New Delhi: India’s cybercrime watchdog, the Indian Cyber Crime Coordination Centre (I4C), has warned banks, non-banking financial companies (NBFCs) and fintech firms of a growing threat from artificial intelligence-powered cyberattacks capable of breaching financial systems and executing fraudulent transactions at machine speed.
The warning comes amid concerns over vulnerabilities in automated fund disbursement systems and payment application programming interfaces (APIs), which cybercriminals are allegedly exploiting to divert crores of rupees into mule accounts before concealing evidence of their activities.
In a joint advisory with the Indian Computer Emergency Response Team (CERT-In), I4C’s National Cybercrime Threat Analysis Unit (NCTAU) has asked financial institutions to urgently strengthen cybersecurity controls and implement measures prescribed in critical-severity CERT-In advisories.
According to the advisory, cybercriminals are increasingly deploying AI agents to automate different stages of attacks, allowing them to identify vulnerabilities, compromise systems and initiate unauthorised financial transactions at unprecedented speed.
“The attacks are financially motivated and are being carried out with the help of Artificial Intelligence (AI) agents leading to machine-speed compromise.
“Multi-crore unauthorised transactions through fund disbursement systems and APIs are being found in individual cases,” the advisory said.
The agencies identified unpatched software, misconfigured internet-facing servers and inadequately secured IT infrastructure as major entry points for attackers.
Once inside a financial institution’s network, hackers target automated disbursement platforms and APIs used for payments and fund transfers.
The stolen funds are subsequently routed through mule accounts maintained across multiple banks and rapidly transferred or withdrawn using payment channels such as IMPS and NEFT.
Attackers also allegedly delete transaction records and other digital evidence to obstruct investigations and complicate efforts to trace stolen money.
However, while the advisory refers to individual cases involving multi-crore unauthorised transactions, it does not identify the affected institutions or disclose the scale of losses attributable specifically to AI-assisted attacks.
I4C and CERT-In have directed financial institutions to strengthen their defences against AI-assisted cyber threats and align security controls with CERT-In’s May 2026 blueprint for reducing exposure to AI-enabled vulnerability exploitation.
Financial institutions have been advised to report cybersecurity incidents to CERT-In within six hours of detection.
Banks and NBFCs are also required to report applicable incidents to the Reserve Bank of India through its DAKSH portal within the prescribed six-hour window, according to the advisory.
Among the preventive measures, institutions have been asked to maintain a comprehensive inventory of payment-related APIs and immediately disable obsolete, unused or testing interfaces that could provide potential entry points for attackers.
The advisory also calls for closer coordination among chief information security officers, transaction monitoring teams and IT departments to identify suspicious activities and mitigate API-related risks.
The warning comes against the backdrop of mounting cyber fraud complaints across India.
According to Union Home Ministry data compiled through the National Cyber Crime Reporting Portal (NCRP) and the Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS), operated by I4C, more than 53.87 lakh cyber fraud complaints were reported between FY2023-24 and FY2025-26.
During the same period, more than 1.81 lakh FIRs were registered, while the total amount reported in cyber fraud complaints exceeded Rs 56,087 crore.
Of the reported amount, more than Rs 9,079 crore was marked as lien, while over Rs 206 crore was refunded to victims.
The figures underline the scale of cyber-enabled financial crime, although they cover a broad range of frauds and cannot be attributed solely to AI-powered attacks.
The advisory raises concerns about the preparedness of India’s rapidly expanding digital financial infrastructure, particularly the security of automated payment systems and third-party integrations.
While AI-assisted attacks can accelerate exploitation, the vulnerabilities identified by I4C — including outdated software, exposed APIs and poorly configured servers — point to weaknesses that conventional cybersecurity practices are already expected to address.
The disclosure of multi-crore fraudulent transactions also raises questions about whether existing transaction monitoring systems can detect and interrupt suspicious fund transfers quickly enough, particularly when attacks are automated.
The larger concern is not merely the growing sophistication of cybercriminals, but whether financial institutions are keeping pace with threats to systems that can move substantial sums of money within seconds.
The advisory underscores the need for stronger API security, real-time fraud detection and coordinated incident response, alongside greater accountability for institutions that fail to address known cybersecurity vulnerabilities.
(PSU Watch is India's Business News centre that places the spotlight on PSUs, Bureaucracy, Defence and Public Policy. 👉 Click to join our channel now: PSUWatch WhatsApp Channel. Prefer LinkedIn? Follow PSU Watch on LinkedIN. Click to stay connected on Twitter here and stay updated.)