Open Banking, Open Doors? API Abuse Through a Threat Intelligence Lens

How does open banking work, and what role do APIs play?

Open banking is designed to give customers greater control over their financial data while enabling authorised providers to develop more connected services. Under frameworks such as the UK's Open Banking Initiative and the EU's revised Payment Services Directive (PSD2), APIs help facilitate data sharing and financial services integration.

An API acts as a defined interface through which different applications and systems communicate. In open banking, it allows an authorised provider to access permitted financial information or initiate supported services without requiring every organisation to build a separate connection from scratch.

This connectivity creates significant opportunities for innovation. However, as explained in McKinsey's research on data sharing and open banking, the model also places greater emphasis on governance, data privacy and safeguards across participating organisations.

The cybersecurity challenge is clear: the more connected a financial ecosystem becomes, the more important it is to understand which systems, identities and third parties can be trusted.

What are the main cybersecurity risks of open banking APIs?

Open banking APIs are not inherently insecure. However, weaknesses in their design, configuration or access controls can create opportunities for attackers to exploit connected financial services.

Key API security risks, includes broken authentication, broken authorisation, security misconfiguration and unrestricted resource consumption. These vulnerabilities are particularly relevant to financial services, where APIs may handle sensitive customer information and support critical transactions.

1. API vulnerabilities and abuse

Weak access controls can allow attackers to access information or functionality beyond their permissions. Misconfigured APIs may expose sensitive data, while insufficient rate limiting can leave services vulnerable to automated abuse or disruption.

As outlined in the OWASP API Security Top 10, broken object-level authorisation and broken authentication are among the key risks organisations must address.

API abuse does not always involve exploiting a software vulnerability. Attackers may also misuse legitimate functionality, making effective access controls, rate limiting and activity monitoring essential.

2. Stolen credentials and account compromise

Compromised credentials can provide attackers with access to financial applications and connected services. Credentials may be obtained through phishing, malware, infostealer infections or criminal marketplaces where stolen access is traded.

Where attackers use valid credentials or compromised authentication tokens, malicious activity may be harder to distinguish from legitimate access. Monitoring for exposed credentials and investigating suspicious activity can help organisations identify potential compromise.

3. Third-party and supply chain risk

Open banking relies on relationships between banks, fintechs, payment providers and technology suppliers. Each integration introduces dependencies that can extend beyond an organisation's direct security perimeter.

A vulnerability or compromise at one provider may create risks for other organisations that rely on its services. Understanding third-party exposure requires more than reviewing a supplier's security documentation. Organisations need visibility into emerging vulnerabilities, compromised assets and threats targeting the wider fintech ecosystem.

4. Data exposure and financial fraud

Unauthorised access to financial information can enable further attacks, including identity fraud, targeted phishing and social engineering. Even when attackers cannot directly move funds, exposed personal or account data may help them construct convincing scams or target customers and employees.

This makes open banking security both a technical and a fraud prevention concern. Protecting APIs is important, but so is understanding how stolen data and access could be used elsewhere.

How can cyber threat intelligence help protect open banking APIs?

Strong API security starts with secure design, robust authentication and authorisation, appropriate access controls, encryption, rate limiting and continuous monitoring. These measures help organisations prevent unauthorised access, identify suspicious activity and reduce the risk of exploitation.

CTI complements these controls by providing external context about the threats facing an organisation. It helps security teams understand what attackers are targeting, which techniques they use and whether relevant warning signs are emerging beyond their own networks.

For open banking providers and financial institutions, this can include:

• Monitoring compromised credentials: Identifying exposed employee or third-party credentials circulating in criminal communities.

• Tracking threat actors and campaigns: Understanding which threat groups target financial services and how their techniques evolve.

• Identifying external exposure: Correlating intelligence about malicious domains, vulnerable assets and emerging threats with an organisation's digital footprint.

• Monitoring third-party threats: Identifying relevant threats affecting suppliers and connected providers to support more informed risk assessments.

• Supporting incident response: Providing context that helps security teams investigate suspicious activity, assess potential exposure and prioritise defensive action.

As explored in CYJAX's guide to cyber threat intelligence for fintech, financial services organisations face a threat landscape shaped by their digital connectivity and the value of the data and services they provide.

Threat intelligence does not prevent API abuse on its own. Its value lies in strengthening existing security measures with external visibility and early warning. Combined with secure API development, effective access controls, authentication and continuous monitoring, CTI can help organisations make more informed decisions and respond to emerging threats more effectively.

Building a more proactive approach to open banking security

As financial services become more interconnected, cybersecurity teams must look beyond their own infrastructure. Open banking introduces opportunities for innovation, but its reliance on APIs, shared data and third-party integrations makes visibility across the wider threat landscape increasingly important.

A proactive security strategy combines robust technical controls with ongoing external monitoring, threat intelligence and effective incident response. By understanding where credentials are exposed, which threats are targeting financial services and how attackers operate, organisations can move beyond reacting to incidents towards identifying risks earlier.

For financial institutions and fintechs, the objective is not to restrict connectivity. It is to ensure that innovation does not come at the expense of security.