I4C: Banks urged to guard against AI-assisted cyberattacks

The Indian Cyber Crime Coordination Centre (I4C) has urged banks, non-banking financial companies (NBFCs) and fintech firms to implement safeguards against AI-assisted cyberattacks, warning of unauthorised transfers worth several crore rupees in individual cases. Its advisory dated 3 November 2026 calls for tighter controls over payment systems and reporting of cyber incidents to the Indian Computer Emergency Response Team (CERT-In) within six hours of detection.

The advisory, numbered TAU/ADV/020, says I4C’s National Cybercrime Threat Analysis Unit and CERT-In have observed financially motivated attacks using artificial intelligence agents to compromise systems at machine speed. The warning also covers payment aggregators, payment gateways and other financial entities.

I4C identifies automated fund disbursement systems and application programming interfaces (APIs) as targets. APIs are digital interfaces through which software systems exchange information and instructions, including those used to initiate payments and fund transfers.

The advisory does not name affected institutions, give the number of incidents or quantify aggregate losses from these attacks. Its reference to transactions worth several crore rupees concerns individual cases, not a sector-wide loss estimate.

From exposed systems to unauthorised payments

I4C describes an attack sequence that begins with software lacking security updates or incorrectly configured servers and IT systems exposed to the internet. Customer-facing complaint interfaces are among the possible entry points it identifies.

After gaining access, attackers target automated disbursement systems or payment APIs. According to I4C, agentic AI frameworks enable this activity at machine speed: the agency describes AI agents helping carry out the attack, rather than merely generating deceptive messages for customers.

The money is then routed into “mule” accounts, which the advisory describes as accounts used by criminals. I4C says funds are rapidly moved or withdrawn through Immediate Payment Service (IMPS) and National Electronic Funds Transfer (NEFT) channels. Attackers subsequently delete records and conceal their activity, making investigation more difficult.

The agency’s recommended safeguards address both access to financial infrastructure and the checks that govern money leaving it. Its measures extend from securing complaint platforms to monitoring beneficiary details and the speed of transactions.

Payment controls and security teams

I4C advises institutions to maintain a complete inventory of payment APIs and remove or disable old, unused and test interfaces. It also calls for closer coordination between banks’ chief information security officer teams, transaction-monitoring teams and IT departments to address API attack risks proactively.

For outgoing payments, the advisory recommends daily and per-transaction limits, verification of beneficiary names and accounts, and monitoring for unusually fast transactions. It says money should not leave a system unless earlier checks, including know-your-customer (KYC) verification and approvals, have been completed properly.

Transaction-monitoring teams are asked to look for sudden changes in payment descriptions, beneficiary profiles or transaction volumes. These checks sit alongside, rather than replace, the advisory’s recommendations for securing the underlying technology.

I4C also asks banks to check for failed attempts to use NBFC access tokens from internet addresses outside approved lists. An access token is a credential used to request access to a system; the recommendation concerns failed access attempts originating from locations the institution has not authorised.

For customer-facing and complaint-receiving infrastructure, the advisory recommends stronger protection against intrusion and a thorough review of secure system design. The stated purpose includes preventing lateral movement, meaning an intruder’s ability to move from an initially compromised system into other parts of the network.

The agency further recommends authorised red-team exercises: controlled simulations of attacks to test defences. These should simulate machine-speed attacks and measure how quickly the security operations centre, which monitors security threats, and payment controls respond.

Earlier CERT-In advisories form the baseline

The November advisory directs financial institutions to prioritise measures in two CERT-In advisories, both described in the I4C document as having critical severity.

The first, CIAD-2026-0046, dated 9 October 2026, is titled “Threat Actors Exploiting Payment and Disbursement APIs for Unauthorized Fund Transfers in BFSI Entities”. BFSI refers to banking, financial services and insurance. The second, CIAD-2026-0049, dated 15 October 2026, is titled “AI Agents as Attack Vectors”.

I4C also asks institutions to align their controls with CERT-In’s May 2026 “Blueprint for Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation in Digital Infrastructure”, alongside the cybersecurity frameworks prescribed by their respective sectoral regulators.

The November document brings together payment-specific controls, earlier CERT-In measures and sectoral requirements. It does not present its additional safeguards as a substitute for those frameworks.

AI assistance does not establish full autonomy

A separate assessment by the UK’s National Cyber Security Centre (NCSC), published on 7 May 2025, helps distinguish AI-assisted attacks from fully autonomous ones. In “Impact of AI on cyber threat from now to 2027”, the NCSC assessed that AI would highly likely increase the volume and impact of intrusions by improving existing attack techniques, rather than creating entirely new routes of attack.

The NCSC also assessed that fully automated, end-to-end advanced cyberattacks were unlikely through 2027 and that skilled attackers would need to remain involved. That forecast concerns the use of AI in cyber intrusions generally; it does not establish how the Indian incidents occurred.

I4C’s advisory identifies AI assistance and machine-speed compromise but does not specify the AI models used or the degree of human involvement in individual cases.

Six-hour reporting and efforts to freeze funds

I4C asks financial institutions to report any cyber incident to CERT-In within six hours of noticing it. Banks and NBFCs must also report to the Reserve Bank of India through its DAKSH portal within six hours of detection, according to the advisory.

For NBFCs and fintech firms, I4C offers a further reporting route aimed at restricting the movement of stolen funds. The advisory says they may contact I4C to arrange bulk reporting of fraudulent transactions through the National Cybercrime Reporting Portal’s Citizen Financial Cyber Fraud Reporting and Management System, so that defrauded money can be frozen.