Attention, UPI Users! Why Have Banks Issued a Warning to Fintech Companies?

In light of the rising cyber fraud associated with UPI and digital payments, banks have urged Fintech companies to strengthen their merchant verification processes and enhance the security of their fund-transfer systems.

Nowadays, everything from small, everyday purchases to the payment of large bills can be handled via UPI and other digital payment methods. While this has made life more convenient, the growth of online payments has also brought an increased risk of cyber fraud. Consequently, banks are now focusing on bolstering the security frameworks of companies involved in digital payments.

Banks have instructed Fintech companies to implement stricter vetting for the merchants and businesses that join their platforms. Furthermore, they have been advised to increase the monitoring of fund-transfer systems and to conduct thorough checks before facilitating payments to new bank accounts. This raises the question: what kind of fraud is occurring within the digital payment ecosystem?

What Have Banks Told Fintech Companies?

Banks have become increasingly cautious regarding Fintech companies that facilitate digital payments and money transfers. They have directed their partner Fintech firms to rigorously verify new merchants—such as shopkeepers and business owners—before onboarding them onto their platforms.

Additionally, banks have requested a re-verification of the bank account details where business funds are deposited. They have also advised strengthening controls over "automated payout systems"—a mechanism that allows companies to send funds to thousands of bank accounts simultaneously. If these systems are not properly vetted, cybercriminals could exploit them to divert funds into unauthorized or fraudulent accounts.

What Happens If an API Key Is Stolen?

An API Key is a type of private code used by a merchant’s software to issue payment-related instructions to a payment service provider. For instance, when an online merchant collects payments from customers through a payment platform, the API Key helps the system verify that the payment instruction has indeed originated from the legitimate merchant. The problem arises when these codes are stored on a merchant's server. If cybercriminals breach that server, they can steal the API key and initiate fund transfers at their own discretion. In such a scenario, it becomes difficult for the payment system to distinguish between legitimate and fraudulent instructions. To mitigate this risk, payment companies are now frequently rotating (changing) these API keys.