Mumbai, Feb. 26 -- At 3:50 am on a quiet Kolkata morning, 35-year-old numerologist Vivek Baid woke up to a string of notifications that would upend his day. One message became two, then three. By 4 am, he had received eight transaction alerts for his forex card. All eight, he said, were successful.

"My money was being deducted in front of my eyes," Baid said.

The deductions, he said, totalled around Rs.1,45,000. The amounts were debited in United Arab Emirates Dirham, the currency loaded on his Yes Bank-BookMyForex multi-currency prepaid forex card, but the transactions reflected in Brazilian real. He has since filed a complaint with the cybercrime authorities.

The card was launched in August 2019 as a co-branded multi-currency prepaid...