Cyberattacks Hit 20 Indian Financial Institutions; CERT-In Issues Critical Warning

Mumbai, October 15, 2026: Around 20 Indian financial institutions were reportedly affected by cyberattacks earlier this month, raising concerns about payment security across banks, NBFCs and fintech companies.

According to The Economic Times, attackers used stolen credentials and weaknesses in payment application programming interfaces (APIs) to carry out unauthorised fund transfers.

India's cybersecurity agency, CERT-In, issued a critical advisory on October 9, 2026, warning financial institutions about attacks targeting payment systems and digital loan disbursal processes.

The advisory described attempts to bypass loan approvals, customer verification and transaction controls.

Key Highlights of the Cyberattacks

• Around 20 institutions reportedly affected: The figure comes from The Economic Times, not a confirmed count in CERT-In's public advisory.

• Critical security warning: CERT-In issued advisory CIAD-2026-0046 on October 9.

• Payment systems targeted: Attackers exploited weaknesses in APIs and compromised credentials.

• Digital lenders included: NBFCs, fintech companies and payment service providers were among the sectors identified.

• Unauthorised transfers: CERT-In reported fraudulent transactions involving IMPS and NEFT.

• Loan verification bypasses: Attackers attempted to circumvent KYC, loan approval and beneficiary checks.

• Stronger security recommended: Institutions were advised to improve authentication, transaction monitoring and payment verification.

1. What Happened in the Cyberattacks?

The reported incidents involved attackers targeting systems used by financial institutions to process payments and transfer funds.

Instead of following the normal transaction process, attackers allegedly gained access to trusted interfaces and attempted to send payment instructions without proper authorisation.

Cyberattack Details at a Glance

What Makes This Incident Serious?

The attacks highlighted several security concerns:

1. Stolen credentials can provide access to systems that process financial transactions.

2. Poorly secured APIs can expose payment functions to unauthorised users.

3. Weak transaction checks can allow payments without matching approval records.

4. Automated attacks can move money quickly.

5. Third-party technology connections can create additional security risks.

The total financial losses and the identities of all affected institutions have not been publicly established in the cited reporting.

2. How Did Hackers Target Payment and Loan Systems?

Financial institutions use APIs to connect their applications with banks, payment processors and other technology providers.

For example, after a digital loan is approved, an API may help send the disbursal instruction to a banking partner.

These connections are useful, but they must be properly secured.

Five Attack Methods Identified by CERT-In

1. Stolen payment credentials

Attackers obtained credentials associated with financial service providers and attempted to use them to access payment functions.

2. Vulnerable or outdated APIs

Some attacks involved exposed interfaces that were outdated, poorly secured or no longer needed.

3. Bypassed loan approval controls

Attackers attempted to send disbursal instructions without genuine loan approval records.

4. Manipulated beneficiary information

Weak verification processes could allow money to be transferred to unintended accounts.

5. Rapid transfers to mule accounts

Stolen funds were moved through accounts used to receive or transfer money on behalf of criminal networks.

Security Weaknesses and Possible Consequences

3. Which Financial Institutions Could Be Exposed?

CERT-In's advisory identified several types of financial businesses whose systems may be targeted.

These include:

• Non-banking financial companies (NBFCs)

• Digital lending platforms

• Fintech companies

• Payment aggregators

• Payment service providers

• Digital wallet operators

• Banking and technology partners

Important: This does not mean every company in these categories was attacked.

The advisory discusses security risks and observed attack activity across these sectors. It does not establish that Pocketly or its lending partners were among the affected institutions.

4. How Can a Loan Disbursal API Be Misused?

Consider a simplified digital lending process.

Normal Loan Disbursal Process

1. A customer submits a loan application.

2. The lender verifies identity and eligibility.

3. The lender reviews and approves or rejects the application.

4. An approved loan receives a valid reference number.

5. The payment system verifies the transaction details.

6. Funds are transferred to the verified beneficiary account.

What Can Go Wrong During an API Attack?

1. An attacker obtains access to a payment interface.

2. The attacker attempts to submit an unauthorised payment request.

3. Weak controls fail to validate the loan reference or approval status.

4. The system processes the payment request.

5. Money is transferred to an account controlled by the attacker.

This is an illustrative explanation of the risk, not a reconstruction of a specific institution's breach.

5. What Security Measures Has CERT-In Recommended?

CERT-In advised financial institutions to strengthen the security of their payment systems and connected applications.

Recommended Security Measures

Five Priorities for Financial Institutions

1. Review payment API access: Identify who and what can initiate transactions.

2. Secure third-party connections: Check the controls used by technology and banking partners.

3. Validate every disbursal: Ensure payment requests match authorised loan records.

4. Monitor suspicious activity: Investigate unusual payment amounts, beneficiaries and transaction patterns.

5. Prepare an incident response plan: Establish procedures for securing systems, preserving evidence and reporting attacks.

6. Are Digital Loan App Users at Risk?

The reported attacks primarily involved institutional payment systems.

The available information does not establish that every customer's bank account or personal data was compromised.

However, people using digital financial services should remain careful about suspicious messages, fake applications and unauthorised transactions.

Seven Safety Tips for Digital Loan Users

1. Download loan apps only from official websites or recognised app stores.

2. Check the identity of the regulated bank or NBFC providing the loan.

3. Never share banking OTPs, UPI PINs or account passwords.

4. Avoid loan offers received through suspicious links or unknown messaging groups.

5. Read the Key Facts Statement before accepting a loan.

6. Review bank transaction alerts regularly.

7. Report unauthorised transactions immediately.

You can also read Pocketly's guide on how to identify fake loan apps in India.

Genuine Loan App vs Suspicious Loan App

No single check guarantees that an app is safe. Borrowers should consider the full set of warning signs.

7. What Should You Do After an Unauthorised Bank Transaction?

If you notice money leaving your account without permission, quick action matters.

Immediate Action Checklist

1. Contact your bank: Report the transaction through its official helpline or app.

2. Secure your account: Follow the bank's instructions to block compromised access.

3. Call 1930: Use India's national cybercrime reporting helpline.

4. File a complaint online: Visit cybercrime.gov.in.

5. Preserve evidence: Save transaction IDs, messages and screenshots.

6. Change compromised passwords: Update affected accounts using a trusted device.

7. Follow up: Keep the bank's complaint reference number and monitor the investigation.

Where to Report Financial Cyber Fraud

Recovery of funds is not guaranteed and depends on the circumstances and applicable rules.

8. Why Does This Matter for India's Digital Lending Industry?

Digital lending has made it easier for eligible borrowers to apply for loans online.

But faster processing also creates a need for stronger technology controls.

Four Lessons for the Industry

• Speed must not replace verification. Fast loan disbursals still require valid approvals and transaction checks.

• API security matters. Financial institutions need to protect the connections between lending and payment systems.

• Technology partners need oversight. A weakness in a connected provider can create risks for other businesses.

• Fraud monitoring must be continuous. Institutions need systems that identify suspicious activity promptly.

How Cybersecurity Connects to Borrower Trust

9. What Should Borrowers Know Before Applying for a Digital Loan?

Cybersecurity is one part of choosing a financial service.

Borrowers should also understand the loan's affordability and repayment obligations.

Before applying, review:

• The name of the lending institution

• Loan eligibility requirements

• Interest rate and APR

• Processing fees and other charges

• Repayment tenure

• Monthly EMI

• Late-payment charges

• Customer support and grievance details

For more information, explore Pocketly's personal loan options and review the applicable terms before applying.

Conclusion

The reported cyberattacks affecting around 20 Indian financial institutions show why payment security matters across banks, NBFCs and fintech companies.

CERT-In's October 9 advisory highlights the importance of protecting payment APIs, verifying loan disbursals and detecting suspicious transfers.

For borrowers, the practical lessons are straightforward:

1. Use verified financial platforms.

2. Protect your banking credentials.

3. Understand the lender and loan terms.

4. Check account activity regularly.

5. Report suspicious transactions without delay.

Explore Pocketly to learn about digital personal loan options and review applicable eligibility, charges and repayment terms.

Frequently Asked Questions

1. How many financial institutions were affected by the October 2026 cyberattacks?

Around 20 institutions were reportedly affected, according to The Economic Times. CERT-In's public advisory confirms multiple attacks but does not provide that exact count.

2. What did CERT-In warn about?

CERT-In warned about attacks targeting payment APIs, compromised credentials and attempts to bypass transaction verification controls.

3. Were NBFCs affected by the cyberattacks?

CERT-In identified NBFCs among the targeted sectors. The advisory does not publicly name every affected institution.

4. What is a payment API cyberattack?

It involves exploiting the software connections used to process payment instructions, potentially allowing unauthorised transactions.

5. Can hackers bypass digital loan approval systems?

Weakly secured systems may be vulnerable to attempts to bypass approval checks. Strong validation and payment controls help reduce this risk.

6. Are digital loan apps safe to use?

Safety depends on the lender, platform and security practices. Borrowers should use official channels, verify the lending institution and protect their banking credentials.

7. What should I do if money is transferred without my permission?

Contact your bank immediately, report the incident through 1930 or cybercrime.gov.in and preserve the transaction evidence.

8. What is a mule account?

A mule account is an account used to receive or transfer money on behalf of another party, sometimes as part of financial fraud.

This article is intended for financial awareness. It does not suggest that Pocketly or its lending partners were affected by the reported incidents.

Sources

1. CERT-In — Official Critical Advisory CIAD-2026-0046, issued October 9, 2026. Read the official CERT-In advisory. This is the primary source for the attack methods and recommended safeguards.

2. The Economic Times — Cyberattacks Affect 20 Financial Institutions, published October 15, 2026. Read the original news report. This is the source for the reported number of affected institutions.

3. Moneycontrol — CERT-In Warns NBFCs and Fintech Firms, published October 10, 2026. Read the cybersecurity report.