I4C warns banks, NBFCs and fintech firms of AI-assisted attacks on payment APIs

India’s financial institutions, including banks, Non-Banking Financial Companies (NBFCs), fintech platforms and payment service providers, have been put on alert against a growing cyber threat involving Artificial Intelligence (AI)-assisted attacks designed to exploit vulnerabilities in payment and fund disbursement infrastructure.

In an advisory dated November 3, 2026, the National Cybercrime Threat Analysis Unit (NCTAU) of the Indian Cyber Crime Coordination Centre (I4C), in coordination with CERT-In under the Ministry of Electronics and Information Technology, flagged a trend of financially motivated cyberattacks targeting financial institutions.

Also read | Cyber warfare: How hackers can turn smart devices into weapons

Titled ‘AI-assisted financially motivated cyberattacks on NBFCs and fintech platforms’, the advisory warns that cybercriminals are increasingly deploying AI agents to accelerate attacks, with multi-crore unauthorised transactions through disbursement systems and application programming interfaces (APIs) being identified in individual cases.

The warning is significant as it highlights how the combination of exposed digital infrastructure, automated financial processes and agentic AI can increase the speed and potential financial impact of cyber fraud.

How AI-driven attacks target financial institutions

According to the advisory, attackers typically begin by exploiting unpatched software and misconfigured, internet-exposed servers or IT systems to gain access to an institution’s infrastructure. Customer-facing and complaint-management interfaces may also become potential entry points.

Once inside, cybercriminals target automated fund disbursement systems and specialised APIs used for payments and fund transfers. The advisory specifically states: “Use of Agentic AI Framework makes the attack possible at machine speed.”

This is a particularly concerning development because automated systems can potentially be exploited to initiate or manipulate transactions much faster than conventional, manually executed cyberattacks.

The stolen funds are subsequently routed through so-called ‘mule’ accounts, which are bank accounts used by criminals to receive and transfer illicit money.

The advisory explains that the money is sent to mule accounts across different banks and then quickly moved or withdrawn through IMPS and NEFT channels.

Attackers may also delete records and conceal their activities, making subsequent investigations more difficult.

Why payment APIs are vulnerable

Payment APIs facilitate communication between financial institutions, payment platforms and other digital services. They are essential to modern financial operations, including loan disbursements, vendor payments and fund transfers.

However, improperly secured APIs, excessive access privileges, weak authentication mechanisms and exposed interfaces can create opportunities for unauthorised access.

The risk becomes more serious when automated disbursement systems are involved, as compromised access can potentially translate into large-value transactions within a short period.

The advisory therefore places particular emphasis on API security, transaction monitoring, beneficiary verification and controls that prevent funds from being released without completing mandatory checks.

I4C's cybersecurity advisory

The advisory calls on financial institutions to strengthen their cybersecurity infrastructure and implement measures recommended in earlier CERT-In advisories, including:

• Maintaining a comprehensive inventory of payment-related APIs and disabling old, unused or testing interfaces.

• Coordinating efforts between the Chief Information Security Officer’s team, transaction monitoring teams and IT departments.

• Establishing daily and per-transaction limits.

• Verifying beneficiary names and accounts.

• Monitoring unusual transaction speeds and sudden changes in beneficiary profiles or transaction volumes.

• Checking NBFC access-token failures originating from non-whitelisted IP addresses.

• Strengthening customer-facing and complaint-receiving infrastructure to detect potential intrusion attempts.

• Conducting secure architecture reviews to prevent lateral movement within compromised systems.

• Ensuring that mandatory checks, including KYC and approvals, are completed before funds are released.

• Conducting authorised red-team exercises to simulate machine-speed attacks and assess the response capabilities of Security Operations Centres (SOCs) and payment controls.

The advisory also stresses the importance of implementing the recommendations in CERT-In advisories CIAD-2026-0046, concerning exploitation of payment and disbursement APIs, and CIAD-2026-0049, concerning AI agents as attack vectors.

Six-hour cyber incident reporting rule

Apart from preventive measures, the advisory reiterates the importance of rapid incident reporting.

It states: “Report any cyber incident to CERT-In within 6 hours of noticing it.” Banks and NBFCs must also report incidents to the Reserve Bank of India’s DAKSH portal within six hours of detection.

For bulk reporting of fraudulent transactions, NBFCs and fintech companies may contact I4C through the National Cybercrime Reporting Portal's Citizen Financial Cyber Fraud Reporting and Management System (NCRP-CFCFRMS), enabling defrauded funds to be frozen where possible.

What the warning means for India’s financial sector?

The warning has implications beyond conventional banking cybersecurity. It highlights the emerging risks associated with AI-driven financial crime, particularly as India’s financial ecosystem increasingly relies on APIs, automated payments, digital lending and technology-led disbursement systems.

Also read | Cybercrime cases jumped 141 per cent from 2018 to 2022: Home Ministry informs Lok Sabha

For banks and NBFCs, the threat extends beyond data breaches or customer-account compromises. A successful attack on internal payment infrastructure could result in direct financial losses, operational disruption, regulatory scrutiny and reputational damage.

Fintech companies, payment aggregators, payment gateways and other entities handling financial transactions also need to assess whether their API access controls, transaction monitoring systems and fund-release mechanisms can withstand attacks executed at machine speed.

The larger message from the I4C advisory is clear – cybersecurity measures must evolve alongside AI-enabled threats. Financial institutions can no longer rely solely on conventional security monitoring; they must ensure that automated payment systems have strong access controls, transaction-level safeguards and the ability to detect and stop suspicious fund movements before money leaves the system.