When Attackers Bypass the Banking Application: The Rise of Direct Payment-API Fraud
Financial cybercrime is entering a more dangerous phase. For years, much of the public discussion around digital financial fraud has focused on phishing links, stolen passwords, account takeover, malicious mobile applications and social-engineering scams. Those threats remain important. But a recent warning from India’s Computer Emergency Response Team (CERT-In) and CSIRT-Fin highlights something considerably deeper: attackers are targeting the infrastructure behind financial applications and directly invoking the APIs responsible for moving money. On 9 October 2026, CERT-In/CSIRT-Fin reported multiple cyberattack campaigns affecting non-banking financial companies, digital-lending platforms, fintech companies, payment service providers and wallet operators. The attackers were observed compromising internet-facing applications, exposed APIs and privileged endpoints before stealing payment-gateway, aggregator or partner-bank API credentials. The significance is not simply that credentia...