Research · 5 October 2026

3 of 40 Indian wallet companies publish a security.txt

Wallets, prepaid cards, gift cards and transit cards all run on a licence from the Reserve Bank of India. We checked every non-bank issuer on RBI's authorised list for two small things: a security.txt, the file that tells someone who finds a flaw where to report it, and a DMARC policy, which tells inboxes what to do with email that falsely claims to come from the company.

What we found

Of the four security.txt files that exist, one has passed its own expiry date and one has no Expires field, which RFC 9116 requires. So two of the four tell a careful reporter to look elsewhere.

Email is the stronger side, but not evenly. Of the 40 companies headquartered in India, 7 publish no DMARC record at all and 4 publish p=none, which reports on spoofed mail but tells inboxes to do nothing about it. Two more apply their policy to only part of the mail that fails. For a wallet, an email that looks like it came from the company is a common way fraud against its customers begins.

This mirrors our first study, of RBI's authorised payment aggregators, where 4 of 49 India-headquartered companies published a security.txt and 39 of 49 enforced DMARC. Most of these companies have closed the door on an attacker pretending to be them. Very few have opened one for the person trying to warn them.

What this does not mean

A missing security.txt does not mean a company has no way to receive a vulnerability report. Some run a responsible disclosure page or a bug bounty programme elsewhere. A missing DMARC policy does not mean spoofed mail always arrives either, because receiving providers apply their own filtering. This check measures what each company itself publishes, in the place the standards say to publish it.

Method

• Sample. The non-bank entities authorised to issue prepaid payment instruments in RBI's list of payment system operators, as updated on 5 October 2026: 53 entities. Revoked, surrendered and cancelled authorisations were left out.
• Websites. Each entity was mapped to the public website of the brand RBI names, confirmed by the site's own title or redirect. One brand's domain now serves unrelated content and was left out. Five sites refused automated requests or could not be reached, and we did not work around that, so they were left out too. That leaves 47.
• Requests. For each site, the home page to confirm the domain, then at most two requests, to /.well-known/security.txt and then the older /security.txt. Every request identified itself as ExceptionSecurity-DisclosureStudy/1.0 with a link to our method. Nothing else was requested, scanned or probed.
• What counts as a security.txt. HTTP 200, served as plain text, with at least one Contact: line. Many sites return their home page for any address, which would otherwise look like a file that exists.
• DMARC. One public DNS query for the _dmarc record of the domain, falling back to the organisational domain as RFC 7489 describes. "Enforce" means a policy of quarantine or reject.
• Grouping. "Global group" means an Indian entity of a company headquartered outside India.
• No names. We publish aggregates only. The per-company results are available to each company on request.

Both fixes are small

The security.txt can be three lines, served as plain text at /.well-known/security.txt:

Contact: mailto:security@example.com
Expires: 2027-09-30T00:00:00.000Z
Policy: https://example.com/security/

The contact must be read by someone who can act, and the expiry should be less than a year away. DMARC takes longer to do safely: publish p=none with a reporting address, read the reports until every legitimate sender passes, then move to quarantine and reject.

If you work at one of these companies and want to know exactly what we saw on your domain, write to founder@exceptionsecurity.com and we will send it, whether or not anything follows. If you would rather not run the inbox behind the file yourself, our disclosure programme is free: reports come to us, we reproduce what is real, and only that is passed to your team. Our own security.txt is here.