AI agents target payment interfaces; India demands transfer limits
On 3 November India's cybercrime threat analysis unit warned banks, non-bank lenders and fintechs of AI-assisted attacks on automated payout systems; individual losses run to several crore rupees.
A government body describes criminals using AI agents to attack payment and payout interfaces at machine speed. The remedies it demands are conventional: limits, checks before every payout and reporting within six hours.
What happened
The warning comes from the National Cybercrime Threat Analysis Unit, part of the Indian Cybercrime Coordination Centre (I4C) under the home ministry, together with CERT-In, the national emergency response team. It is addressed to banks, non-bank lenders, fintechs and payment aggregators and was made public on 4 November. According to Reuters it says the attacks are financially motivated and carried out with the help of AI agents, leading to machine-speed compromise. Entry points are unpatched software, misconfigured internet-facing servers and customer complaint interfaces. The targets are automated disbursement systems and interfaces for payments and transfers. Money is moved through mule accounts at several banks and via the IMPS and NEFT payment systems, after which the attackers delete their traces. Several individual cases each reached several crore rupees; one crore is 10m rupees. It remains unclear which AI tools were used and which institutions were hit; the agency gives no total loss.
What follows
The weakness lies less in the AI than in the architecture: where payouts run through interfaces without human approval, an agent cuts the time between intrusion and outflow to minutes. That matters in Europe too, where banks have had to send instant euro transfers since October 2025. The faster money moves, the more depends on safeguards before the payout: daily and per-transaction limits, payee verification and alerts on sudden changes. For fintechs and lending platforms with automated payouts, the cost of security and audits rises. Assessment: the sources do not show whether similar attacks are already occurring in the EU.
What changes in practice
- Banks and fintechs
- India demands daily and per-transaction limits, KYC checks before every payout and incident reports within six hours.
- Payment providers
- Payout and transfer interfaces are the stated target. They are to be tested specifically and probed in red-team exercises.
- IT security
- Entry via unpatched software and misconfigured servers: basic hygiene remains the first line of defence.
- Customers
- Stolen money quickly reaches mule accounts. The shorter the reporting chain, the better the chance of stopping transfers.
What to watch
- Whether CERT-In or the Reserve Bank of India publishes case numbers, losses or affected institutions
- Similar warnings from Germany's BSI, BaFin or the European Banking Authority
- Fraud figures for instant payments in the EU
Sources
- Inc42: I4C Warns Banks & Fintechs Against Agentic AI Cyberattacks
- Elets BFSI: I4C AI Cyberattacks Warning for Fintechs
- Reuters: India's cybercrime agency warns financial firms of AI attacks