Indian Cyber Agency Warns Banks of AI-Driven Fraud Threats

The Indian Cyber Crime Coordination Centre (I4C), under the Union Home Ministry, has issued a cautionary advisory to banks, non-banking financial companies (NBFCs), and fintech firms about an alarming surge in cyberattacks fueled by artificial intelligence. These attacks are enabling hackers to breach systems and carry out fraudulent transactions at unprecedented speeds.

The National Cybercrime Threat Analysis Unit (NCTAU), a division within I4C, highlighted that these AI-enabled cyber intrusions present significant investigative challenges. Attackers often delete transaction records and cover their tracks, complicating efforts to trace and resolve incidents.

In coordination with the Indian Computer Emergency Response Team (CERT-In), which falls under the Ministry of Electronics and Information Technology, I4C has urged financial institutions to immediately adopt security measures outlined in recent high-priority CERT-In advisories. The joint alert follows observations of AI-driven fraud tactics increasingly targeting banks, NBFCs, and fintech companies.

According to the advisory, the cyberattacks are primarily financially motivated. Utilizing AI agents, perpetrators achieve rapid and automated system compromises, allowing them to initiate unauthorized transactions worth several crores. These transactions often exploit fund disbursement platforms and application programming interfaces (APIs) used for payments.

The agency noted that hackers gain entry into financial institutions by exploiting unpatched software vulnerabilities and misconfigured internet-exposed servers. Customer service interfaces and complaint handling systems have also been identified as potential entry points. Once inside, attackers focus on automated fund transfer systems and payment APIs, leveraging agentic AI frameworks to execute attacks at machine speed.

Funds stolen through these breaches are routed to mule accounts held across multiple banks. Criminals then swiftly withdraw or transfer the money using instant payment methods like IMPS and NEFT. To evade detection, attackers erase digital footprints of their activities, which significantly hampers forensic investigations.

In response, the advisory emphasizes the need for financial institutions to align their cybersecurity practices with CERT-In’s May 2026 guidelines aimed at minimizing exposure to AI-assisted attacks. Institutions are also asked to comply with cybersecurity frameworks prescribed by their respective regulatory bodies.

Financial entities have been instructed to report any incidents within six hours of detection. Besides notifying CERT-In, banks and NBFCs must inform the Reserve Bank of India via its DAKSH portal within the same timeframe to ensure prompt action and coordinated response.

Preventive recommendations include maintaining a detailed inventory of payment-related APIs, disabling obsolete or unused interfaces, and enhancing collaboration between cybersecurity teams, transaction monitors, and IT departments. This integrated approach is crucial for identifying and mitigating risks associated with API-based exploits.

The advisory comes amid rising cyber fraud complaints in India. Data from the Union Home Ministry indicates that between the financial years 2023-24 and 2025-26, more than 53.8 lakh cyber fraud cases were reported through the National Cybercrime Reporting Portal (NCRP). During this period, over 1.8 lakh FIRs were registered, with reported losses exceeding Rs 56,087 crore. Of this, Rs 9,079 crore is currently marked as lien, while Rs 206 crore has been refunded to victims.

This growing trend of AI-driven cyberattacks underscores the evolving threat landscape faced by India’s financial sector. As digital transactions continue to expand, protecting payment systems against sophisticated AI-powered fraud is becoming increasingly vital for safeguarding customer assets and maintaining trust in digital financial services.