Three checks before you trust a message asking for money

By Manuj Kumar Pandey, Founder & Director, Dunime Technologies. This first appeared in The Investigator's Brief, his fortnightly LinkedIn newsletter on fraud and cyber developments in India.

Most frauds I look at do not need malware or a zero-day. They need one person to act on one message before checking it: a supplier's "new bank account", a video call from "the police", a screenshot claiming your company has been breached.

This first edition of The Investigator's Brief gives you the three checks I run before I trust any of them. They take minutes, cost nothing and use only government portals and free public services. First, two CERT-In advisories from this fortnight that every IT and finance lead in India should read.

This fortnight: what changed

1. AI agents walked into Indian systems through doors we left open

On 15 October 2026, CERT-In issued advisory CIAD-2026-0049, rated Critical. AI model providers told CERT-In that agents under evaluation had reached live systems of Indian organisations and read business records, including personal and confidential data. They got in with credentials exposed in application configuration and public code repositories, and through over-permissive cloud roles. None of the affected organisations noticed. The providers found it in their own reviews.

In a separate campaign, attackers used open-source agentic offensive tools against Indian entities. CERT-In says this cut the time from first access to impact from days to a few hours, and victims who fixed things only partly were hit again within days.

Why it matters: every weakness on CERT-In's list is old: exposed keys, forgotten test APIs, cloud roles anyone can read. What changed is speed. A gap you would have found in next quarter's audit can now be used this afternoon.

Do this week: scan your repositories, including history, for secrets and rotate anything you find; list every API and switch off test and dormant ones; check what an anonymous user can read and write in your cloud and backend-as-a-service roles; keep logs for at least 180 days.

2. Payment APIs are the new target in BFSI

On 9 October, CERT-In advisory CIAD-2026-0046 described attacks on NBFCs, digital lenders, fintechs, payment service providers and wallet operators. Attackers steal payment-gateway and partner-bank API credentials, call disbursal APIs from the entity's own whitelisted servers, skip KYC and beneficiary checks, and move money over IMPS and NEFT to mule accounts.

Do this week: MFA on payment platforms and bank APIs; no long-lived static tokens; maker-checker approval on fund movement; per-transaction and daily limits enforced at the API; real-time alerts on new beneficiaries and unusual velocity.

3. The scam now arrives as an ad

The Indian Cyber Crime Coordination Centre (I4C) has started an awareness drive on malicious social media ads: deals, jobs and dating offers that lead to unrelated websites, malicious apps or fake payment pages. A professional-looking ad on a familiar platform proves nothing about where it sends you.

The three checks

Check 1: Is the company the company?

Before an advance payment, look the counterparty up on the government's own registers.

• MCA master data (mca.gov.in): search the name or CIN. Status must read Active, and the registered office should match the invoice.
• GST Search Taxpayer (gst.gov.in): a GSTIN carries its own proof. The first two digits are the state code and characters 3 to 12 are the PAN. If the state does not match the address, or the embedded PAN belongs to another legal name, it is not this company's GSTIN.
• Udyam verification: for any "registered MSME" claim on a quote or letterhead. It proves the business exists, not that it is honest.

Stop the payment if the MCA name, the GST name and the beneficiary name your bank or UPI app shows do not match, if a company asks to be paid into a personal account, or if bank details change by email. Confirm on a number you already had, never the one in the email.

Check 2: Is the authority real?

In October 2024, I4C said publicly that the CBI, police, customs, ED and judges do not arrest anyone on a video call. "Digital arrest" is a script: a parcel or SIM "linked to a crime", a uniform on screen, "tell no one", then money moved to "verify" you.

The isolation is the attack. Hang up, call the agency on a number you look up yourself, and tell one family member. If money has moved, call 1930 or file at cybercrime.gov.in at once; speed is what gets funds held. If nothing was lost, report the number on Chakshu, on the Department of Telecommunications' Sanchar Saathi portal.

Check 3: Is the breach real?

Breach claims arrive with a sample and a record count. Some are real. Many are older breaches repackaged, scraped public data, or lists stitched together from unrelated leaks. Ask three questions before you believe or share one:

1. Who is the source, and what is their track record?
2. Do the record count, the data fields and the dates agree with each other?
3. Has the company, CERT-In or a credible researcher verified it? If not, it is an allegation.

Never download the "sample": it is legal exposure and a common malware lure. If you might be affected, check your email on Have I Been Pwned (it only knows breaches that have been loaded into it), change reused passwords starting with email and banking, and turn on two-factor authentication. Expect phishing that quotes the breach; that is often the real damage.

For organisations, one rule matters most: CERT-In's Directions of 28 April 2022 require specified incidents to be reported within six hours of being noticed. Decide now who confirms, who files and what you send.

Free tool of the fortnight: gitleaks

For IT teams acting on the first advisory above. gitleaks is a free, open-source (MIT licence) scanner that finds API keys, tokens and passwords committed to git.

Scan every branch of a repository, with secrets masked in the output:

gitleaks git -v --redact --log-opts="--all" path/to/repo

Scan a folder of configuration files:

gitleaks dir -v --redact path/to/folder

The catch: it matches known secret patterns, so unusual or in-house credentials need your own rules. And anything it finds must be rotated, not just deleted from history. Once a key has sat in a public repository, assume someone has it.

Key takeaways

• Attackers did not get new doors this month; they got faster. Close exposed keys and open cloud roles first.
• Before paying anyone new: MCA status, GSTIN anatomy, beneficiary name.
• No agency arrests anyone on a video call. Hang up, then report on 1930 or Chakshu.

Your turn

Tell me in the comments which scam or breach claim you saw most this fortnight. The next edition, on 3 November, is built from readers' answers.

If this was useful, subscribe to The Investigator's Brief on LinkedIn and forward it to the person who approves payments in your organisation. Between editions, Dunime Technologies posts scam alerts and field playbooks on its LinkedIn page.

Sources

• CERT-In advisory CIAD-2026-0049, 15 October 2026: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0049
• CERT-In advisory CIAD-2026-0046, 9 October 2026: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0046
• CERT-In Directions under section 70B(6) of the IT Act, 28 April 2022 (six-hour incident reporting): https://www.cert-in.org.in
• I4C advisory on "digital arrest", October 2024 (The Tribune): https://www.tribuneindia.com/news/india/cbi-ed-dont-nab-via-video-calls-advisory-to-curb-digital-arrest/
• I4C awareness drive on malicious social media ads (ETV Bharat, 6 October 2026): https://www.etvbharat.com/en/bharat/i4c-launches-awareness-drive-as-fake-social-media-ads-become-the-new-cybercrime-trap-enn26100604507
• GST Search Taxpayer: https://services.gst.gov.in/services/searchtp
• National Cyber Crime Reporting Portal: https://cybercrime.gov.in
• Sanchar Saathi (Chakshu): https://sancharsaathi.gov.in
• gitleaks: https://github.com/gitleaks/gitleaks

Manuj Kumar Pandey, Founder & Director, Dunime Technologies. Full guides: dunime.com/insights