AI Cyberattacks on Indian Banks have triggered a fresh warning from India’s cybersecurity authorities, with hackers increasingly using artificial intelligence to break into financial systems and execute unauthorised money transfers.
The Indian Cyber Crime Coordination Centre (I4C) and the Indian Computer Emergency Response Team (CERT-In) have alerted banks, NBFCs, fintech companies and payment service providers about the growing threat.
In an advisory issued on November 4, 2026, authorities highlighted how AI-powered tools are helping cybercriminals exploit software vulnerabilities, access payment systems and transfer money at machine speed.
Investigators have also identified cases involving multi-crore unauthorised transactions through automated fund-disbursement systems and payment application programming interfaces (APIs).
The warning comes amid growing cybersecurity concerns in India’s financial sector, where banks and digital financial platforms increasingly depend on interconnected technology systems.
AI Cyberattacks on Indian Banks: What I4C and CERT-In Found
According to the cybersecurity advisory, criminals are using artificial intelligence agents to identify weaknesses in financial institutions’ IT infrastructure and automate different stages of cyberattacks.
The attackers initially exploit unpatched software, incorrectly configured servers and internet-facing systems to gain unauthorised access.
Customer-facing applications and complaint-handling interfaces can also become potential entry points.
Once inside an organisation’s infrastructure, hackers target automated fund-disbursement systems and APIs used to process payments and transfer money.
The agencies have reported cases involving multi-crore unauthorised transactions.
The use of agentic AI frameworks allows attackers to execute several operations rapidly, reducing the time available for financial institutions to detect suspicious activity.
How Hackers Use AI to Steal Money Through Banking Systems
The attacks generally involve several stages, beginning with identifying vulnerable systems and gaining access to financial infrastructure.
After compromising payment interfaces, attackers attempt to initiate unauthorised transactions through automated fund-disbursement systems and payment APIs.
The money is then transferred into mule accounts maintained across different banks. Mule accounts are bank accounts used by criminals to receive and move illegally obtained funds.
The stolen money may subsequently be transferred or withdrawn through banking channels such as Immediate Payment Service (IMPS) and National Electronic Funds Transfer (NEFT).
Another concern is that attackers attempt to delete transaction records and other digital evidence to make investigations more difficult.
The agencies have warned that the combination of automated attacks, rapid money transfers and attempts to destroy evidence creates additional challenges for financial institutions and investigators.
CERT-In Identifies AI Tools Used in Cyberattacks
The November 4 advisory issued by CERT-In identified an ongoing threat campaign involving an AI-assisted threat actor named “CRAFTY FALCON”.
The agency reported the use of several publicly available AI-powered security tools, including ARTEX, PentAGI, Cairn and CyberStrikeAI.
These tools can automatically identify vulnerabilities, generate customised attack scripts and modify their techniques based on how targeted systems respond.
According to CERT-In, the tools can execute multiple stages of an attack with limited human involvement and at machine speed.
The agency also found that some financial institutions were targeted again even after taking corrective action following earlier warnings.
Incomplete security fixes and insufficient monitoring reportedly allowed attackers to exploit weaknesses repeatedly.
Banks and Fintech Companies Asked to Strengthen Security
I4C and CERT-In have urged financial institutions to strengthen their cybersecurity arrangements and implement the security measures outlined in earlier advisories.
Banks, NBFCs and fintech companies have been advised to maintain updated software, secure internet-facing systems and regularly review vulnerabilities in their IT infrastructure.
Financial institutions have also been asked to maintain a comprehensive inventory of payment-related APIs and disable outdated, unused or testing interfaces that could provide entry points for attackers.
Another important recommendation involves closer coordination between chief information security officers, transaction monitoring teams and IT departments.
CERT-In has also recommended stronger access controls, continuous monitoring of cloud infrastructure and better separation between testing environments and live production systems.
Financial institutions should also monitor unusual transaction patterns and preserve relevant digital evidence if suspicious activity is detected.
Six-Hour Deadline for Reporting Cyberattacks
The cybersecurity warning also highlights the importance of reporting incidents quickly.
Financial institutions are required to report cybersecurity incidents to CERT-In within six hours of detecting them.
Banks and NBFCs must also report relevant incidents to the Reserve Bank of India through its DAKSH portal within the same timeframe.
Additionally, NBFCs and fintech companies have been advised to coordinate with I4C for reporting bulk fraudulent transactions through the Cyber Fraud Mitigation Centre.
These reporting requirements are intended to help authorities respond quickly, investigate suspicious transactions and take steps to prevent further financial losses.
What Does the Warning Mean for Bank Customers?
The latest warning highlights the growing risks associated with India’s expanding digital financial infrastructure.
As banks, lending platforms and payment companies increasingly depend on automated systems, weaknesses in connected services can create opportunities for cybercriminals.
The reported attacks primarily target financial institutions and their payment infrastructure. The advisory does not mean that every bank account or mobile banking customer has been compromised.
However, customers should remain cautious about unexpected banking messages, suspicious payment requests and unknown links. They should never share their OTP, PIN, password or banking credentials with anyone.
The latest AI Cyberattacks on Indian Banks warning also underlines the importance of stronger security arrangements across the financial sector.
With cybercriminals increasingly using automated AI tools, financial institutions will need to improve their monitoring systems, close software vulnerabilities and respond quickly to suspicious transactions to protect digital banking infrastructure.
Reuters+2
