New Delhi, November 5 (TNA) The Indian Cyber Crime Coordination Centre (I4C) has cautioned banks, non-banking financial companies (NBFCs) and fintech firms about a growing wave of financially motivated cyberattacks involving artificial intelligence agents. The agency warned that attackers are exploiting weaknesses in payment systems and digital infrastructure to carry out fraudulent transactions at high speed.
In an advisory issued to financial institutions, I4C asked them to urgently implement security measures prescribed in advisories issued by the Indian Computer Emergency Response Team (CERT-In). The advisory was prepared after I4C’s National Cybercrime Threat Analysis Unit and CERT-In observed an increase in cyber fraud targeting banks, NBFCs and fintech companies.
Focus on payment infrastructure
The advisory flags the misuse of vulnerable payment application programming interfaces (APIs), outdated software and misconfigured internet-facing systems as potential entry points for attackers. Cybercriminals may use AI tools to identify vulnerabilities, automate attacks, transfer funds and attempt to erase digital evidence, officials said.
Financial institutions have been advised to:
• Maintain a complete inventory of payment-related APIs and digital interfaces.
• Disable obsolete, unused and testing interfaces.
• Strengthen monitoring of automated fund-disbursement and payment systems.
• Set appropriate daily and per-transaction limits.
• Verify beneficiary details and monitor unusual transaction speeds or patterns.
• Coordinate closely with chief information security officers, transaction-monitoring teams and IT departments.
• Conduct secure-architecture reviews and red-team exercises simulating machine-speed attacks.
Six-hour reporting deadline
I4C has directed financial institutions to align their security controls with CERT-In’s May 2026 blueprint on reducing exposure to AI-assisted vulnerability exploitation in digital infrastructure. They have also been asked to follow cybersecurity frameworks prescribed by their respective sectoral regulators.
Institutions must report cyber incidents to CERT-In within six hours of detecting them. Banks and NBFCs are additionally required to report applicable incidents to the Reserve Bank of India through its DAKSH portal within the same six-hour timeframe.
The advisory comes amid concerns that AI-enabled attacks could allow criminals to target multiple financial systems simultaneously and execute unauthorised fund transfers before conventional monitoring mechanisms detect the activity. I4C and CERT-In have urged financial institutions to treat the prescribed safeguards as an immediate priority.