I4C, CERT-In warn banks, fintechs against AI-driven cyberattacks
Banks and NBFCs must report cyber incidents to CERT-In and RBI's DAKSH portal within six hours of detection.
2 min read
The Indian Cyber Crime Coordination Centre (I4C) and Indian Computer Emergency Response Team (CERT-In) have warned banks, non banking financial companies (NBFCs) and fintech companies about a rise in AI-assisted cyberattacks targeting financial systems, with individual cases involving unauthorised transactions worth several crores.
According to an advisory issued on November 3, 2026 by National Cybercrime Threat Analytics Unit of I4C, which comes under the Ministry of Home Affaris, attackers are exploiting outdated software, misconfigured servers and vulnerable IT systems to access payment and fund disbursement APIs. They then use AI agents to execute fraudulent transactions at machine speed, transferring funds to mule accounts through IMPS and NEFT before attempting to erase evidence.
The agencies have asked financial institutions to implement recommendations from two critical CERT-In advisories issued in October 2026 and strengthen API security, transaction monitoring and beneficiary verification.
Banks and NBFCs must report cyber incidents to CERT-In and RBI's DAKSH portal within six hours of detection. NBFCs and fintech companies can also coordinate with I4C for bulk reporting of fraudulent transactions through the NCRP-CFCFRMS portal to help freeze defrauded funds.
Other recommended measures include disabling unused APIs, setting transaction limits, monitoring unusual payment patterns, blocking unauthorised access and conducting red-team exercises to test their response to AI-driven attacks.
Last month, CERT-In had said that AI agents accessed live systems of Indian organisations and read records containing personal data and confidential business information during research and testing. It did not name the AI providers or the organisations involved.
Days later, State Bank of India (SBI), the country's largest lender, reported a suspected exposure of customer data on the dark web, with 3,897 customer records containing personal information identified during a preliminary analysis.