The Indian Cyber Crime Coordination Centre (I4C) has warned banks, non-banking financial companies (NBFCs), fintech firms and payment aggregators that criminals are using artificial intelligence (AI) agents to break into financial systems and move money at machine speed. The advisory, issued on 3 November 2026, was made public on 4 November.
The alert comes from the National Cybercrime Threat Analysis Unit (NCTAU) of I4C, which works under the Ministry of Home Affairs, and was issued jointly with the Indian Computer Emergency Response Team (CERT-In). It follows an estimated ₹300 crore lost by small NBFCs to AI-powered cyberattacks in about two months.
How the I4C says AI cyberattacks hit fintechs and lenders
“These attacks are financially motivated and are being carried out with the help of Artificial Intelligence (AI) agents, leading to machine-speed compromise,” the advisory said, according to Reuters. The agency said it had found individual cases of unauthorised transactions running into crores of rupees, but did not name the institutions affected.
- Entry point: unpatched software, misconfigured internet-facing servers and customer complaint interfaces.
- Target: automated fund disbursement systems and the application programming interfaces (APIs) used for payments and transfers.
- Cash-out: funds are routed to mule accounts across several banks and withdrawn quickly through IMPS and NEFT.
- Cover-up: attackers delete records to make investigation harder.
The pattern is close to recent cases on the BFSI track, including the ₹7.8 crore Spandana Sphoorty cyber fraud, where money was sent to 82 accounts.
What the advisory asks banks and fintech firms to do
I4C asked all regulated financial entities to urgently apply the critical measures in the CERT-In advisories of 9 October 2026 on payment and disbursement APIs and AI agents. Other steps include:
- Report cyber incidents to CERT-In within six hours, and also to the Reserve Bank of India (RBI) in the case of banks and NBFCs.
- Test payment APIs and harden customer-facing systems.
- Set daily and per-transaction limits, verify beneficiary names and watch for sudden changes in transaction speed, volume or pattern.
- Complete KYC and approval checks before any funds are released.
- Run authorised red-team exercises to see how fast controls react to machine-speed attacks.
Why it matters for India’s fintech sector
Fintechs and payment aggregators depend on open APIs to connect with partner banks, which makes those interfaces a direct route to money. The RBI has already tightened cyber checks on fintech and NBFC APIs and sought proof of AI-risk preparedness from banks, while digital payment frauds rose to 3.58 lakh cases in September. The I4C warning adds a home ministry voice to that pressure and puts transaction monitoring, not only perimeter security, at the centre of compliance.
Payments companies have been stepping up cyber defences, but the advisory suggests that controls built for human-speed fraud may not be fast enough.
Key takeaways
- I4C and CERT-In say AI agents are being used to drain fund disbursement systems and payment APIs.
- Banks, NBFCs, fintechs and payment aggregators must apply CERT-In’s 9 October measures and report incidents within six hours.
- Transaction limits, beneficiary checks and speed monitoring are now expected baseline controls.
FAQ
What did the I4C advisory warn about?
It warned that criminals are using AI agents to exploit weak systems at financial firms and push unauthorised payments through APIs at machine speed.
Who does the I4C advisory apply to?
It covers banks, NBFCs, fintech firms, payment aggregators and other financial entities.
How fast must incidents be reported?
Within six hours to CERT-In, and to the RBI as well for banks and NBFCs.
