The ink of the Rs 590 crore scam in the Chandigarh branch of IDFC First Bank was not yet dry when the customers of Yes Bank got a big shock. In the IDFC case, the investigating agencies had found that crores of rupees were transferred from the accounts of various departments of the Haryana government to a private company. Now a similar serious cyber breach has been seen in Yes Bank’s multi-currency prepaid forex card system, which has raised questions on banking security.
How did millions of dollars flow into foreign accounts overnight?
This cyber attack on Yes Bank’s Forex Card issued in partnership with BookMyForex took place in the early morning of February 24, 2026. Between 3:30 am and 8:30 am Indian time, illegal transactions were carried out on 15 merchant accounts of a Latin American country. Internal investigation of the bank has revealed that in this planned incident, approximately US$0.28 million (Rs 2.54 crore) was fraudulently withdrawn from the accounts of about 5,000 customers. The money was gone before the customers even had a clue.
Fraudsters took advantage of the security flaw
To carry out this entire fraud, hackers took full advantage of the weakness of the Bank Identification Number (BIN). In the country from where these transactions took place (reportedly Brazil), two-factor authentication (2FA) or OTP is not mandatory for e-commerce purchases. Taking advantage of this geographical security flaw, cyber criminals got many transactions approved continuously without any restriction, due to which the hard-earned money of common customers suddenly came in danger and the security system had to be defeated.
Loss reduced due to bank’s vigilance
Fortunately, Yes Bank’s fraud monitoring system immediately detected this unusual decline and activity in multi-currency prepaid forex card transactions. The bank’s control system took prompt action and successfully blocked 688 unauthorized suspicious transactions. Due to this, about 0.1 million US dollars of customers were saved safely.
What are the measures for refund of customers’ money?
Yes Bank has clarified that to protect the affected customers from financial loss, they are working with the card networks to expeditiously complete the ‘charge-back’ process. As a strict security precaution, the bank has completely banned all e-commerce transactions from that Latin American country with immediate effect. The Bank is continuously monitoring the situation and working closely with all concerned parties to protect the interests of customers.