Case Study: UPI App Hardened Against MASVS Findings Before RBI Audit

The situation

A UPI payments app (we'll call them "PayCo") with 12 lakh monthly active users in Tier-2 cities had completed their last RBI audit cycle 11 months prior. The next audit was scheduled. PayCo's CISO commissioned a pre-audit mobile pentest to identify gaps.

PayCo's profile:

1. 80 employees, 12 lakh MAU
2. Android + iOS native apps (Kotlin / Swift)
3. React Native shared business logic layer
4. AWS backend
5. RBI-regulated payment aggregator
6. Last audit findings: 4 Medium, closed within 60 days

The pentest (Week 1)

The Bachao.AI 5-day pentest returned:

C-001 — UPI intent redirection on Android allowing transaction hijack

The app accepted UPI intent parameters from external apps without validating origin. An attacker app could intent the PayCo app with a malicious payment URL → if the user confirmed, payment went to attacker's VPA.

PoC: a 3-line malicious Android intent demonstrated end-to-end transaction redirection.

Remediation: validate intent source, signed-only intents, explicit user confirmation with merchant name display.

H-001 — TLS pinning bypass on iOS

The app used certificate-pinning library but pinned to an intermediate CA. Attacker with control of intermediate could intercept. (Common implementation mistake.)

Remediation: pin to leaf certificate + 1 backup, with proper rotation procedure.

H-002 — Biometric authentication bypass via Frida script

The app's biometric auth wasn't bound to a server-side challenge. Frida script could mock biometric success without actual fingerprint/face authentication.

Remediation: server-issued challenge + biometric-attested response (Android Biometric Crypto API + iOS LocalAuthentication with secure enclave).

H-003 — Aadhaar number visible in app logs

During KYC flow, the masked-Aadhaar field was logged unmasked to console (visible via adb logcat on rooted device).

Remediation: explicit log redaction for KYC fields; disable verbose logging in release builds.

H-004 through H-008 — IDOR on transaction history API (cross-user data), insecure biometric fallback to PIN, session token reuse across devices, insufficient root detection, deep-link parameter pollution.

The remediation sprint (Week 2-3)

Bachao.AI mobile engineers worked alongside PayCo's mobile team for 2 weeks:

Week 2:

1. C-001 (UPI intent redirection) resolved Day 8 — PayCo's senior Android engineer + Bachao's mobile specialist worked through the intent validation refactor
2. H-001 (TLS pinning) resolved Day 10 — pinning to leaf cert + rotation procedure documented
3. H-002 (biometric bypass) resolved Day 12 — server-side challenge implemented end-to-end

1. H-003 through H-008 resolved
2. Code review of fixes by Bachao mobile lead
3. Re-test of all 9 Critical/High findings — all confirmed closed
4. 11 Medium findings closed (mostly platform-specific hardening: ProGuard rules, root detection improvements, deep-link allowlist)
5. 3 Low findings closed (informational hardening)

Pre-audit packaging (Week 4)

Bachao.AI produced the evidence package PayCo's CISO took to the RBI auditor:

1. Pre-audit pentest report (23 findings)
2. Remediation log (each finding closed with code commit reference)
3. Re-test confirmation (Bachao.AI testing post-remediation)
4. Updated mobile app security policy

The RBI audit (Week 6)

PayCo's RBI audit cycle concluded with 0 cybersecurity findings on the mobile app surface. The auditor observation: "Comprehensive pre-audit work evident."

What it cost

What PayCo's CISO said

"Mobile security audits often produce reports we can't action — too generic. Bachao's report had actual PoCs. Their engineers wrote the actual Kotlin and Swift fixes alongside our team. That's the only way 23 findings get closed in 2 weeks. We kept them on a quarterly mobile review retainer after the audit."

Pattern this engagement followed

This is a common shape for Bachao.AI mobile security engagements with Indian fintechs:

1. Regulatory deadline (RBI, SEBI, or sector-specific)
2. Internal mobile team capable but lacking specific security depth
3. Real findings, not abstract risk
4. Remediation work performed jointly, not handed off

Schedule the mobile pentest scoping call →

Related: Mobile Pentest Methodology · Mobile Security for Indian Banks