India’s Indian Cyber Crime Coordination Centre (I4C) has warned banks, non-banking finance companies and fintech firms of a growing trend of financially motivated cyber attacks that use AI agents. The advisory, issued by the centre’s threat analysis unit with CERT-In and reported on 5 November, says attackers are using agentic AI frameworks to compromise systems at “machine speed”, and that multi-crore unauthorised transactions through fund disbursement systems and payment APIs have been found in individual cases.
It describes attackers exploiting unpatched or misconfigured internet-facing servers, entering through customer complaint portals, attacking automated payment and fund-transfer interfaces, then moving money quickly through mule accounts at several banks and deleting records to cover their tracks.
The centre asks firms to keep a full inventory of payment APIs and switch off old, unused or test interfaces; set daily and per-transaction limits; verify beneficiary names and accounts; watch for unusually fast transactions; release no money until KYC and approval checks are complete; and run authorised red-team exercises that simulate machine-speed attacks.
It follows a CERT-In warning in October about AI agents being used to gain unauthorised access to Indian systems. For customers, it is a reminder that banks’ own controls, not just passwords, now stand between AI-assisted fraud and their money.
Source: ANI report of the advisory