Search
Breach tracker

Breach report

RapiPay loses ₹1.56 crore in 43 transfers made through a field agent's app

ConfirmedDisclosed Report published IndiaFinanceBy Vivek Kumar
Records UnknownCause Unknown

Attackers moved ₹1.56 crore out of the fintech's Yes Bank account in 23 minutes on 3 October using a field agent's mobile app, the company told Noida police. An FIR has been registered.

What happened

RapiPay Fintech, a Noida-based digital payments company that works with banks as a business correspondent, says ₹1.56 crore was taken from its Yes Bank account on 3 October 2026. According to the company's police complaint, reported by Amar Ujala on 7 October and The420.in on 8 October, 43 transactions were made between 10:41 am and 11:04 am. All of them went through the mobile application used by one of its field agents.

The company suspects that the attackers got unauthorised access to the agent's phone or to the app itself. An FIR has been registered at the Cyber Crime Police Station in Noida, and the case was also reported on the national cybercrime portal and the 1930 helpline.

What was exposed

What was reported lost is money, not customer data. The ₹1.56 crore was sent to several beneficiary bank accounts, and police are collecting account numbers, IFSC codes and account-holder details to trace and freeze the funds. Neither report says that any customer accounts or personal data were touched, and RapiPay has not said so either.

Confirmed vs. claimed

Stated by RapiPay in its complaint, as reported: 43 transfers worth ₹1.56 crore in 23 minutes, all through one field agent's app. Amar Ujala reports that the agent is not accused of fraud; investigators suspect his device or app was taken over.

Not known: how access was gained (a hacked phone, stolen login details or a weakness in the app), whether other agents' accounts were targeted, and how much money has been frozen so far. RapiPay has not issued a public statement that we could find, and no group has claimed the attack.

What to do if you are affected

  • If you are a RapiPay retailer or field agent, change your app PIN and password now. Remove unknown apps that can read SMS or control your screen, and never give OTPs or screen-sharing access to callers who say they are from support.
  • Check your wallet and settlement history and report any transaction you did not make to RapiPay straight away.
  • Customers who used a RapiPay outlet do not appear to be affected, but report any debit you do not recognise to your own bank.
  • If money is stolen, call 1930 as fast as you can; the first hour matters most. You can also report at cybercrime.gov.in.

Sources

We do not link to leak sites or reproduce leaked data. Spotted an error? Request a correction.

More breaches in India