24
India’s cybercrime authorities have warned banks, non-banking financial companies and fintech firms that criminals are increasingly using artificial intelligence to speed up cyberattacks and carry out unauthorised financial transactions.
In an advisory issued on November 3, the National Cybercrime Threat Analysis Unit (NCTAU) of the Indian Cyber Crime Coordination Centre, or I4C, along with CERT-In, warned about attacks targeting financial institutions.
The agencies said criminals are exploiting unpatched software and misconfigured internet-facing servers to gain access to financial systems. Customer-facing platforms and complaint-handling interfaces can also become entry points.
Once inside, attackers may target automated fund-disbursement systems and APIs used for payments and fund transfers.
The stolen money can then be moved through mule accounts and transferred or withdrawn using channels such as IMPS and NEFT. Attackers may also delete transaction records and other digital evidence to make investigations more difficult.
The authorities warned that AI agents could make these attacks faster and more difficult to detect.
In a separate advisory issued on November 4, CERT-In flagged an escalating campaign called CRAFTY FALCON, which uses AI-driven tools to automate attacks against financial organisations.
I4C and CERT-In have advised financial institutions to keep software updated, maintain an inventory of payment APIs and disable obsolete, unused or testing interfaces.
They have also recommended setting transaction limits, verifying beneficiary names, monitoring unusual payment activity and improving coordination between cybersecurity, IT and monitoring teams.
The November 3 advisory also requires financial institutions to report cyber incidents to CERT-In within six hours of detection. Banks and NBFCs must additionally report incidents to the Reserve Bank of India through its DAKSH portal within the same timeframe.
The warnings highlight how AI is increasing the speed and scale of financial cybercrime, making continuous monitoring and faster incident response increasingly important.
In an advisory issued on November 3, the National Cybercrime Threat Analysis Unit (NCTAU) of the Indian Cyber Crime Coordination Centre, or I4C, along with CERT-In, warned about attacks targeting financial institutions.
The agencies said criminals are exploiting unpatched software and misconfigured internet-facing servers to gain access to financial systems. Customer-facing platforms and complaint-handling interfaces can also become entry points.
Once inside, attackers may target automated fund-disbursement systems and APIs used for payments and fund transfers.
The stolen money can then be moved through mule accounts and transferred or withdrawn using channels such as IMPS and NEFT. Attackers may also delete transaction records and other digital evidence to make investigations more difficult.
The authorities warned that AI agents could make these attacks faster and more difficult to detect.
In a separate advisory issued on November 4, CERT-In flagged an escalating campaign called CRAFTY FALCON, which uses AI-driven tools to automate attacks against financial organisations.
I4C and CERT-In have advised financial institutions to keep software updated, maintain an inventory of payment APIs and disable obsolete, unused or testing interfaces.
They have also recommended setting transaction limits, verifying beneficiary names, monitoring unusual payment activity and improving coordination between cybersecurity, IT and monitoring teams.
The November 3 advisory also requires financial institutions to report cyber incidents to CERT-In within six hours of detection. Banks and NBFCs must additionally report incidents to the Reserve Bank of India through its DAKSH portal within the same timeframe.
The warnings highlight how AI is increasing the speed and scale of financial cybercrime, making continuous monitoring and faster incident response increasingly important.
