A monitor shows an interface simulating a hacking attack on a refrigeration system at Cyber 3 Lab, part of Howest University of Applied Sciences in Bruges, Belgium, November 4, 2026.
| Photo Credit:
Zoran Mikletic
Central cyber security agency I4C has warned banks, non-banking financial companies (NBFCs) and fintech firms about a growing trend of financially motivated cyberattacks involving artificial intelligence agents, which can enable hackers to compromise systems and execute fraudulent transactions at machine speed.
The National Cybercrime Threat Analysis Unit (NCTAU) of the Indian Cyber Crime Coordination Centre (I4C) has also flagged that attackers delete records and attempt to conceal their activities, adding multiple layers of complexity in the investigation process.
I4C flags AI-powered cyberattacks on financial institutions
In an advisory issued to financial institutions, the I4C, which works under the Union Home Ministry, along with the Indian Computer Emergency Response Team (CERT-In) under the Ministry of Electronics and Information Technology, has asked financial institutions to urgently implement measures outlined in critical-severity CERT-In advisories.
The move comes after agencies noticed a trend of AI use in cyber frauds on banks, non-banking financial companies (NBFCs) and FinTech companies.
“The attacks are financially motivated and are being carried out with the help of Artificial Intelligence (AI) agents leading to machine-speed compromise.
“Multi-crore unauthorised transactions through fund disbursement systems and APIs are being found in individual cases,” the advisory said.
The agency flagged cases involving multi-crore unauthorised transactions through fund disbursement systems and application programming interfaces (APIs), but it does not cite specific instances in the warning.
Hackers exploit software vulnerabilities and payment APIs
The agency has noticed that attackers exploit unpatched software and misconfigured internet-facing servers and IT systems to gain access to financial institutions’ infrastructure with customer-facing and complaint-handling interfaces also being potential targets.
Once inside, the hackers then “target automated fund disbursement systems or special interfaces (APIs) used for payments and fund transfers. Use of Agentic AI Framework makes the attack possible at machine speed”, it said.
“The money is sent to ‘mule’ accounts (accounts used by criminals) across different banks and then quickly moved or withdrawn through IMPS/NEFT. Then the perpetrators delete records and hide their tracks so that investigation becomes difficult,” it said.
Financial institutions asked to strengthen cybersecurity measures
Financial institutions have also been asked to align their security controls with CERT-In’s May 2026 blueprint for reducing exposure and defending against AI-assisted vulnerability exploitation in digital infrastructure, as well as cybersecurity frameworks prescribed by their respective sectoral regulators.
The financial institutions have been urged to report such incidents to CERT-In within six hours of detecting them.
“Banks and NBFCs are also required to report incidents to the Reserve Bank of India through its DAKSH portal within the same time frame,” it said.
As part of preventive measures, financial institutions have been advised to maintain a comprehensive inventory of payment-related APIs and disable obsolete, unused or testing interfaces, the advisory said.
The advisory directed closer coordination between the chief information security officer’s team, transaction monitoring teams and IT departments to identify and mitigate risks associated with API-based attacks, among other steps.
Over 53 lakh cyber fraud complaints reported in three years
According to the Union Home Ministry data on NCRP and CFCFRMS operated by I4C, from the financial years 2023-24 to 2025-26, the total number of cyber fraud complaints on NCRP are more than 53, 87, 905.
The total number of FIRs registered is more than 1, 81, 271 and the total amount reported is more than Rs 56087 crore with the total amount marked as Lien is more than Rs 9, 079 crore, and the amount refunded is more than Rs 206 crore.
Published on November 4, 2026
