Cybersecurity Agency I4C Warns Banks & Fintechs Against AI-Led Cyberattacks

I4C Flags AI-Driven Fraud Risk

The Indian Cyber Crime Coordination Centre (I4C) has issued an advisory cautioning banks, non-banking financial companies and fintech startups about a rising pattern of financial fraud carried out using AI agents. The warning, dated November 3, came through the National Cybercrime Threat Analysis Unit (NCTAU), which functions under the I4C. The unit reported that attackers are gaining entry into financial infrastructure by targeting software that has not been patched and internet-facing servers that are poorly configured.

According to the NCTAU, several isolated instances have already surfaced in which malicious agentic AI systems leveraged compromised financial systems to carry out unauthorised transactions valued in crores of rupees. The agency outlined a typical attack chain: intruders first breach banking systems through unpatched software, and customer complaint interfaces are also viewed as possible entry points. After gaining access, the attackers are said to target automated fund disbursement systems along with the APIs that handle payments and transfers.

Why It Matters For Firms

The funds are then moved through mule accounts spread across multiple banks, with the perpetrators quickly withdrawing the proceeds using IMPS and NEFT. Records are subsequently deleted to obscure the trail and complicate investigations. For regulated entities, the advisory reinforces existing obligations around incident reporting and system hygiene. The I4C has asked financial institutions to report cyber incidents to CERT-In within six hours, conduct testing of payment APIs, and reinforce customer-facing infrastructure. The development signals that AI is speeding up the scale and sophistication of cyber fraud directed at financial services, an issue that has drawn attention from senior policymakers and regulators.

What To Watch Next

The advisory follows a critical note from CERT-In last month on attackers deploying publicly available agentic AI…