India’s cyber security agencies have flagged a growing trend of financially motivated cyber attacks targeting banks, non-banking financial companies (NBFCs) and fintech firms. The National Cybercrime Threat Analysis Unit (NCTAU) of the Indian Cyber Crime Coordination Centre (I4C), along with CERT-In under the Ministry of Electronics and Information Technology, said attackers are using Artificial Intelligence (AI) agents to carry out compromises at machine speed.
The agencies said individual cases have involved unauthorised transactions worth several crores through fund disbursement systems and application programming interfaces (APIs). They have advised financial institutions to urgently strengthen their cyber security measures, monitor transactions and report incidents within six hours of detection.
How attackers exploit payment systems
According to the advisory, attackers first target unpatched software or internet-exposed servers and IT systems that have been incorrectly configured. This can include customer-facing systems and complaint-handling interfaces.
Once they gain access to an organisation’s infrastructure, hackers target automated fund disbursement systems or special interfaces used to process payments and transfers. The use of agentic AI frameworks allows these attacks to happen at machine speed.
The stolen money is then transferred to “mule” accounts, which are accounts used by criminals, across different banks. It is quickly moved or withdrawn through IMPS or NEFT. The attackers then delete records and attempt to hide their tracks, making investigations more difficult.
The attack typically follows these steps:
- Exploit unpatched software or misconfigured, internet-exposed servers and IT systems.
- Gain access to infrastructure, including customer-facing and complaint-handling interfaces.
- Target automated fund disbursement systems or payment and transfer APIs, using agentic AI to act at machine speed.
- Transfer funds to “mule” accounts across different banks.
- Move or withdraw the money quickly through IMPS or NEFT.
- Delete records and conceal traces to make investigations harder.
Banks and fintech firms told to act on critical advisories
All banks, NBFCs, fintech companies, payment aggregators, payment gateways and other financial entities have been advised to prioritise measures outlined in two CERT-In advisories, both rated “Critical”.
The first, CIAD-2026-0046, titled “Threat Actors Exploiting Payment and Disbursement APIs for Unauthorized Fund Transfers in BFSI Entities”, was issued on October 9, 2026. The second, CIAD-2026-0049, titled “AI Agents as Attack Vectors”, was issued on October 15, 2026.
Financial institutions have also been asked to align their security controls with CERT-In’s “Blueprint for Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation in Digital Infrastructure”, released in May 2026, as well as cyber security frameworks set by their respective sectoral regulators.
Cyber incidents must be reported within six hours
CERT-In must be informed of any cyber incident within six hours of it being noticed. Banks and NBFCs are also required to report incidents to the Reserve Bank of India (RBI) through its DAKSH portal within six hours of detection.
NBFCs and fintech firms may contact I4C for bulk reporting of fraudulent transactions through the NCRP-CFCFRMS portal. The process is intended to help freeze money defrauded from victims.
Financial institutions urged to strengthen API security
The agencies have outlined additional measures to reduce the risk of attacks on payment and disbursement systems. Financial institutions have been advised to:
- Maintain a complete inventory of digital interfaces and payment APIs, and remove or disable old, unused or test interfaces.
- Ensure the Chief Information Security Officer’s team, transaction monitoring team and IT team work closely to reduce API-related risks.
- Set daily and per-transaction limits, verify beneficiary names and account details, and monitor transactions moving at unusual speed.
- Check for access-token failures from non-whitelisted IP addresses.
- Strengthen customer-facing and complaint-receiving infrastructure against intrusion attempts.
- Conduct a secure architecture review to prevent attackers from moving laterally within systems.
- Monitor sudden changes in transaction narration, beneficiary profiles or transaction volumes.
- Ensure funds cannot be transferred until all required checks, including KYC and approval procedures, have been completed.
- Run authorised red-team exercises simulating machine-speed attacks and measure how quickly security operations centres (SOCs) and payment controls respond.
With AI-powered attacks moving at machine speed, agencies have urged financial institutions to strengthen their defences and act swiftly to prevent unauthorised transfers and limit losses.
ALSO READ:
Delhi Police arrests 7 in Rs 3.93 crore cyber fraud case, probe reveals suspected hawala links