment layer and cannot be skipped by calling the bank API directly.

Beneficiary verification has limits: – It does not stop an attacker who already holds your bank API credentials from calling the bank directly. Only credential, network, and flow-binding controls do that. – It cannot catch a mule account opened in the borrower’s own name, which is why velocity and new-beneficiary monitoring still matter. – It adds value only if the verified result is bound to the payout record, so the debit cannot proceed without a matching, recent verification.

RBI’s own direction to banks, issued on 30 December 2024, to offer a beneficiary name look-up for RTGS and NEFT by 1 April 2025 follows the same logic for customer payments.

Where BeFiSc fits: IDProof provides bank account verification through penny drop with name match, which lenders and PAs can call before each disbursal to confirm the destination account belongs to the approved borrower or payee. BeFiSc does not secure your APIs, manage your credentials, or replace the security controls CERT-In lists; IDProof is one input to the beneficiary validation step. We offer a demo of payout beneficiary verification on your own flow.

Real-world scenarios

These scenarios are illustrative and are not drawn from any reported incident.

Scenario 1: The orphan disbursal. A digital lender’s disbursal service accepts any call carrying a valid internal token. An attacker with a stolen token triggers 40 payouts with reference IDs that do not exist in the loan system. A payout-validation rule that looks up each reference ID in the approved-loans table, plus a mandatory name match against the borrower record, would reject every one of them.

Scenario 2: the edited bank account. An attacker with database access changes a sanctioned borrower’s bank account to a mule account just before disbursal. The loan record looks valid. A fresh penny drop at payout time returns a name that does not match the borrower, and the payout is held for review.

Key Takeaways

• CERT-In advisory CIAD-2026-0046 (9 October 2026, Critical) describes attackers calling disbursal APIs from inside lenders' own infrastructure to transfer funds to mule accounts.
• The core weakness is business checks that exist only in the application layer, while payout APIs trust any authenticated caller.
• The advisory's controls cover authentication, secrets management, network isolation, flow binding, API-layer limits, beneficiary validation, monitoring, reconciliation, and logging.
• Beneficiary verification through penny drop and name matching is one named control. It must be linked to the payout record to be effective.
• No single vendor control can replace credential hygiene, multi-factor authentication (MFA), and API governance.
• Suspicious activity should be reported to [email protected] with relevant logs, within the existing CERT-In reporting timelines.

Conclusion

This CERT-In advisory is a warning about architecture more than about any single exploit. When the payout API trusts anything that can authenticate, every upstream check becomes optional for an attacker who gets inside.

Lenders and payment businesses should treat the CERT-In advisory’s control list as a gap assessment: inventory APIs, kill static tokens, bind payouts to approved records, enforce limits at the API layer, and verify every beneficiary before money moves. Beneficiary verification is the part BeFiSc can help with; the rest belongs to your security and engineering teams.