I4C Warns Banks, NBFCs of AI-Agent Fraud; Six-Hour Reporting Rule

The Indian Cyber Crime Coordination Centre (I4C) has warned banks, non-banking finance companies (NBFCs) and fintech firms that criminals are using AI agents to break into payment systems and move money out at machine speed. The advisory, issued on 3 November and reported on 4 and 5 November, says I4C has found several cases in which such systems made unauthorised transactions worth crores of rupees. It did not name the institutions affected.

Entry Points Banks Are Told to Close

According to the advisory, attackers get in through unpatched software, misconfigured internet-facing servers and customer complaint interfaces. They then go after automated fund-disbursement systems and payment and transfer APIs. Money is routed through mule accounts at several banks, withdrawn through IMPS and NEFT, and records are deleted to slow down investigators.

I4C, working through its National Cybercrime Threat Analysis Unit, has asked institutions to test their payment APIs, set transaction limits, verify beneficiary details, complete KYC and approval checks before funds move, and watch for sudden jumps in transaction speed or volume. It has also asked them to run authorised red-team exercises to see how quickly their controls react.

Also read Digital Arrest Fraud: Supreme Court Mulls Making Banks Pay Victims

Customers May See Tighter Limits

The advisory does not announce any rule for account holders. But limits on single and daily transfers, and extra beneficiary checks, are among the controls it recommends, so customers of smaller lenders and fintech apps could see stricter checks on large transfers.

Six Hours to Report an Incident

The advisory repeats that cyber incidents must be reported to CERT-In within six hours, and that banks and NBFCs must also inform the Reserve Bank of India. It asks institutions to apply CERT-In’s earlier critical advisories on payment and disbursement APIs and AI agents “urgently”. CERT-In issued one such advisory last month, on attackers using publicly available agentic AI tools for financially motivated intrusions.

The advisory sets no deadline beyond the six-hour reporting window, and I4C has not said how many institutions have been hit. Related: Digital arrest fraud: 21,900 complaints, Rs 647 crore in 2026, and more in Daily Updates.

Source: Based on reporting by Inc42 and Elets BFSI.

Image: Elets BFSI (concept image).