A multi-currency prepaid forex card issued by Yes Bank in partnership with BookMyForex has come under scrutiny after several users flagged unauthorised international transactions, raising concerns over a possible data compromise.
According to people aware of the matter, thousands of users may have been impacted. Many customers said they were unable to log in to the platform to lock their cards, worsening the situation. Several reported transactions in US dollars and Brazilian real.
In a post on X, the platform said the issue had been escalated to the bank. People cited earlier said Yes Bank would initiate chargeback proceedings for affected users. The bank did not respond to emails seeking comment.
BookMyForex denied any breach of its systems.
“There has been no data breach involving BookMyForex systems or customer data,” a company spokesperson said. “YES Bank observed unusual volumes of false transaction attempts on YES BANK–BookMyForex Multi-Currency Prepaid Forex Cards, resulting in a high number of declined transactions. Upon analysis, these transactions were found to originate from a specific country. The bank has blocked transactions from that country, identified as the source of these attempts. As a precautionary measure, cards involved in these attempted transactions were also proactively blocked.”
The company added that customer balances remain secure and that it is working with the bank to strengthen safeguards.
One user wrote: “I’m seeing multiple emails of both failed and successful transactions on my BookMyForex card. They are emptying my funds in front of my eyes. I’m unable to log in to the website or the card portal.”
Another said: “My forex card is being used in Brazilian real and multiple transactions are taking place. Customer support is unreachable, and the app also appears to be facing issues.”
Responding to complaints, BookMyForex said: “We understand your concern and assure you that your funds are safe. The issue has been escalated to the card-issuing bank. As a precautionary measure, please lock your card through the app or the self-care card portal.”
People familiar with the matter said prima facie evidence suggested attackers may have accessed sensitive card details such as card numbers, expiry dates and CVVs. They allegedly conducted small test transactions before executing higher-value purchases. A large share of transactions was routed in Brazilian real, possibly to exploit less-monitored foreign currency channels.
On 6 Feb, the Reserve Bank of India proposed compensating customers up to Rs 25,000 for digital fraud losses. Banks reported 5,092 fraud cases in the first half of FY26, down from 18,386 a year earlier. However, the total fraud value rose to Rs 21,515 crore from Rs 16,569 crore during April–September, according to the central bank’s latest report.
Also read: Viksit Workforce for a Viksit Bharat
Do Follow: The Mainstream LinkedIn | The Mainstream Facebook | The Mainstream Youtube | The Mainstream Twitter
About us:
The Mainstream is a premier platform delivering the latest updates and informed perspectives across the technology business and cyber landscape. Built on research-driven, thought leadership and original intellectual property, The Mainstream also curates summits & conferences that convene decision makers to explore how technology reshapes industries and leadership. With a growing presence in India and globally across the Middle East, Africa, ASEAN, the USA, the UK and Australia, The Mainstream carries a vision to bring the latest happenings and insights to 8.2 billion people and to place technology at the centre of conversation for leaders navigating the future.
