Hey Hunters 👋 I'm Kapil.

On 4 November, India's national cyber agency, CERT-In, issued a critical advisory about an AI-driven attacker hitting lenders, payment companies & crypto exchanges.

What caught my eye:
it doesn't break the payment rails. It gets inside (an exposed staging server, a rebuilt mobile app, a leaked token) & then calls the company's own payout API, with the company's own keys. It sends ₹1 to test the route, then the real amount. Timed for holidays.

I spent 5 years building lending products in India. Almost every control we had asked "who is calling?" That question stops working once the attacker looks exactly like you.

PayRekha asks a different question: why is this money leaving?

🔑 Two keys to move money.
The system that approves money (loan system, settlement engine) signs a short intent: amount, account, single use. The payout service can't create one, and neither can an attacker who only stole its key. No matching intent, no payout.

🪙 Knows a penny drop from a probe.
Lenders send ₹1 all day to verify accounts; attackers copy the trick. PayRekha tells them apart.

🪔 Tightens on holidays, and plants decoy accounts only an attacker would pay. One touch puts every payout on high alert.

🧪 Safe to try:
replay last month's payouts on a laptop, run it in watch-only mode, enforce when you trust it. It's open source (Apache-2.0), runs in your own cloud, has no telemetry, and makes a decision in about 100 µs. It's an alpha, so the thresholds are illustrative and I'd love your toughest feedback.

👉 Try it in your browser (no install): https://peopleofproduct.github.io/payrekha/

The name:
in the Ramayana, the Lakshman Rekha is a line drawn to protect a home. The demon Ravana couldn't cross it, even in disguise. This is that line, for money.

If you work in payments, fraud or security anywhere, not just India:
how does your company check why money leaves, not just who asked?

Follow our work on Linkedin: https://www.linkedin.com/showcase/payrekha/