AI agents could turn payment-system breaches into rapid transfers, India warns

India’s cyber agencies warn that attackers could use AI to move from accessing financial systems to fraudulent transfers at machine speed, urging lenders and fintech firms to tighten controls and report incidents within six hours.

India’s cybercrime authorities have warned banks, non-bank lenders and fintech companies that criminals are using artificial intelligence agents to accelerate attacks on payment systems, potentially enabling unauthorised transfers worth crores of rupees. The Indian Cyber Crime Coordination Centre’s National Cybercrime Threat Analysis Unit says automated tools can help attackers move from gaining access to initiating fraudulent transactions at machine speed. The warning does not identify specific institutions or incidents. CERT-In’s separate technical advisory describes campaigns targeting financial and payment organisations, while cautioning that its findings do not mean every institution has been affected.

The attacks may begin with unpatched software, poorly configured internet-facing systems, exposed application programming interfaces or privileged access points. Once inside, criminals can obtain payment credentials and use disbursement or transfer APIs, sometimes calling them from infrastructure the victim organisation trusts. CERT-In says this can allow attackers to bypass safeguards such as customer verification, beneficiary checks, approval processes and transaction limits. Transfers may be disguised with misleading reference details before funds are routed through mule accounts and quickly moved or withdrawn.

The I4C and the Indian Computer Emergency Response Team have urged financial institutions to apply critical-severity security guidance and strengthen controls around payment systems. CERT-In recommends maintaining a complete inventory of payment and disbursement APIs, disabling obsolete or testing interfaces, protecting credentials and reviewing access permissions and transaction safeguards. It also stresses continuous monitoring and the preservation of evidence. The agencies have called for closer cooperation between information-security, IT and transaction-monitoring teams, reflecting the risk that automated attacks can unfold faster than conventional checks may detect them.

Institutions have also been told to report cyber incidents to CERT-In within six hours of detection. Banks and non-banking financial companies were directed to notify the Reserve Bank of India through its DAKSH portal within the same period. CERT-In’s incident-management guidance says organisations should be ready to assess and contain attacks, identify affected systems, preserve evidence and recover operations, as well as report promptly. RBI requirements also call for incident response and post-incident analysis for covered payment-system operators, although their application depends on an organisation’s regulatory status.

The warning comes amid a substantial volume of reported cybercrime. Data cited by the Union Home Ministry for the financial years 2023-24 to 2025-26 records more than 5.38 million complaints on the National Cybercrime Reporting Portal and more than 181,000 FIRs. The reported financial loss exceeded Rs 56,087 crore, while more than Rs 9,079 crore was marked as lien and over Rs 206 crore was refunded. CERT-In’s broader guidance on AI-assisted exploitation warns that the time between initial access and harmful activity may be shrinking, making ongoing monitoring, rapid remediation and tested recovery plans increasingly important.

Source Reference Map

Inspired by headline at: ^[1]

Sources by paragraph:

Source: Fuse Wire Services