THE ESSENTIALS IN 30 SECONDS

  • An advisory from I4C's National Cybercrime Threat Analysis Unit says attackers are using AI agents to compromise financial firms and target payment and disbursement APIs.
  • I4C says individual cases involved unauthorised transactions worth crores of rupees, routed through mule accounts and withdrawn quickly via IMPS and NEFT.
  • Financial entities are asked to apply CERT-In's October 9 measures, set transaction limits, verify beneficiaries and run red-team tests against machine-speed attacks.

The Indian Cyber Crime Coordination Centre (I4C), the Ministry of Home Affairs body that coordinates the country's response to cybercrime, has warned banks, non-banking financial companies (NBFCs) and fintech firms that attackers are using AI agents to break into their systems. The advisory, from I4C's National Cybercrime Threat Analysis Unit, was dated November 3 according to Inc42 and made public on November 4, Reuters reported. It comes days after the Reserve Bank of India pressed banks on their readiness for AI-related cyber risks.

How the attacks work, according to I4C

The agency describes the campaigns as financially motivated and says agentic AI tools allow intruders to compromise systems at machine speed. Attackers first exploit unpatched software or misconfigured internet-facing servers, including customer complaint interfaces. They then go after automated fund disbursement systems and the application programming interfaces (APIs) used for payments and transfers. Money is moved into mule accounts spread across several banks, pulled out quickly through the IMPS and NEFT payment rails, and records are deleted to slow investigators. I4C says it has seen individual cases with unauthorised transactions running into crores of rupees, but neither Inc42 nor ANI reported a total.

What financial firms are asked to do

I4C asks banks, fintechs and payment aggregators to implement the measures that CERT-In, the national cybersecurity agency, issued on October 9. ANI and Inc42 list further steps: inventory payment APIs and switch off old or test interfaces; set daily and per-transaction limits; verify beneficiaries; watch for sudden changes in transaction speed or volume; block any transfer until KYC checks are complete; and have security, IT and transaction-monitoring teams coordinate. Authorised red-team exercises should measure how quickly defences respond to machine-speed attacks. Incidents must be reported to CERT-In within six hours, and banks and NBFCs must also notify the RBI.

Context

The advisory adds to a series of warnings in India. Last month, CERT-In said AI models under evaluation had accessed live systems of Indian organisations without authorisation, which Reuters calls the country's first official account of such behaviour. The RBI, Reuters reported last week, asked banks to demonstrate compliance with existing rules and to detail their preparedness for AI risks. The advisory does not name the institutions affected or the AI tools used in the attacks.