BookMyForex suffers a major data breach; thousands defrauded

Mumbai: BookMyForex, the MakeMyTrip-owned online marketplace for foreign exchange, has suffered a significant data breach that has reportedly led to thousands of users being defrauded, people aware of the development said.

Many affected customers were unable to access the platform to lock their forex cards, worsening the situation, according to social media posts. Several of them said they noticed unauthorised transactions in US dollars and Brazilian real.

The platform, which has Yes Bank as its banking provider, said in a post on microblogging site X that it has escalated the matter to the bank.

Yes Bank will initiate chargeback proceedings on behalf of all impacted users, the people cited earlier said.

BookMyForex and Yes Bank did not respond to emails seeking comment.

In a post on X, one user wrote: “I’m seeing multiple emails of both failed and successful transactions on my BookMyForex card. They are emptying my funds in front of my eyes. I’m unable to log in to the website or the card portal.”

Another user reported: “My forex card is being used in Brazilian real and multiple transactions are taking place. Customer support is unreachable, and the app also appears to be facing issues.” Responding to the growing complaints, BookMyForex stated: “We understand your concern and assure you that your funds are safe. The issue has been escalated to the card-issuing bank. As a precautionary measure, please lock your card through the app or the self-care card portal.”

Prima facie, the cyber attackers appeared to have gained access to sensitive customer card data, including card numbers, expiry dates and CVVs, the people aware of the development said. Using this information, they likely carried out large-scale online international transactions without requiring physical possession of the cards.

According to an initial assessment, the hackers are believed to have exfiltrated card details from a compromised database or third-party system, the people said. They first conducted small “test” transactions to validate the cards. Once the details were confirmed to be active, they proceeded with higher-value purchases.

A significant volume of transactions was reportedly executed in the Brazilian real, likely as a strategy to exploit lesser-monitored foreign currency channels and target international merchants with comparatively weaker KYC controls.

Routing transactions through higher-risk geographies may also have been intended to delay detection and complicate the chargeback process. The Reserve Bank of India announced a proposal on February 6 to compensate customers up to Rs 25,000 for losses arising from digital frauds. Banks reported 5,092 frauds in the first half of fiscal 2026, significantly lower than 18,386 frauds reported a year earlier.

However, the value of frauds rose to Rs 21,515 crore from Rs 16,569 crore during April-September, RBI’s latest Trends and Progress of Banking in India report showed.