How I Hacked Your Bank Account: A Detailed Look At UPI Security
summary
Independent reverse engineering of multiple UPI apps while at Razorpay finds a simple but wide-impact flaw: an Android banking app trusts the client-submitted mobile number during registration, allowing an attacker to skip SMS validation and enroll as any victim. Exploit development uses tooling like Frida and objection plus SSL‑pinning bypass and field‑level crypto analysis to automate mass enrollments and then brute‑force 4-digit PINs, enabling large-scale, zero‑click account takeovers; vulnerabilities are disclosed to NPCI and patched, no funds are stolen during research.
AI-written summary · about
chapters (10)
- 0:00Introduction and background
- 3:31Understanding UPI architecture
- 8:06UPI app setup and authentication
- 11:15Vulnerability in mobile number validation
- 13:24Impact of the security flaw
- 15:10Why the flaw was missed
- 16:33Problems with UPI security model
- 18:42Lack of end-to-end encryption
- 19:03Need for open security standards
- 20:28Call for hackers and disclosure
related talks
14mSecurity and Privacy Advice for UPI Users in India
29mScorthter, Hacking Banks and Cryptocurrency Exchanges through their APIs
35mEveryone can see your credit card details
31mHow do we get a FOSS UPI mobile app
31mHow I hacked 30 mobile banking apps & the future of API Security
32mResults of Scanning the Top 45 Android Mobile Banking Apps
57m(In)Security of Mobile Banking
01h 01mPrincess of Thieves: How I Robbed 30 Banks