Central cyber security agency warns banks, NBFCs of AI attacks; I4C reveals how hackers are executing multi-crore frauds

India's central cyber security agency, the Indian Cyber Crime Coordination Centre (I4C), has sounded an alert for banks, non-banking financial companies (NBFCs) and fintech firms over a growing trend of cyberattacks involving artificial intelligence (AI) agents that allow hackers to compromise systems and execute fraudulent transactions at machine speed. The National Cybercrime Threat Analysis Unit (NCTAU) of I4C has flagged cases of multi-crore unauthorised transactions through fund disbursement systems and application programming interfaces (APIs). It has also warned that cybercriminals delete records and cover their tracks after siphoning off money, making investigations more difficult.

Read more - 'Chernobyl-like' blackout soon: 'Godfather of AI' predicts major crisis this year or next; Nobel laureate Geoffrey Hinton warns of risks to financial markets & power systems

The warning comes in an advisory issued jointly by I4C, which operates under the Union Home Ministry, and the Indian Computer Emergency Response Team (CERT-In), under the Ministry of Electronics and Information Technology. The agencies have urged financial institutions to urgently implement security measures outlined in critical-severity CERT-In advisories.

AI-powered cyberattacks on banks: What has I4C found?

According to the advisory, cybercriminals are increasingly using AI agents to target financial institutions, with attacks designed to exploit vulnerabilities and facilitate rapid financial fraud.

"The attacks are financially motivated and are being carried out with the help of Artificial Intelligence (AI) agents leading to machine-speed compromise.

"Multi-crore unauthorised transactions through fund disbursement systems and APIs are being found in individual cases," the advisory said.

The agency has not identified specific banks or financial institutions affected by these incidents.

How hackers exploit APIs to carry out financial fraud

The advisory said attackers exploit unpatched software, misconfigured internet-facing servers and vulnerable IT systems to gain access to the infrastructure of financial institutions.

Customer-facing platforms and complaint-handling interfaces have also been identified as potential entry points for cybercriminals.

After gaining access, hackers target automated fund disbursement systems and specialised APIs used for payments and fund transfers.

"Use of Agentic AI Framework makes the attack possible at machine speed," the advisory said.

The money is subsequently transferred to 'mule' accounts, which are bank accounts used by criminals to receive and move illegally obtained funds. These accounts may be spread across multiple banks, allowing the money to be quickly transferred or withdrawn through Immediate Payment Service (IMPS) and National Electronic Funds Transfer (NEFT).

"The perpetrators delete records and hide their tracks so that investigation becomes difficult," the advisory added.

I4C advisory: What security measures must banks and NBFCs take?

I4C and CERT-In have asked financial institutions to implement the measures prescribed in critical-severity cybersecurity advisories without delay.

They have also been directed to align their security arrangements with CERT-In's May 2026 blueprint for reducing exposure and defending against AI-assisted vulnerability exploitation in digital infrastructure.

Financial institutions must additionally follow cybersecurity frameworks laid down by their respective sectoral regulators.

As part of the preventive measures, the advisory has recommended that banks and other financial entities:

• Maintain a comprehensive inventory of all payment-related APIs.
• Disable obsolete, unused and testing interfaces that could expose their systems to cyberattacks.
• Strengthen monitoring of automated fund disbursement systems and payment interfaces.
• Improve coordination between chief information security officer (CISO) teams, transaction monitoring units and IT departments.
• Identify and address vulnerabilities that could be exploited through API-based attacks.

Cyber fraud reporting deadline: Banks must inform CERT-In and RBI within six hours

The advisory has also stressed the need for faster reporting of cybersecurity incidents. Financial institutions have been asked to report such incidents to CERT-In within six hours of detecting them.

"Banks and NBFCs are also required to report incidents to the Reserve Bank of India through its DAKSH portal within the same time frame," the advisory said.

The six-hour reporting requirement is aimed at enabling authorities and regulators to respond quickly to attacks and limit their financial impact.

Cyber fraud in India: Over 53.87 lakh complaints registered in three years

The latest warning comes amid a significant number of cyber fraud complaints reported across the country.

According to Union Home Ministry data from the National Cybercrime Reporting Portal (NCRP) and the Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS), both operated by I4C, more than 53,87,905 cyber fraud complaints were registered between financial years 2023-24 and 2025-26.

During the same period, more than 1,81,271 FIRs were registered in connection with cyber fraud cases.

The total reported amount exceeded Rs 56,087 crore, while more than Rs 9,079 crore was marked as lien. The amount refunded to victims stood at over Rs 206 crore.


Inputs from agencies