KYC API Hack: Is Your Fintech Account Safe?

CERT-In has warned fintechs and NBFCs about hackers breaking into KYC systems through API hijacks, possibly using AI tools, leading to fake accounts and unauthorised money transfers from real customers.

Here's what happened: CERT-In and CSIRT-Fin issued a Critical-level advisory on October 9, 2026, warning fintechs, NBFCs, digital lenders, payment providers, and wallet operators about coordinated cyberattacks targeting KYC systems.. Attackers are exploiting API vulnerabilities in the KYC verification layer to bypass identity checks, create fraudulent accounts, and trigger unauthorised fund transfers from genuine customer accounts.. The advisory specifically flags the use of AI-powered tools by attackers, allowing these KYC bypass campaigns to operate at scale across multiple platforms simultaneously..

What you should do: Log into every fintech and lending app you use and audit recent KYC activity — if you see any re-verification prompts you did not initiate, flag it immediately to the platform's official customer care number.. Freeze or reduce the credit or wallet limits on any fintech app you rarely use — a dormant account with a high limit is the easiest target in an API-level attack.. Enable transaction alerts via SMS (not just app push notifications) on all linked bank accounts so you catch any unauthorised transfer within minutes, even if your app is compromised..

Pro tip: Under RBI's digital lending guidelines, if a fund transfer is triggered without your explicit consent at the transaction level, you can dispute it as 'unauthorised' — file a complaint with RBI's Sachet portal within 3 days to maximise your recovery chances.

If this affects your borrowing choices, compare current personal loan options from 100+ lenders on GoCredit.