The NCTAU flagged that attackers were exploiting unpatched software and misconfigured internet-facing servers to gain access to financial infrastructure
With this, the I4C is looking to clampdown on misuse of agentic AI systems, curb financial loss for the general public and fix compromised financial systems
The agency has advised financial institutions to report cyber incidents to CERT-In within six hours, test payment APIs and strengthen customer-facing infrastructure
The Indian Cyber Crime Coordination Centre (I4C) has warned banks, non-banking financial companies (NBFCs) and fintech startups against the growing trend of cyberattackers using AI agents for financial frauds.
In an advisory issued on November 3, the National Cybercrime Threat Analysis Unit (NCTAU), under the I4C, flagged that attackers were exploiting unpatched software and misconfigured internet-facing servers to gain access to financial infrastructure.
The cybersecurity agency also said that it has unearthed multiple “individual” cases, where malicious agentic AI systems were exploiting compromised financial systems to undertake unauthorised transactions running into crores of Rupees.
Describing the modus operandi of these AI-led cyberattacks, the agency noted that perpetrators exploit unpatched software to compromise banking systems. Customer-facing complaint interfaces can also serve as potential entry points, added I4C.
Once inside, NCTAU noted that attackers potentially target automated fund disbursement systems and APIs used for payments and transfers.
The agency added that these cyberattackers then route funds through mule accounts across different banks and quickly move to withdraw the proceeds of the crime via IMPS and NEFT. The perpetrators then delete records and hide their tracks so that investigation becomes difficult, added the NCTAU.
As such, the agency has advised financial institutions to take the following measures:
The warning highlights how AI is accelerating the threat of cyber fraud for financial services firms. At the Global Fintech Fest (GFF) 2026 in September, both Prime Minister Narendra Modi and RBI Governor Sanjay Malhotra had urged fintechs to bolster cybersecurity and strengthen consumer trust.
At the same event, National Payments Council of India (NPCI) MD and CEO Dilip Asbe had also called on banks and payments companies to invest in AI to combat cyber threats.
In line with this, CERT-In had also issued a critical advisory last month, raising concerns over cyberattackers using publicly-available agentic AI tools for financially motivated intrusions into Indian entities.
The advisory follows disclosures by global AI firms OpenAI and Anthropic about their agents taking unauthorised actions during internal cybersecurity evaluations.
Source: Inc42
