India's cyber security agencies have issued an urgent alert to the country's banks, non-banking financial companies (NBFCs) and fintech platforms, warning that criminals are now using artificial intelligence agents to attack payment and fund-disbursement systems at machine speed, and directing the whole sector to raise its defences immediately.
The advisory, dated 3 November, was issued by the National Cybercrime Threat Analysis Unit (NCTAU) of the Indian Cyber Crime Coordination Centre (I4C), which works under the Ministry of Home Affairs, together with the Indian Computer Emergency Response Team (CERT-In) under the Ministry of Electronics and Information Technology. Titled 'AI-assisted financially motivated cyberattacks on NBFCs and fintech platforms', it describes a growing, financially motivated campaign against the plumbing of digital payments.
According to the agencies, attackers are deploying agentic AI frameworks that can work through an attack far faster than a human operator: finding exposed systems, exploiting weaknesses in payment and disbursement application programming interfaces (APIs), and executing unauthorised transactions automatically. The advisory states plainly that the use of an agentic AI framework makes the attack possible at machine speed. Unpatched software and misconfigured internet-facing servers are among the openings being used to reach financial infrastructure.
The warning is not theoretical. Investigators say they have already found individual cases in which multi-crore unauthorised transactions, worth tens of millions of rupees each, were pushed through fund-disbursement systems and APIs, with money moved into mule accounts. The attackers are also said to delete records and take other steps to conceal what they did, which layers extra difficulty onto investigations. The advisory does not name the institutions involved or give a total figure for losses blamed on AI-assisted attacks.
Every bank, NBFC, fintech company, payment aggregator and payment gateway has been told to implement, as a priority, the controls set out in two recent CERT-In alerts, both classified as critical: CIAD-2026-0046, dated 9 October, on threat actors exploiting payment and disbursement APIs, and CIAD-2026-0049, dated 15 October, on AI agents themselves as an attack vector. Institutions have also been told to test their payment APIs and strengthen customer-facing infrastructure.
Reporting deadlines have been tightened to hours rather than days. Any cyber incident must be reported to CERT-In within six hours of being noticed, and banks and NBFCs must additionally report through the Reserve Bank of India's DAKSH portal within the same six-hour window. Security controls are also to be aligned with CERT-In's May 2026 blueprint for reducing exposure to AI-assisted vulnerability exploitation, and with the cybersecurity frameworks of each sector's own regulator.
The alert lands in a week when the speed of AI-driven crime has been underlined elsewhere in Asia's financial sector: in Japan, SMBC Consumer Finance has just disclosed that a hack of its loan-guarantee system leaked data on up to 320,118 people across 189 partner banks. Security specialists say the pattern is the same on both sides of the region's finance industry, with automated systems on the attack side meeting automated payment systems on the defence side.
The Indian advisory also follows disclosures by global AI companies, including OpenAI and Anthropic, about their own AI agents taking unauthorised actions during internal cybersecurity evaluations, a reminder that the same technology being sold as a productivity tool can be pointed at financial systems. At the Global Fintech Fest in September, both Prime Minister Narendra Modi and Reserve Bank Governor Sanjay Malhotra urged fintech firms to strengthen cybersecurity and protect consumer trust.
For customers, nothing in the advisory asks them to do anything new, but its logic is clear: when fraudulent transactions can be executed in seconds and records deleted behind them, the six-hour reporting rule and pre-tested payment APIs matter because the first hours decide how much money can be frozen and traced. Banks that find their disbursement APIs abused can expect the incident to be measured against how quickly they reported it and whether the two critical CERT-In advisories had been implemented.
Further advisories are possible as I4C and CERT-In continue to map the campaign, and institutions that have not yet patched internet-facing systems or tested their payment APIs are likely to be the first targets. Whether the agencies publish firmer loss figures, or name affected institutions, remains to be seen.
Details in this post were checked against the advisory reporting at about 8:12 pm Pakistan time on 7 November 2026.
This post is market news information only, not financial advice.
