Follow us on Google News
The Indian Cyber Crime Coordination Centre (I4C), under the Union Home Ministry, has warned banks, non-banking financial companies (NBFCs) and fintech firms about growing cyberattacks involving artificial intelligence.
The agency said cybercriminals are using AI agents to compromise financial systems, carry out unauthorised transactions worth crores of rupees and erase digital evidence to avoid detection.
The warning calls for stronger protection of payment infrastructure, faster incident reporting and immediate action against security vulnerabilities.
How Are Cybercriminals Targeting Financial Institutions?
The National Cybercrime Threat Analysis Unit (NCTAU) of I4C, in coordination with the Indian Computer Emergency Response Team (CERT-In), has identified several weaknesses being exploited by attackers.
These include outdated software, improperly configured internet-facing servers and vulnerable IT systems. Customer-facing banking applications and complaint-handling platforms are also considered potential entry points.
Once attackers gain access, they can target automated payment systems and application programming interfaces (APIs) used to process financial transactions.
How Are AI Agents Being Used in Cyberattacks?
According to the advisory, criminals are deploying agentic AI frameworks to automate attacks against financial institutions.
These systems can help attackers execute fraudulent transactions at machine speed, reducing the time available for banks to identify and stop suspicious activity.
The agencies have flagged individual cases involving unauthorised transactions worth several crores of rupees through automated fund-disbursement systems and payment APIs.
https://the420.in/fcrf-certified-chief-ai-officer-second-cohort-november-2026/
Attackers may subsequently delete transaction records and conceal their digital footprints, complicating investigations and attempts to recover stolen money.
How Is the Stolen Money Transferred?
Investigators have identified the use of mule bank accounts to receive and transfer money obtained through compromised financial systems.
The stolen funds are allegedly moved rapidly between accounts or withdrawn through Immediate Payment Service (IMPS) and National Electronic Funds Transfer (NEFT) channels.
Such transactions can make it difficult for investigators to trace the money, particularly when criminals attempt to remove digital evidence.
The advisory highlights the importance of monitoring suspicious transfers and strengthening security around payment infrastructure.
What Reporting Requirements Must Banks Follow?
Financial institutions have been directed to report covered cyber incidents to CERT-In within six hours of detection.
Banks and NBFCs must also report such incidents to the Reserve Bank of India through its DAKSH portal within the same timeframe.
The agencies have asked institutions to implement measures prescribed in critical-severity CERT-In advisories and follow the May 2026 cybersecurity guidance addressing AI-assisted vulnerability exploitation.
Institutions must also comply with applicable cybersecurity requirements issued by their respective regulators.
What Security Measures Have Been Recommended?
Banks and fintech companies have been advised to maintain a complete inventory of payment-related APIs.
Outdated, unused and testing interfaces should be disabled immediately to prevent their exploitation. The advisory also recommends closer coordination between chief information security officers, transaction-monitoring teams and IT departments. These measures aim to improve vulnerability detection, strengthen transaction monitoring and enable faster responses to attempted cyberattacks.
How Serious Is India’s Cyber Fraud Problem?
The warning comes amid substantial financial losses linked to cyber fraud across India. Government figures cited in the report show that more than 53.87 lakh cyber fraud complaints were registered between 2023-24 and 2025-26.
During this period, over 1.81 lakh FIRs were registered, while the reported amount involved in cyber fraud exceeded ₹56,087 crore. More than ₹9,079 crore was marked as lien, and over ₹206 crore was refunded to victims.
These figures reflect overall cyber fraud complaints, not exclusively AI-powered attacks. The advisory underscores the need for financial institutions to strengthen cybersecurity as criminals increasingly adopt automated technologies to exploit vulnerabilities and move stolen funds.
The420 Advisory: Banks and fintech firms must strengthen payment security, monitor suspicious transactions and promptly report cyber incidents. Regular security checks and stronger safeguards against AI-powered attacks are essential to protect customer funds.
Click Here For The Original Source.
——————————————————–
