Cybersecurity Agency I4C Warns Banks & Fintechs Against AI-Led Cyberattacks

The Indian Cyber Crime Coordination Centre (I4C) has warned banks, non-banking financial companies (NBFCs) and fintech startups against the growing trend of cyberattackers using AI agents for financial frauds. 

In an advisory issued on November 3, the National Cybercrime Threat Analysis Unit (NCTAU), under the I4C, flagged that attackers were exploiting unpatched software and misconfigured internet-facing servers to gain access to financial infrastructure. 

The cybersecurity agency also said that it has unearthed multiple “individual” cases, where malicious agentic AI systems were exploiting compromised financial systems to undertake unauthorised transactions running into crores of Rupees.

Describing the modus operandi of these AI-led cyberattacks, the agency noted that perpetrators exploit unpatched software to compromise banking systems. Customer-facing complaint interfaces can also serve as potential entry points, added I4C. 

Once inside, NCTAU noted that attackers potentially target automated fund disbursement systems and APIs used for payments and transfers. 

The agency added that these cyberattackers then route funds through mule accounts across different banks and quickly move to withdraw the proceeds of the crime via IMPS and NEFT. The perpetrators then delete records and hide their tracks so that investigation becomes difficult, added the NCTAU. 

As such, the agency has advised financial institutions to take the following measures: 

• Implement CERT-In’s critical advisories “urgently” on payment and disbursement APIs as well as AI agents
• Report cyber incidents to CERT-In within six hours, and to RBI as well in the cases of banks or NBFCs 
• Test payment APIs and strengthen customer-facing infrastructure
• Set transaction limits, verify beneficiary details and monitor sudden changes in transaction speeds, volumes and patterns 
• Ensure KYC and approval checks are completed before funds are transferred
• Improve coordination between security, transaction monitoring and IT teams 
• Conduct authorised red-team exercises to test how quickly security and payment controls respond to machine-speed attacks

The warning highlights how AI is accelerating the threat of cyber fraud for financial services firms. At the Global Fintech Fest (GFF) 2026 in September, both Prime Minister Narendra Modi and RBI Governor Sanjay Malhotra had urged fintechs to bolster cybersecurity and strengthen consumer trust.

At the same event, National Payments Council of India (NPCI) MD and CEO Dilip Asbe had also called on banks and payments companies to invest in AI to combat cyber threats. 

In line with this, CERT-In had also issued a critical advisory last month, raising concerns over cyberattackers using publicly-available agentic AI tools for financially motivated intrusions into Indian entities. 

The advisory follows disclosures by global AI firms OpenAI and Anthropic about their agents taking unauthorised actions during internal cybersecurity evaluations. 

The post Cybersecurity Agency I4C Warns Banks & Fintechs Against AI-Led Cyberattacks appeared first on Inc42 Media.