The fraud exploited specific bank identification numbers, and the country reportedly did not require two-factor authentication for e-commerce
| Photo Credit:
AINNIE ARIF/Reuters
Yes Bank has disclosed that its internal investigation has revealed that fraudulent transactions aggregating about USD 0.28 million on its multi-currency prepaid forex card, which was issued in partnership with BookMyForex, were carried out on 15 merchants based in a Latin American country in the early hours of February 24, 2026, between 3:30 am and 8:30 am (IST)
The aforementioned transactions were approved on behalf of 5,000 customers, the private-sector bank said in a statement.
The Bank said its fraud monitoring system observed an unusual increase in transaction decline in the case of a multi-currency prepaid forex card.
These fraudulent transactions were attempted on specific BINs (bank identification numbers).
“Due to the Bank’s monitoring and control mechanisms, 688 unauthorised transaction attempts were declined, which led to safeguarding of approximately equivalent to USD 0.1 million,” claimed the Bank.
The Bank said it is working with Card Network to raise a chargeback to ensure that the impacted customers do not face any financial loss.
Yes Bank emphasised that the specific country (reportedly Brazil) does not mandate two-factor authentication for e-commerce transactions.
As a security measure, the bank has subsequently restricted e-commerce transactions from the specific Latin American country, the statement said.
The Bank said it continues to closely monitor the situation and is working with all relevant stakeholders to safeguard customer interests.
Published on February 26, 2026
