I4C, CERT-In Warn Banks And Fintech Firms Of AI-Driven Cyberattacks, Flag Risk Of Multi-Crore Financial Fraud
· Free Press Journal
New Delhi: The National Cybercrime Threat Analysis Unit (NCTAU) of Indian Cyber Crime Coordination Centre (I4C) and CERT-In, Ministry of Electronics and IT has noticed a trend in cyber-attacks based cyber frauds on Banks, Non-Banking Financial Companies (NBFCs) and FinTech Companies.
Visit milkshake.it.com for more information.
Imp #Cyber Advisory: The government is warning banks, NBFCs (Non-Banking Financial Companies) and FinTech companies that cybercriminals are using #ArtificialIntelligence (AI) to steal money from financial institutions.
— Ankur Sharma (@AnkurSharma__) November 4, 2026
- These attacks are becoming faster because hackers are using… pic.twitter.com/xXdoGtNvGB
"These attacks are financially motivated and are being carried out with the help of Artificial Intelligence (AI) agents leading to machine speed compromise. Multi-crore unauthorized transaction through fund disbursement systems and APIs are being found in individual cases," read the advisory from 14C.
The advisory said that Perpetrators exploit unpatched software or mis-configured internet exposed Servers / IT systems to compromise the infrastructure.
Senior Citizen Loses ₹2.82 Crore In Cyber Fraud After Falling For Deepfake Video Of Finance MinisterThis also includes customer end complaint interface, according to the advisory, adding that Hackers then target automated fund disbursement systems or special interfaces (APIs) used for payments and fund transfers.
"Use of Agentic AI Framework makes the attack possible at machine speed," it said.
The money is subsequently transferred to 'mule' accounts, which are bank accounts used by criminals to receive and move illegally obtained funds. These accounts may be spread across multiple banks, allowing the money to be quickly transferred or withdrawn through Immediate Payment Service (IMPS) and National Electronic Funds Transfer (NEFT).
Maharashtra Cyber Police Warn Citizens Against Diwali Message Scams, Urge Caution Over Fake Gift Links & Online Fraud"Then perpetrator delete records and hide their tracks so that investigation becomes difficult," the advisory added.
The advisory has directed financial institutions to take security measures, including:
Keep a complete list of all digital interfaces (APIs) used for payments and remove or switch off old, unused or test interfaces.
Bank’s Chief Information Security Officer’s Team and Transaction Monitoring Team and IT Team
may work in close coordination for proactively mitigating the API attack risks.
Set daily and per-transaction limits, verify beneficiary names and accounts, and watch for unusual speed of transactions.
Diwali 2026: 8 Smartphone & Online Shopping Scams To Watch Out For During Festive SalesBanks Check for NBFC’s Access token failures from non-whitelisted IPs.
Strengthen the customer facing & complaint receiving infrastructure for any potential attempts of intrusion.
Thorough secure architecture review may be conducted to prevent lateral movement.
Sudden change in transaction narration patterns and beneficiary profiles or volume may be monitored by transaction monitoring team.
Make sure money cannot be sent out unless all earlier checks (KYC, approval, etc.) have been completed properly.
Run authorised red-team exercises that simulate machine-speed attacks, and measure how quickly SOC and payment controls respond.
(Except for the headline, this article has not been edited by FPJ's editorial team and is auto-generated from an agency feed.)