India warns banks of AI-powered cyberattacks and machine-speed fraud

The rise of AI-driven theft

The Indian Cyber Crime Coordination Centre (I4C), operating under the Union Ministry of Home Affairs, has issued a high-level alert regarding a new wave of cyber threats. These attacks specifically target banks, non-banking financial companies (NBFCs), and various fintech firms across the country. The primary concern is the use of artificial intelligence to conduct fraudulent activities that occur at machine speed.

According to the advisory issued by the National Cybercrime Threat Analysis Unit (NCTAU), hackers are no longer just using manual scripts. They are deploying AI agents designed to compromise financial infrastructure and siphon off large sums of money. These agents can move through payment interfaces and delete digital evidence almost instantly to avoid being caught by security teams.

The government warns that these methods are leading to massive unauthorized transfers through payment systems and APIs. As the advisory notes, "Multi-crore unauthorised transactions through fund disbursement systems and APIs are being found in individual cases." This represents a significant escalation in the complexity and speed of modern financial crime.

How attackers infiltrate systems

Cybercriminals are finding multiple entry points into the financial ecosystem by looking for technical weaknesses. They often exploit unpatched software, which is software that has not received the latest security updates. They also target misconfigured internet-facing servers and other vulnerable IT systems to gain an initial foothold in a company's network.

Interestingly, the advisory points out that customer-facing platforms and even complaint-handling interfaces are becoming potential gateways for hackers. Once an attacker successfully infiltrates these systems, they move toward the core of the financial operation. They specifically look for automated fund disbursement mechanisms and specialized application programming interfaces (APIs) used for transfers.

APIs are sets of rules that allow different software programs to communicate with each other, such as when a mobile app talks to a bank's server. By targeting these specific interfaces, hackers can trigger payments automatically. The use of agentic AI frameworks allows these attacks to happen so quickly that financial institutions have very little time to detect the breach or stop the money from leaving the account.

The lifecycle of a digital heist

Once the hackers gain access and initiate a fraudulent transfer, the stolen money follows a rapid path to prevent recovery. The criminals route the funds through 'mule' accounts, which are accounts held by individuals who allow others to use them to move illicit money. These accounts act as a buffer, moving the funds across different banks to obscure the original source of the theft.

From these mule accounts, the proceeds are moved or withdrawn very quickly using established payment channels. The advisory specifically mentions the use of the Immediate Payment Service (IMPS) and the National Electronic Funds Transfer (NEFT) systems. These channels are designed for speed, which the criminals exploit to ensure the money is gone before the victim or the bank realizes what happened.

To further complicate the situation, the attackers are programmed to delete transaction records and conceal their digital footprints. This systematic erasure of data makes it much harder for forensic investigators to piece together what happened. Consequently, recovering the stolen funds becomes a significantly more difficult task for both the victims and the financial institutions involved.

New rules for financial security

In response to these threats, the I4C and the Indian Computer Emergency Response Team (CERT-In) are demanding immediate action from the financial sector. They have urged institutions to implement specific measures outlined in critical-severity advisories. Specifically, banks and fintechs are being told to align their security controls with a May 2026 blueprint designed to reduce exposure to AI-assisted vulnerability exploitation.

The government is also tightening the rules on how quickly these crimes must be reported. Financial institutions are now directed to report cyber incidents to CERT-In within just six hours of detection. Additionally, banks and NBFCs must notify the Reserve Bank of India via the DAKSH platform within that same six-hour window. This rapid reporting is intended to help authorities track and respond to threats in real-time.

To prevent attacks before they happen, companies are being told to maintain a complete inventory of all payment-related APIs. They must immediately shut down any obsolete, unused, or testing interfaces that are no longer needed. The advisory also stresses the need for better internal communication between security leaders, transaction monitoring groups, and IT teams to identify and fix vulnerabilities before they can be exploited.

The scale of the cyber crisis

The urgency of this warning is underscored by the massive scale of cyber fraud currently affecting India. Records from the National Cybercrime Reporting Portal (NCRP) and the Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS) show a staggering number of complaints. Between 2023-24 and 2025-26, more than 53.87 lakh cyber fraud complaints were registered by the public.

During this same period, authorities registered more than 1.81 lakh FIRs, which are formal complaints for criminal investigation. The total amount involved in these reported cyber frauds exceeded Rs 56,087 crore. This highlights the massive financial impact that cybercriminals are having on the economy and the individual citizens who rely on digital banking services.

Despite the high volume of crime, the recovery of funds remains a challenge. Out of the total amount involved in fraud, more than Rs 9,079 crore was marked as a lien, which means the money was frozen. However, only over Rs 206 crore was actually refunded to the victims. This disparity emphasizes why the government is pushing for faster detection and more robust AI-resistant security measures across the entire financial infrastructure.