The Ministry of Home Affairs has issued an urgent advisory warning banks, Non-Banking Financial Companies (NBFCs), and FinTech platforms of a sharp increase in AI-assisted cyberattacks targeting automated payment and fund-disbursement systems.
Issued on November 3 by the National Cybercrime Threat Analysis Unit (NCTAU) of the Indian Cyber Crime Coordination Centre (I4C) and CERT-In, the advisory states that attackers are using artificial intelligence agents to execute large-scale unauthorised transactions at machine speed, causing losses of several crores in individual cases.
According to the advisory, perpetrators initially exploit unpatched software, misconfigured internet-facing servers, or customer complaint interfaces to gain access.
MHA warns banks of rising AI-powered cyberattacks
They then target automated fund-disbursement systems and payment APIs. Once they gain access, agentic AI frameworks enable attacks to progress rapidly.
Stolen funds are routed through mule accounts at multiple banks and quickly withdrawn or transferred onward through IMPS and NEFT. Attackers then delete logs and records to impede investigations.
The advisory directs all banks, NBFCs, FinTech companies, payment aggregators, and payment gateways to implement, as a priority, the controls set out in two recent CERT-In alerts: CIAD-2026-0046, dated 9 October 2026, concerning threat actors exploiting payment and disbursement APIs; and CIAD-2026-0049, dated 15 October 2026, concerning AI agents as attack vectors. Both alerts are classified as “Critical.” Institutions are also asked to align their defences with CERT-In’s May 2026 blueprint for reducing exposure to AI-assisted vulnerabilities and with cybersecurity frameworks issued by their respective sectoral regulators.
Additional recommended measures include maintaining a comprehensive inventory of payment-related APIs and disabling unused or test interfaces; ensuring close coordination among the Chief Information Security Officer’s team, transaction-monitoring teams, and IT; setting daily and per-transaction limits; verifying beneficiary details; and monitoring for sudden increases in transaction speed or unusual patterns in transaction narration and beneficiary profiles.
Banks are advised to monitor access-token failures involving NBFCs that originate from non-whitelisted IP addresses. Institutions must also ensure funds are not released until all KYC and approval checks are complete, strengthen customer-facing and complaint systems against intrusion, and conduct authorised red-team exercises simulating machine-speed attacks to assess the responsiveness of security operations and payment controls.
Reporting deadlines are strict.
All cyber incidents must be reported to CERT-In within six hours of detection. Banks and NBFCs must also notify the Reserve Bank of India through the DAKSH portal within the same six-hour period. NBFCs and FinTech companies may contact I4C to arrange bulk reporting of fraudulent transactions through the NCRP-CFCFRMS portal, enabling freezing of defrauded funds.
The advisory highlights the escalation of financially motivated attacks on digital payment infrastructure and notes that conventional controls alone are no longer sufficient to counter AI-driven automation. Financial institutions have been instructed to treat the recommended measures as immediate priorities.