NEW DELHI: The Indian Cyber Crime Coordination Centre (I4C), under the Union Ministry of Home Affairs (MHA), has sounded an alert over the growing threat of artificial intelligence (AI)-powered cyberattacks targeting banks, non-banking financial companies (NBFCs) and fintech firms. It has warned that hackers are exploiting automated systems to execute fraudulent transactions worth crores of rupees at machine speed.In an advisory issued to financial institutions, the National Cybercrime Threat Analysis Unit (NCTAU) of the I4C said cybercriminals were deploying AI agents to compromise financial infrastructure, siphon off funds through payment interfaces and erase digital evidence to evade detection.The advisory, issued jointly with the Indian Computer Emergency Response Team (CERT-In) under the Ministry of Electronics and Information Technology, has urged financial institutions to urgently implement the measures prescribed in critical-severity CERT-In advisories.”Multi-crore unauthorised transactions through fund disbursement systems and APIs are being found in individual cases,” the advisory said, flagging a new dimension to cyber fraud in the financial sector.According to the agencies, attackers are exploiting unpatched software, misconfigured internet-facing servers and vulnerable IT systems to infiltrate financial institutions. Customer-facing platforms and complaint-handling interfaces are also emerging as potential entry points.Once inside these systems, hackers target automated fund disbursement mechanisms and specialised application programming interfaces (APIs) used for payments and fund transfers. The use of agentic AI frameworks enables them to execute attacks at machine speed, significantly reducing the time available to financial institutions to detect and prevent fraudulent transactions.The stolen money is routed through ‘mule’ accounts, which criminals use to receive and transfer illicit funds across banks. The proceeds are then rapidly moved or withdrawn through Immediate Payment Service (IMPS) and National Electronic Funds Transfer (NEFT) channels.The attackers subsequently delete transaction records and conceal their digital footprints, making forensic investigations and the recovery of funds more difficult, the advisory said.The agencies have asked financial institutions to align their security controls with CERT-In’s May 2026 blueprint for reducing exposure to AI-assisted vulnerability exploitation, besides complying with the cybersecurity frameworks prescribed by their respective sectoral regulators.Banks, NBFCs and fintech companies have also been directed to report such incidents to CERT-In within six hours of detection. Banks and NBFCs must additionally report the incidents to the Reserve Bank of India (RBI) through its DAKSH portal within the same timeframe.
Click Here For The Original Source.
——————————————————–
