Indian Lender SG Finserve Discloses $540,000 Unauthorized Transfers via Yes Bank Payment API
SG Finserve Limited told BSE and NSE on 3 November 2026 that it had detected 15 unauthorized debit transactions totalling Rs 5,10,00,000 (51 million rupees, about $540,000) from two Yes Bank current accounts at the South Extension II branch, New Delhi, executed through the bank’s payment API. The company said it notified the Cyber Crime Cell, the RBI and CERT-In, engaged an independent investigating agency, and that core operations and customer data were unaffected.
MUMBAI/NEW DELHI, Nov. 3, Listed Indian non-banking financial company SG Finserve said it had detected unauthorized electronic fund transfers totaling 51 million rupees (about $540,000) from its accounts at Yes Bank, executed through the bank’s payment API without the company’s knowledge or authorization.
Incident Details
In a filing with the Bombay Stock Exchange and National Stock Exchange under India’s securities disclosure rules, the company reported that 15 unauthorized debit transactions were made from two current accounts held at Yes Bank’s South Extension II branch in New Delhi.
The transfers were carried out via the bank’s payment application programming interface (API).
Response
SG Finserve said it immediately activated its incident response procedures, isolated affected systems, and took steps to freeze beneficiary accounts and recover the funds.
It has notified India’s Cyber Crime Cell, the Reserve Bank of India (RBI), and the Indian Computer Emergency Response Team (CERT-In).
The company is also reporting the matter to police authorities and has engaged an independent investigating agency.
The firm stated that its core business operations, customer data, and day-to-day functioning were unaffected.
It is working to recover the amount and is strengthening its information security controls.
The disclosure was also posted on the company’s website.
Company Background
SG Finserve is a technology-focused RBI-registered non-bank lender specializing in supply-chain finance, including dealer, vendor, invoice, and factoring products for businesses linked to large corporate “anchor” clients.
It has reported rapid growth in recent quarters, with a loan book of roughly 57 billion rupees as of late September.
Cybersecurity Context
The incident aligns with a pattern of attacks that India’s national cybersecurity agency has publicly flagged.
CERT-In has issued critical advisories warning that threat actors are compromising internet-facing systems or stealing partner-bank API credentials at non-bank lenders and fintech firms, then calling fund-transfer APIs directly from within the victim’s own allow-listed infrastructure.
This approach bypasses the application-layer controls that normally enforce know-your-customer checks, loan sanctions, beneficiary validation, and transaction limits.
In a November 4 update, CERT-In named an ongoing campaign “CRAFTY FALCON” and described AI-assisted tooling that enables rapid reconnaissance and execution, often timed for weekends or periods of reduced monitoring.
The agency has noted that some organizations previously alerted to the risk have been re-targeted after incomplete remediation.
An earlier CERT-In advisory on the same threat said fraudulent transfers frequently carry dummy reference numbers and move quickly into networks of mule accounts.
Government Warning
Separately, the Indian Cyber Crime Coordination Centre (I4C) under the Ministry of Home Affairs warned on November 3 that financially motivated attackers are using AI agents to compromise banks, non-bank lenders and fintechs at “machine speed,” producing multi-crore unauthorized transfers through fund-disbursement systems and payment APIs, and directed institutions to implement CERT-In controls and report incidents within six hours.
Industry Risks
Similar API-related risks have been observed in other markets where non-bank lenders and fintechs integrate directly with bank payment rails for high-velocity disbursements.
Global regulators and industry groups have repeatedly highlighted the need for strong API authentication (including short-lived tokens and mutual TLS), server-side validation, request signing, maker-checker controls for high-value transfers, behavioral monitoring for anomalous patterns, and strict separation of production payment credentials.
Status
Yes Bank and SG Finserve did not immediately provide additional public comment beyond the regulatory filing.
Recovery of the funds will depend on the speed of account freezes and inter-bank coordination, steps that cybersecurity authorities in India and elsewhere have identified as frequent points of friction when money moves rapidly through multiple accounts.