Why API security is critical in banking
Open Banking and the PSD2 directive transformed financial services architecture. Banks must expose APIs to third-party providers (TPPs), enabling payment initiation and account information access. Every API endpoint is a potential entry point for attackers.
In 2025, attacks on banking APIs increased by 127%. API vulnerabilities enable: unauthorized access to client data, fraudulent transaction initiation, personal data exfiltration, and balance manipulation. Traditional network firewalls don’t protect the API application layer.
Most common API vulnerabilities in finance
BOLA (Broken Object Level Authorization)
The most serious API vulnerability per OWASP. An attacker changes the object identifier in a request (e.g., account number) and gains access to another client’s data. In banking, this means access to others’ accounts, transactions, and personal data.
Broken Authentication
Weak API authentication mechanisms: missing JWT token validation, long token lifetimes, no key rotation. Enables session hijacking and API access with legitimate user privileges.
Excessive Data Exposure
API returns more data than the client needs (e.g., full card number, SSN, transaction history). Filtering implemented on the frontend instead of the backend.
Lack of Rate Limiting
No request rate limits enable brute force on authentication, client data scraping, API DDoS attacks, and credential stuffing.
Mass Assignment
Attacker adds unexpected fields to a request (e.g., "role": "admin" or "balance": 999999), exploiting automatic parameter binding.
Banking API security architecture
Layer 1: API Gateway
Central point for API traffic management. Functions: authentication (OAuth 2.0, mTLS), rate limiting, request transformation, logging, caching, load balancing. Separation of Open Banking traffic from internal APIs.
Layer 2: Authentication and authorization
OAuth 2.0 + OpenID Connect for resource access authorization. Strong Customer Authentication (SCA) per PSD2. eIDAS certificates for TPP identification. RBAC/ABAC for granular endpoint access control.
Layer 3: Data validation
Schema validation on every endpoint. Allowed field whitelist. Type, range, and format validation. Input sanitization. Injection protection (SQL, NoSQL, Command).
Layer 4: Monitoring and SOC
Logging all API calls with business context. Anomaly detection: unusual call patterns, geolocation changes, excessive requests. Integration with SOC for correlating API alerts with other security events.
API security implementation plan
Step 1: API inventory
Map all APIs: internal, external (Open Banking), partner. Identify endpoints processing sensitive data (PII, card data, balances). Document in OpenAPI/Swagger format.
Step 2: Threat modeling
Threat analysis for each API: who can attack, what data is at risk, what are the consequences. Risk prioritization per DORA and PCI DSS.
Step 3: API Gateway implementation
Deploy central API Gateway with authentication, rate limiting, and logging. Configure per-endpoint policies: different limits for Open Banking, mobile app, and internal systems.
Step 4: Endpoint hardening
Implement data validation, authorization controls (BOLA prevention), mass assignment and injection protection. Security code review for every new endpoint.
Step 5: Testing
Penetration testing covering OWASP API Top 10. Endpoint fuzzing. Authentication and authorization testing. Rate limiting validation. Regular vulnerability scanning.
Step 6: Monitoring and continuous improvement
API log integration with SIEM/SOC. Anomaly alerts. Regular configuration reviews. Security policy updates. Automated tests in CI/CD pipeline.
Regulatory requirements for banking APIs
PSD2/Open Banking: Strong customer authentication (SCA), eIDAS certificates for TPPs, dedicated APIs with 99.5%+ availability, sandbox for integration testing.
DORA: APIs as ICT infrastructure subject to risk management, resilience testing, and incident reporting.
PCI DSS: APIs processing card data must meet encryption, logging, and access control requirements.
How nFlo secures banking APIs
- Penetration testing — dedicated API tests, OWASP API Top 10, fuzzing, business logic testing
- Security audits — API architecture review, Gateway configuration assessment, threat analysis
- SOC as a Service — real-time API monitoring, anomaly detection, cross-source correlation
- Compliance support — API compliance with PSD2, DORA, and PCI DSS
Cybersecurity for Your Industry
Learn more about cybersecurity in your industry:
Related topics
See also:
