India’s premier cybersecurity agency, the Indian Cyber Crime Coordination Centre (I4C), has issued a warning to banks, NBFCs, and fintech startups about a rising wave of cyberattacks using AI technology to orchestrate large-scale financial frauds.
- AI agents exploit unpatched systems and payment APIs to conduct fraud
- Funds are routed through mule accounts and withdrawn quickly via IMPS/NEFT
- Institutions advised to follow CERT-In advisories and enhance monitoring
What happened
The Indian Cyber Crime Coordination Centre (I4C) recently alerted banks, NBFCs, and fintech companies regarding increasing incidents of AI-led cyberattacks targeting their financial infrastructure. Malicious AI agents have been found exploiting software vulnerabilities and misconfigured internet-facing servers to gain unauthorized access.
Once inside, these AI-powered attackers target automated fund disbursement systems and payment APIs, initiating fraudulent transactions worth crores of rupees. The criminal networks then use mule accounts across multiple banks to rapidly withdraw stolen funds via IMPS and NEFT and erase transaction logs to cover their tracks.
Why it matters
This advisory underscores the growing threat posed by agentic AI technology in accelerating the speed and scale of cyber financial fraud in India’s banking and fintech sectors. As attackers automate and refine intrusion tactics, existing security controls face increased pressure to detect and respond swiftly.
The threat also poses a challenge to consumer trust and regulatory compliance. The Indian government and RBI have emphasized the importance of enhancing cybersecurity frameworks, especially ahead of India’s expanding digital payments ecosystem.
What to watch next
Financial institutions are expected to urgently implement CERT-In’s critical advisories, particularly focussing on securing payment APIs and AI systems that interact with customer interfaces. Coordination between cybersecurity teams, transaction monitoring units, and IT departments will be critical to improve detection and prevention.
Authorities and fintech stakeholders will likely increase investment in AI-powered defensive tools and authorized red-team exercises to simulate machine-speed attacks. The market should watch for further regulatory updates and potential mandates from RBI and CERT-In as this landscape evolves.