NEW DELHI: A Reserve Bank of India (RBI) platform meant to help users recover unclaimed bank deposits exposed sensitive personal information online, allowing anyone with a mobile number and one-time password to access details of thousands of dormant accounts, according to an independent researcher whose findings were later corroborated by Mint.
The platform, Unclaimed Deposits Gateway to Access Information (Udgam), which has 30 participating banks, allowed users until 25 May to register and search records of unclaimed deposits in dormant bank accounts. Search fields included users’ names, residential addresses, bank names, and unclaimed deposits reference numbers (UDRNs), which can be used to initiate claims with banks.
Independent security researcher Avinash Jain told Mint that RBI’s Udgam user manual lists only name, place, bank name and UDRN as acceptable output fields, and full residential addresses are absent from both the list and other RBI documentation.
“The results were, therefore, outside every documented standard, including ones that are binding on the banks themselves,” said Jain, who informed the Indian Cyber Emergency Response Team (Cert-In) on 24 May through an email that was later seen by Mint.
Jain warned that exposure of precise address data could sharply increase the risk of spear phishing, targeted scams and impersonation-related harassment, as attackers may use information from the Udgam platform to establish credibility, extract more personal details, and facilitate financial fraud.
Mint could not ascertain how many users’ records may have been exposed. RBI has not disclosed the total number of dormant account entries available through Udgam.
Jain, who has worked in cybersecurity for 12 years at firms such as Cred and Microsoft, among others, said that the flaw had likely remained publicly accessible since the platform’s launch in August 2023.
Mint’s queries emailed to Cert-In and the ministry of electronics and IT (Meity), Cert-In’s nodal ministry, on Monday were not answered till press time. Queries emailed to the RBI on Tuesday were also not answered till press time.
Also on Tuesday, Udgam’s login mechanism stopped working, restricting access to the platform. It was not immediately clear whether the platform had been patched or updated.
A day earlier, Cert-In had issued a 38-page directive on patching vulnerabilities in critical systems. The directive was issued for “known exploited vulnerability affecting internet-facing and crown-jewel systems”, and urged public-facing systems to be fixed within 12 hours of being flagged, where feasible.
Access flaw
Other cyber security experts said the exposed information could be used to cross-match names against stolen databases and extract additional details such as PAN, Aadhaar and other identification records, which could enable targeted scams.
They also said the episode highlighted persistent vulnerabilities around handling sensitive user information despite multiple regulatory frameworks, including RBI guidelines, Cert-In advisories and the Digital Personal Data Protection Act, 2023.
“There’s a significant risk associated with such exposed data, as any personal information that is KYC-grade is personal identifiable information. If such information gets exposed, this could be quite alarming for any user,” said Sidharth Mutreja, chief technology officer at independent cyber security services firm, Rockladder Technologies.
Mutreja added that despite the availability of current guidelines, “data protection in case of such vulnerabilities involves the need for an organization to manage data through its entire lifecycle and understand what is sensitive”.
“In sensitive use cases, data masking must be done to encrypt information and prevent data loss from happening by enabling access to anyone. This is crucial for personal information, alongside ensuring that data is not accessible at will or at scale. Tokenization is another tactic that could be adopted, alongside rapid patching to minimize the impact on citizens,” he further said.
Notably, unclaimed deposits tracked through Udgam totalled about ₹72,454 crore, minister of state for finance Pankaj Chaudhary told Parliament in February. Separately, court submissions in response to a PIL on unclaimed bank deposits showed that the platform had more than 2 million registered users as of 1 April, referring to users who had signed up to search the database, and not dormant account holders.