NEW DELHI: The Indian Cyber Crime Coordination Centre (I4C), under the Union Ministry of Home Affairs (MHA), has sounded an alert over the growing threat of artificial intelligence (AI)-powered cyberattacks targeting banks, non-banking financial companies (NBFCs) and fintech firms. It has warned that hackers are exploiting automated systems to execute fraudulent transactions worth crores of rupees at machine speed.
In an advisory issued to financial institutions, the National Cybercrime Threat Analysis Unit (NCTAU) of the I4C said cybercriminals were deploying AI agents to compromise financial infrastructure, siphon off funds through payment interfaces and erase digital evidence to evade detection.
The advisory, issued jointly with the Indian Computer Emergency Response Team (CERT-In) under the Ministry of Electronics and Information Technology, has urged financial institutions to urgently implement the measures prescribed in critical-severity CERT-In advisories.
"Multi-crore unauthorised transactions through fund disbursement systems and APIs are being found in individual cases," the advisory said, flagging a new dimension to cyber fraud in the financial sector.
According to the agencies, attackers are exploiting unpatched software, misconfigured internet-facing servers and vulnerable IT systems to infiltrate financial institutions. Customer-facing platforms and complaint-handling interfaces are also emerging as potential entry points.
Once inside these systems, hackers target automated fund disbursement mechanisms and specialised application programming interfaces (APIs) used for payments and fund transfers. The use of agentic AI frameworks enables them to execute attacks at machine speed, significantly reducing the time available to financial institutions to detect and prevent fraudulent transactions.
The stolen money is routed through 'mule' accounts, which criminals use to receive and transfer illicit funds across banks. The proceeds are then rapidly moved or withdrawn through Immediate Payment Service (IMPS) and National Electronic Funds Transfer (NEFT) channels.
The attackers subsequently delete transaction records and conceal their digital footprints, making forensic investigations and the recovery of funds more difficult, the advisory said.
The agencies have asked financial institutions to align their security controls with CERT-In's May 2026 blueprint for reducing exposure to AI-assisted vulnerability exploitation, besides complying with the cybersecurity frameworks prescribed by their respective sectoral regulators.
Banks, NBFCs and fintech companies have also been directed to report such incidents to CERT-In within six hours of detection. Banks and NBFCs must additionally report the incidents to the Reserve Bank of India (RBI) through its DAKSH portal within the same timeframe.
As part of preventive measures, institutions have been advised to maintain a comprehensive inventory of payment-related APIs and immediately disable obsolete, unused and testing interfaces that could be exploited by attackers.
The advisory has also stressed the need for closer coordination among chief information security officers, transaction-monitoring teams and IT departments to identify vulnerabilities and mitigate risks associated with API-based attacks.
The warning comes against the backdrop of mounting cyber fraud losses. Union Home Ministry data from the National Cybercrime Reporting Portal (NCRP) and the Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS), operated by the I4C, show that more than 53.87 lakh cyber fraud complaints were registered between 2023-24 and 2025-26.
Over the same period, more than 1.81 lakh FIRs were registered, while the reported amount involved in cyber fraud exceeded Rs 56,087 crore. Of this amount, more than Rs 9,079 crore was marked as lien, while over Rs 206 crore was refunded to victims.
