Follow us on Google News
The Indian Cyber Crime Coordination Centre (I4C) has warned banks, non-banking financial companies (NBFCs) and fintech firms about AI-powered cyberattacks capable of executing unauthorised financial transactions at machine speed. The advisory highlights the growing misuse of autonomous AI agents to compromise banking infrastructure and transfer funds.
What Has I4C Warned About?
The advisory was issued by I4C’s National Cybercrime Threat Analysis Unit (NCTAU) in coordination with the Indian Computer Emergency Response Team (CERT-In).
https://the420.in/fcrf-certified-chief-ai-officer-second-cohort-november-2026/
The agencies warned that financially motivated cybercriminals are increasingly using AI agents to exploit weaknesses in financial systems. Some cases have involved unauthorised transactions worth several crores through payment and fund-disbursement interfaces. These automated attacks can significantly reduce the time available for banks to identify suspicious activity and prevent financial losses.
How Do Hackers Enter Banking Systems?
According to the advisory, attackers initially exploit unpatched software, incorrectly configured internet-facing servers and vulnerable IT infrastructure to gain unauthorised access.
Customer-facing applications and complaint-handling platforms are also identified as potential entry points. Once inside, attackers target automated fund-disbursement systems and application programming interfaces (APIs) responsible for processing payments. Agentic AI frameworks can accelerate these attacks, allowing criminals to execute fraudulent transactions faster than conventional security monitoring systems may respond.
How Is the Stolen Money Transferred?
Cybercriminals allegedly move stolen funds through mule bank accounts maintained across different financial institutions. These accounts are used to receive and redistribute money obtained through fraudulent transactions.
The proceeds are subsequently transferred or withdrawn through Immediate Payment Service (IMPS) and National Electronic Funds Transfer (NEFT) channels. Attackers may also delete transaction records and conceal digital evidence to obstruct investigations and complicate efforts to trace the money.
What Security Measures Must Banks Take?
I4C has urged financial institutions to implement safeguards outlined in two critical CERT-In advisories, CIAD-2026-0046 and CIAD-2026-0049, addressing unauthorised fund transfers through payment APIs and the misuse of AI agents.
Banks and fintech firms have been advised to maintain complete inventories of payment APIs and disable obsolete, unused or testing interfaces. They should also establish daily and transaction-specific limits, strengthen beneficiary verification and monitor unusual transaction speeds, sudden changes in beneficiary details and abnormal payment volumes.
How Can Financial Systems Be Protected?
The advisory calls for stronger security controls across customer-facing platforms and complaint-handling systems. Institutions have been asked to conduct secure architecture reviews and ensure that mandatory checks, including Know Your Customer verification and approvals, are completed before funds are released.
Banks must also coordinate cybersecurity, transaction-monitoring and IT teams to identify emerging threats. The agencies have recommended authorised red-team exercises to simulate machine-speed attacks and assess whether security operations centres and payment controls can respond effectively. Institutions have additionally been advised to detect access-token failures originating from non-whitelisted IP addresses.
What Are the Cyber Incident Reporting Rules?
Financial institutions have been instructed to report cybersecurity incidents to CERT-In within six hours of detection. Banks and NBFCs must also report such incidents to the Reserve Bank of India through its DAKSH portal within the same timeframe.
For large-scale fraudulent transactions, NBFCs and fintech companies may use the National Cybercrime Reporting Portal’s Citizen Financial Cyber Fraud Reporting and Management System to seek immediate freezing of defrauded funds.
The warning places particular emphasis on strengthening payment infrastructure as financial institutions increasingly rely on automated transactions, interconnected APIs and digital banking platforms.
About the author — Ayesha Aayat writes on cybercrime, digital safety, and emerging online threats. Her work focuses on public awareness, legal clarity, and technology-driven risks.
