I4C Warns Banks and Fintechs of AI-Assisted Cyberattacks at Machine Speed

NEW DELHI, November 4, 2026: India’s cybercrime agency has warned banks, non-bank lenders, fintech companies and payment aggregators that attackers are using artificial-intelligence agents to move through vulnerable systems and target financial transfers at machine speed. The advisory points to weaknesses in software and payment infrastructure that can turn a technical intrusion into an attempt to move money before conventional checks can respond.

The Indian Cybercrime Coordination Centre (I4C) described the attacks as financially motivated and said AI agents were helping criminals accelerate the compromise of systems. Reuters reported the advisory on Wednesday, quoting its warning that automated tools could enable “machine speed” attacks. The agency identified unpatched software and misconfigured information-technology systems as potential entry points.

Also read: India AI Agents: What They Are and Why Rules Matter

Once inside a network, attackers may seek access to automated fund-disbursement systems or application programming interfaces used for payments and transfers. Those systems are designed to move money between institutions and customers with limited manual intervention. If an attacker obtains the credentials or access needed to invoke them, the same automation that makes legitimate payments efficient can also increase the speed at which fraudulent instructions are submitted.

I4C has asked financial entities, including banks, fintech firms and payment aggregators, to implement measures set out by the Indian Computer Emergency Response Team (CERT-In) in an advisory issued on October 9. It has also recommended additional transaction controls: daily and per-transaction limits, checks that verify beneficiary names, and monitoring for unusual transaction speeds.

These recommendations focus on the point at which a digital instruction becomes a movement of funds. A transaction limit can restrict the amount that leaves an account or system before an alert is investigated. Beneficiary-name verification can expose a mismatch between the intended recipient and the account attached to a payment instruction. Monitoring transaction velocity can help identify a sudden burst of transfers that differs from the normal pattern of an account, merchant or payment channel.

Also read: CERT-In Warns AI Agents Accessed Indian Organisations’ Data

Those controls do not replace basic security work. A financial institution still needs to know which systems are exposed to the internet, which software versions are running, who can access payment APIs, how credentials are issued and revoked, and whether privileged activity is recorded. The I4C warning makes clear that the problem is not confined to a new class of AI model. An attacker still needs a route into the institution’s systems, and weaknesses in configuration, patching or access management can provide that route.

The advisory’s reference to AI agents is important because these systems can perform several linked actions with limited human intervention. They may search for exposed services, test access, move between connected systems and prepare requests at a speed that would be difficult for a person to sustain. That does not mean every AI-assisted intrusion is fully autonomous or that an agent can bypass every safeguard. It means financial firms must consider how automation changes the pace and scale of an attack once a weakness is found.

The agency has not publicly identified a particular bank or lender as the target of the advisory, nor has it disclosed a nationwide loss figure attributable to AI agents. The warning is sector-wide. It should not be read as confirmation that every recent cyber incident involving a financial company was caused by an AI system.

The advisory follows a series of concerns about cyber risks in the financial sector. The Reserve Bank of India has recently sought information from banks about their preparedness for AI-related threats and their compliance with existing cybersecurity requirements, Reuters reported last week. That supervisory focus suggests regulators are looking beyond whether institutions have a general cybersecurity policy and towards whether they can demonstrate that their controls work against changing attack methods.

Reuters also reported that data relating to about 3,900 State Bank of India customers had been exposed in a separate incident. The report does not establish that the SBI incident was carried out by AI agents. It is relevant as an example of the broader exposure of customer information and financial systems that regulators are trying to contain.

Another concern is the connection between core banking systems and third-party payment providers. Banks increasingly depend on external applications, payment gateways, service providers and automated interfaces to process transactions. That network can improve speed and reach, but it also creates more credentials, integrations and software components that need to be monitored. A weak point at one service provider can become a route into a larger financial chain if access is not tightly limited.

For lenders that disburse loans digitally, the risks are not limited to a conventional payment from one customer to another. An attacker who compromises an automated disbursement workflow may attempt to manipulate beneficiary details, create fraudulent requests or exploit gaps between approval and payment. The I4C advisory’s emphasis on fund-disbursement systems and APIs therefore matters to banks, non-bank finance companies and digital lenders, not just payment apps.

Financial institutions will need to test whether transaction limits are enforced at the point where a payment is actually executed, rather than only at an earlier stage in an application. They will also need reliable procedures for suspending credentials, stopping suspicious batches, reconciling disbursements and escalating alerts to people who can intervene. The effectiveness of those measures depends on the quality of logs and the speed at which teams can act on them.

Customers should not assume that the advisory means their accounts have been compromised. It is directed at financial entities and focuses on the systems through which institutions process transactions. Consumers should continue to protect their authentication details and report unexpected transactions through official bank channels, but the central responsibility for implementing the new safeguards rests with the organisations that operate the infrastructure.

The next test will be whether banks and payment companies can translate the warning into measurable changes: tighter API permissions, current software, stronger monitoring, beneficiary checks and limits that are enforced consistently. The I4C advisory does not provide a public deadline or a compliance scorecard. The RBI’s continuing supervision and any further guidance from I4C or CERT-In will help show how quickly the sector responds.