OWASP Top 10 translated for fintech

1. Broken Access Control (BOLA/IDOR)

The OWASP definition: Restrictions on what authenticated users are allowed to do are not properly enforced.

The Fintech Reality: This is the most destructive flaw in fintech apps today. In our testing, it frequently manifests as:

• A user changing the accountId parameter in an API request to view another customer's complete transaction history.
• A merchant changing a storeId to process a refund against a different merchant's ledger.
• An attacker finding a hidden /api/v1/admin/users/freeze endpoint and calling it, successfully freezing accounts because the endpoint checked if the user was logged in, but not if they were an admin.

2. Cryptographic Failures

The OWASP definition: Failures related to cryptography (or lack thereof) which often lead to sensitive data exposure.

The Fintech Reality: Beyond just forcing HTTPS, this category critically affects data-at-rest and integration integrity:

• Storing BVNs, NINs, and full PANs (Primary Account Numbers) in plaintext in the database, making a simple SQL injection instantly fatal.
• Handling webhooks from NIBSS or Paystack without properly validating the HMAC SHA-512 signatures, allowing attackers to spoof successful deposit events.
• Using weak encryption (e.g., base64 encoding instead of actual encryption) for URL parameters passed between microservices.

3. Injection

The OWASP definition: User-supplied data is not validated, filtered, or sanitized by the application.

The Fintech Reality: While modern ORMs have largely solved traditional SQL injection, we now see injection happening at the business logic and API layer:

• NoSQL Injection: Manipulating MongoDB queries via raw JSON input to bypass login checks (e.g., {"email": {"$gt": ""}, "password": {"$gt": ""}}).
• Parameter Pollution: Sending two amount parameters in a transfer request to confuse the backend validation logic while the processing logic takes the smaller amount.

4. Insecure Design

The OWASP definition: Risks related to design flaws and architectural weaknesses.

The Fintech Reality: This represents flaws in the core business logic that cannot be fixed by a simple code patch. Examples:

• Allowing users to register with an email address, completely verify their account, and then change their email address without requiring re-verification.
• Designing a loan disbursement flow where the funds are transferred via an external API *before* the internal ledger records the liability.

5. Identification and Authentication Failures

The OWASP definition: When user identity, authentication, or session management is not handled correctly.

The Fintech Reality: Account Takeover (ATO) directly follows these failures.

• OTP endpoints that do not rate limit, allowing attackers to script brute-force attacks against 4-digit or 6-digit pins.
• JWTs (JSON Web Tokens) that never expire, or systems that do not maintain a server-side blocklist to handle manual logouts.
• Password reset links that do not expire immediately after their first use.