Cert-In warns banks, fintech firms of AI-driven fund transfer fraud

The Indian Cyber Crime Coordination Centre (I4C) and CERT-In have issued an advisory warning banks, non-banking financial companies (NBFCs), and fintech firms about the rising threat of AI-driven cyberattacks. According to the advisory, these attacks are financially motivated and are being carried out using artificial intelligence agents, resulting in machine speed compromise.

Unauthorized transactions worth multi-crores are being detected through fund disbursement systems and APIs. Perpetrators exploit unpatched software or misconfigured internet-exposed servers/IT systems to compromise infrastructure. The attackers then gain access to automated fund disbursement systems or payment and fund transfer interfaces.

The money is transferred to mule accounts across multiple banks for easy withdrawal. The advisory recommends financial institutions take security measures such as removing unused interfaces, setting transaction limits, verifying beneficiary details, enhancing customer-facing infrastructure, and conducting red-team exercises to simulate machine-speed attacks.