Help people safeguard their money against cyber heists

Imagine a cybercrime gang plotting their next big heist.

- SRINATH SRIDHARAN & ANAND VENKATANARAYANAN

Would they attack Mint Street or target thousands of individuals who operate bank accounts on unsecured mobile devices? The answer is obvious. Attack enough of these vulnerable endpoints, and the effect is the same as raiding Mint Street itself.

The recent Bengaluru fintech heist that lost ₹47 crore should not be mistaken as a 'fintech-only' mishap. The anatomy of most digital heists in India follows a depressingly familiar pattern: start with identity fraud, exploit gaps in permission escalation and authentication created by weak processes across intermediaries, and then launder the transactions through mule accounts in banks. Each step exploits an institutional blind spot and is relatively minor, but together they form a systemic breach vector.

The digitally interconnected system of banks, non-bank financial companies, payment intermediaries and fintech firms operates on shared rails that enable instant money movement. The security of one node depends on the discipline of all. Yet most of these entities will claim global best practices, often certified by global consultants.