AI-Powered Cyberattacks: I4C Issues Urgent Warning to Banks and NBFCs
I4C and CERT-In alert banks and NBFCs about AI-driven cyber frauds causing multi-crore losses through automated fund disbursement systems.
The Indian government has sounded a high-alert alarm for the financial sector. The National Cybercrime Threat Analysis Unit (NCTAU) of the Indian Cyber Crime Coordination Centre (I4C), in collaboration with CERT-In under the Ministry of Electronics and IT, has detected a dangerous surge in AI-powered cyberattacks on banks, Non-Banking Financial Companies (NBFCs), and FinTech firms.
These are not your typical phishing scams. According to the official advisory, these attacks are financially motivated and leverage "Agentic AI Frameworks," allowing hackers to compromise systems at machine speed. In several individual cases, this has already resulted in unauthorized transactions worth multiple crores through fund disbursement systems and APIs.
The Blueprint of the Attack: How Hackers Strike
The advisory reveals a sophisticated methodology used by cybercriminals to penetrate high-security financial environments. The process typically follows these steps:
- Finding the Gap: Perpetrators scout for unpatched software or misconfigured servers and IT systems that are exposed to the internet. This vulnerability often extends to the interfaces used for customer complaints.
- Targeting the Pipeline: Once inside the infrastructure, hackers target specialized interfaces (APIs) used for payments or automated fund disbursement systems.
- Machine-Speed Execution: By using AI agents, the attackers can execute commands and move funds far faster than human security teams can react.
- The Money Trail: Stolen funds are rapidly funneled into 'mule' accounts—accounts controlled by criminals to layer and move illegal money. These are often spread across various banks to evade detection.
- Rapid Exit: The money is quickly withdrawn or transferred using Immediate Payment Service (IMPS) and National Electronic Funds Transfer (NEFT).
- Erasing Evidence: To thwart law enforcement, the perpetrators delete system records and scrub their digital footprints, making the subsequent investigation extremely difficult.
Strict Directives for Financial Institutions
To combat this evolving threat, the I4C has issued a comprehensive set of security measures that banks and NBFCs must implement immediately.
Infrastructure and API Management
Financial institutions are urged to maintain a complete inventory of all digital interfaces (APIs) used for payments. Any old, unused, or test interfaces must be switched off or removed entirely to close potential entry points. Furthermore, a thorough secure architecture review is recommended to prevent "lateral movement," where a hacker moves from one part of the system to another.
Monitoring and Coordination
The advisory emphasizes the need for seamless coordination between the Bank’s Chief Information Security Officer (CISO) team, the IT team, and the Transaction Monitoring Team. Key monitoring priorities include:
- Watching for unusual transaction speeds.
- Identifying sudden changes in transaction narration patterns, beneficiary profiles, or transaction volumes.
- Checking for NBFC access token failures originating from non-whitelisted IP addresses.
Payment Controls and Validation
To stop the bleed of funds, the I4C suggests setting strict daily and per-transaction limits. It is critical to verify beneficiary names and account details rigorously. The government has stressed that no money should be sent out unless all prerequisite checks, including KYC and necessary approvals, have been fully completed.
Proactive Defense: Red-Teaming
Finally, the advisory encourages institutions to run authorized "red-team" exercises. These are simulated attacks that mimic machine-speed AI threats to test how quickly the Security Operations Centre (SOC) and payment controls can respond to a real-world breach.