The new banking risk: AI agents that hack at machine speed

India's financial sector has received a serious warning from the Indian Cyber Crime Coordination Centre (I4C) regarding emerging AI-assisted cyberattacks targeting banks, Non-Banking Financial Companies (NBFCs), and FinTech platforms.

The advisory, dated November 3, was issued by the National Cybercrime Threat Analysis Unit (NCTAU) in coordination with the Indian Computer Emergency Response Team (CERT-In) under the Ministry of Electronics and Information Technology. The advisory warned: "The attacks are financially motivated and are being carried out with the help of Artificial Intelligence (AI) agents leading to machine-speed compromise."

The advisory further noted that "Multi-crore unauthorised transactions through disbursement systems and APIs are being found in individual cases," highlighting how cybercriminals exploit automated systems to move funds across financial institutions.

Also read: Cyber warfare: How hackers can turn smart devices into weapons

Attack mechanism

Perpetrators begin by exploiting unpatched software and misconfigured, internet-exposed servers and IT systems to compromise an organization's infrastructure. This initial entry vector includes customer-facing and complaint-handling interfaces.

Once inside, hackers target automated fund disbursement systems and specialized application programming interfaces (APIs) used for processing payments and fund transfers. Highlighting the role of automated intrusion, the advisory stated, "Use of Agentic AI Framework makes the attack possible at machine speed."

The siphoned funds are subsequently moved into mule accounts established across different banks to receive and move illicit money. Criminals quickly withdraw or transfer the funds using Immediate Payment Service (IMPS) and National Electronic Funds Transfer (NEFT) before deleting system records to conceal their tracks and hamper investigations.

Mandatory safeguards

To mitigate these threats, I4C has advised banks, NBFCs, FinTech companies, payment aggregators, payment gateways, and other financial entities to urgently implement recommendations from two critical CERT-In advisories: CIAD-2026-0046, concerning unauthorised fund transfers through payment and disbursement APIs, and CIAD-2026-0049, concerning AI agents as attack vectors.

Financial institutions are recommended to maintain a complete inventory of payment APIs and switch off old, unused, or testing interfaces. Institutions must also coordinate cybersecurity, transaction monitoring, and IT teams while establishing daily and per-transaction limits.

Additional safeguards include verifying beneficiary names and accounts, monitoring unusual transaction speeds, and tracking sudden changes in beneficiary profiles or transaction volumes. Institutions must also check NBFC access-token failures originating from non-whitelisted IP addresses.

Also read: SBI reports cyberattack after nearly 3,900 customer records leaked on dark web

System hardening

Organizations must strengthen customer-facing and complaint-receiving infrastructure, conduct secure architecture reviews, and enforce controls ensuring funds cannot be released unless all mandatory checks, including Know Your Customer (KYC) and approvals, are fully completed.

The advisory further recommends conducting authorised red-team exercises to simulate machine-speed attacks, allowing institutions to assess the real-time response capabilities of Security Operations Centres and payment controls.

Strict instructions have also been established for incident reporting, with I4C mandating, "Report any cyber incident to CERT-In within 6 hours of noticing it."

Regulated reporting

Banks and NBFCs are additionally required to report incidents to the Reserve Bank of India (RBI) through its DAKSH portal within six hours of detection.

For bulk reporting of fraudulent transactions, NBFCs and FinTech companies may contact I4C through the National Cybercrime Reporting Portal's Citizen Financial Cyber Fraud Reporting and Management System (NCRP-CFCFRMS) portal to enable the immediate freezing of defrauded funds.

As India's financial entities rely increasingly on digital infrastructure, automated payments, and APIs, protecting these networks against machine-speed AI cyberattacks has become a critical priority across every entity involved in moving money.