Millions Stolen from Banks via AI; Government Now Monitoring Your Funds!

The I4C has issued an alert to banks and fintech companies regarding banking fraud perpetrated using AI agents. In the event of any suspicious cyber incident, it must be reported to CERT-In and the RBI within six hours.

While digital banking has made financial transactions significantly easier, the methods used for online fraud are evolving alongside the increasing adoption of technology. Cybercriminals are now leveraging Artificial Intelligence (AI) to target the systems of financial institutions. In light of this threat, the nation’s cybersecurity agencies have advised banks and fintech companies to remain vigilant.

Cybercriminals typically gain access to systems by exploiting outdated software or internet servers with weak security. Furthermore, online services for customers and platforms used for lodging complaints can also become targets.

Criminals Target APIs

Once they gain access to a system, criminals target the APIs (Application Programming Interfaces) responsible for automated payments and fund transfers. The stolen funds are then routed into "mule accounts" held at various banks—accounts specifically used to receive and subsequently move illicit funds.

The money is rapidly transferred to other accounts or withdrawn using systems like IMPS and NEFT. Moreover, criminals attempt to erase digital records of these transactions, which complicates investigations.

Fraud Worth Millions Facilitated by AI Agents

The Indian Cyber ​​Crime Coordination Centre (I4C) has issued an alert to banks, Non-Banking Financial Companies (NBFCs), and fintech institutions regarding AI-driven cyberattacks. The National Cybercrime Threat Analysis Unit (NCTAU)—a division operating under the Ministry of Home Affairs—stated in a report that cybercriminals are utilizing AI agents to breach the systems of financial institutions. According to the agency, unauthorized transactions amounting to crores of rupees have been detected in some instances, involving fund transfer systems and Application Programming Interfaces (APIs). With the aid of AI technology, criminals can execute numerous financial activities in a very short span of time.

What security measures should be taken?

Agencies have advised maintaining an inventory of all payment APIs and decommissioning any legacy or unused interfaces. Furthermore, there is an emphasis on strengthening banking security, enhancing transaction monitoring, and fostering better coordination among IT teams.

Data from the Ministry of Home Affairs indicates that over 5.387 million (53.87 lakh) complaints of cyber fraud were registered in the country between 2023-24 and 2025-26. The total value involved in these reported cases exceeded ₹56,087 crore.

Banks must report incidents within six hours.

The I4C and the Indian Computer Emergency Response Team (CERT-In) have directed financial institutions to bolster their security frameworks. Institutions are required to report any suspicious cyber incidents to CERT-In within six hours of their detection. Banks and Non-Banking Financial Companies (NBFCs) must also submit reports via the RBI’s DAKSH portal within this same timeframe.