The Indian Cyber Crime Coordination Centre (I4C) warned banks, NBFCs and fintech startups on Nov. 3 that cybercriminals are using artificial‑intelligence agents to steal funds.
Nov. 3 – Advisory issued
The National Cybercrime Threat Analysis Unit (NCTAU) of I4C released an advisory describing how attackers exploit unpatched software and misconfigured internet‑facing servers to infiltrate financial systems. It said AI‑driven agents have been used in several cases to carry out unauthorized transactions worth crores of rupees.
Modus operandi
According to the advisory, criminals first compromise banking or fintech applications, including customer‑facing complaint portals. They then target automated fund‑disbursement APIs and payment interfaces. Once inside, they move money through mule accounts across multiple banks and withdraw proceeds via IMPS and NEFT, deleting logs to hide their tracks.
Recommended safeguards
I4C urged institutions to implement CERT‑In critical advisories for payment and disbursement APIs, report incidents to CERT‑In within six hours and to the RBI for banks or NBFCs, test payment APIs, set transaction limits, verify beneficiary details and monitor abrupt changes in transaction patterns. It also advised strengthening KYC checks, improving coordination between security, monitoring and IT teams, and conducting authorized red‑team exercises to test defenses against machine‑speed attacks.
Policy context
At the Global Fintech Fest 2026 in September, Prime Minister Narendra Modi and RBI Governor Sanjay Malhotra urged fintechs to enhance cybersecurity and consumer trust. NPCI chief Dilip Asbe called for AI investment to fight cyber threats. CERT‑In had issued a prior advisory flagging the use of publicly available agentic AI tools for financially motivated intrusions.
Where things stand
The I4C advisory highlights a growing risk that AI accelerates fraud in India’s financial sector. Regulators and industry leaders are urging swift implementation of security measures to prevent further AI‑enabled theft.