India’s cybersecurity agencies have warned banks, NBFCs and fintech companies about AI-driven cyberattacks that have caused unauthorised fund transfers worth crores.
In advisories issued on November 3 and 4, Cert-In and the Indian Cyber Crime Coordination Centre (I4C) said hackers were exploiting vulnerable systems, payment platforms and APIs using AI-powered tools to transfer funds illegally.
The stolen money is routed through mule accounts across banks and quickly withdrawn or transferred using IMPS and NEFT. Attackers also delete records to hinder investigations.
Cert-In identified the threat actor as “CRAFTY FALCON” and warned that AI tools were enabling attackers to automate attacks, adapt their methods and operate with limited human involvement.
The agencies urged financial institutions to strengthen payment security, monitor transactions round the clock, secure cloud systems and separate testing environments from production systems.
Institutions have been asked to report cyber incidents to Cert-In and the RBI within six hours of detection. NBFCs and fintech firms have also been advised to report fraudulent transactions to I4C for swift fund-freezing action.
