I4C warns banks and fintechs of AI agent-driven fraud attacks

How the attacks work

According to the advisory, attackers first exploit unpatched software and misconfigured internet-facing servers and IT systems. Customer-facing and complaint-handling interfaces can also be targets. Once inside, they go after automated fund disbursement systems or the APIs used for payments and transfers, and an agentic AI framework lets them act at machine speed.

The money is sent to mule accounts across different banks and then moved on or withdrawn quickly through IMPS or NEFT. The attackers then delete records and hide their tracks, which makes investigation harder.

What institutions are told to do

Financial institutions must urgently implement the measures in critical-severity CERT-In advisories and align their controls with CERT-In's May 2026 blueprint on defending against AI-assisted vulnerability exploitation, plus the frameworks of their sectoral regulators. They should keep a full inventory of payment-related APIs and disable obsolete, unused or testing interfaces. The advisory also calls for closer coordination between the CISO's team, transaction monitoring teams and IT departments.

Incidents must be reported to CERT-In within six hours of detection. Banks and NBFCs must also report to the Reserve Bank of India through its DAKSH portal in the same window.

The scale of the wider problem is large. Home Ministry data shows more than 5,387,905 cyber fraud complaints on the NCRP from FY 2023-24 to 2025-26, with over 181,271 FIRs registered. Reported losses exceed ₹56,087 crore, of which more than ₹9,079 crore is under lien and over ₹206 crore has been refunded.