Unauthorised dollar, Brazilian real transactions hit Yes Bank-BookMyForex forex cards; data breach suspected

Several users posted on social media that they were unable to access the platform to lock their cards, worsening the situation

• Yes Bank-BookMyForex forex cards hit by unauthorised transactions
• Users report failed logins and funds drained from their cards
• BookMyForex assures funds are safe, issue escalated to Yes Bank

Did our AI summary help?

A multi-currency forex card issued by Yes Bank in partnership with BookMyForex has come under scrutiny after users flagged unauthorised overseas transactions, raising fears of a possible data compromise.

People familiar with the matter told The Economic Times that thousands of customers could be impacted. Several users posted on social media that they were unable to access the platform to lock their cards, worsening the situation. Some reported unauthorised transactions in US dollars and Brazilian real.

BookMyForex, which operates with Yes Bank as its banking partner, said on X that it had escalated the issue to the bank. Individuals cited by The Economic Times said Yes Bank is expected to initiate chargeback processes for affected customers. The bank did not respond to queries emailed by the publication.

In a statement to The Economic Times, BookMyForex denied any breach of its own systems. A company spokesperson said there had been no compromise of BookMyForex's infrastructure or customer data. The spokesperson added that Yes Bank had detected an unusually high number of fraudulent transaction attempts on the co-branded multi-currency prepaid forex cards, resulting in a surge of declined transactions. These attempts were traced to a specific country, following which the bank blocked transactions originating there. As a precaution, cards linked to the suspicious activity were also proactively disabled.

The company further told The Economic Times that customer balances remain secure and that it is coordinating with the bank to strengthen safeguards.

Users, however, described distressing experiences online. One customer wrote on X that both failed and successful transactions were appearing on their card, alleging that funds were being drained while they were unable to log in to the website or card portal. Another said transactions in Brazilian real were being processed without authorisation, while customer support and the app appeared inaccessible.

Responding to the mounting complaints, BookMyForex reiterated on X that customer funds were safe and said the matter had been escalated to the issuing bank. It advised users to lock their cards via the app or self-care portal as a precaution.

Sources cited by The Economic Times said preliminary findings suggest attackers may have obtained sensitive card details - including card numbers, expiry dates and CVVs - enabling them to conduct international online transactions without physical access to the cards.

An early assessment, people aware of the development told The Economic Times, indicates that the data may have been extracted from a compromised database or third-party system. The attackers are believed to have initiated small "test" transactions to validate card credentials before moving to larger purchases once the cards were confirmed active.

A sizeable share of the transactions was reportedly denominated in Brazilian real, possibly to exploit less-monitored currency corridors or transact with overseas merchants where KYC checks may be weaker. Routing payments through higher-risk geographies could also slow detection and complicate chargeback efforts, sources told the publication.

The developments come amid heightened regulatory focus on digital fraud. On February 6, the Reserve Bank of India proposed compensating customers up to Rs 25,000 for losses arising from digital fraud.

Data cited in the RBI's latest Trends and Progress of Banking in India report show that banks recorded 5,092 fraud cases in the first half of FY26, down sharply from 18,386 in the corresponding period a year earlier. However, the total value involved rose to Rs 21,515 crore from Rs 16,569 crore during April-September, underscoring the growing financial impact of such incidents.