Millions of bank users at risk? I4C and CERT-In warns of AI powered cyberattacks, check details
I4C warns banks about rising AI-based cyberattacks.
Hackers are using AI to steal money through unauthorised transactions.
Banks must improve security and report cyberattacks within six hours.
Cyberattacks targeting banks and financial institutions in India are becoming a growing concern, with hackers now using artificial intelligence (AI) to carry out attacks faster. The National Cybercrime Threat Analysis Unit (NCTAU) of the Indian Cybercrime Coordination Centre (I4C) has recently issued a warning to banks, fintech companies, non-bank lenders and payment firms about the rising threat of AI-driven cyberattacks. The agency said cybercriminals are using AI agents to break into systems and target financial transactions at machine speed. Furthermore, it also asked financial organisations to strengthen their security systems and take additional precautions to prevent hackers from accessing their infrastructure and carrying out unauthorised money transfers.
How hackers are using AI to target financial firms
According to the advisory shared by Indian Cybercrime Coordination Centre (I4C), attackers are taking advantage of unpatched software and incorrectly configured, internet-exposed IT systems to gain access to financial infrastructure, including customer complaint interfaces. The authority also added that once the hackers are inside the system, they target automated fund disbursement systems and application programming interfaces (APIs), which are used for payments and money transfers. Multi-crore unauthorised transactions have already been found in individual cases.
Not only that, but the agency also warned that the use of agentic AI frameworks can allow attackers to carry out these activities at machine speed. This can make cyberattacks faster and potentially harder for organisations to detect before damage is caused.
The advisory says the stolen money is sent to ‘mule’ accounts across different banks and quickly moved or withdrawn through IMPS/NEFT, after which the attackers delete records to hide their tracks.
Recent cyberattacks raise concerns in India
India has witnessed several cybersecurity incidents involving financial institutions in recent weeks. In October, State Bank of India (SBI), the country’s largest lender, reported a cyberattack that resulted in the leak of data belonging to 3,900 customers.
The Reserve Bank of India (RBI) has also raised concerns about increasing attacks on financial infrastructure. Last week, the central bank reportedly asked lenders to provide details of their cybersecurity preparedness, including how they are addressing risks linked to AI.
What security measures has I4C suggested?
The I4C has asked banks, fintech companies, payment aggregators and other financial organisations to implement, on priority, the measures outlined by the Indian Computer Emergency Response Team (CERT-In) in its October 9 advisory (CIAD-2026-0046) and its October 15 advisory on AI agents as attack vectors (CIAD-2026-0049). Incidents must be reported to CERT-In within six hours, and banks and NBFCs must also report to the RBI within six hours of detection.
It has also recommended additional precautions to reduce the risk of fraudulent transactions. These include setting daily and per-transaction limits on money transfers, verifying beneficiary names before processing payments and monitoring unusual transaction speeds.