Back to News India’s digital financial ecosystem—among the world’s largest real-time payment networks—is facing accelerated cyber risks from AI-assisted attacks on payment and payout APIs. In response, the Indian Cybercrime Coordination Centre (I4C), in collaboration with the Reserve Bank of India (RBI) and FinTech Self-Regulatory Organisation (FACE), organised a dedicated session for leading banks and fintech companies. More than 400 participants discussed emerging threats, including machine-speed frauds en
India’s rapidly expanding digital financial ecosystem, one of the world’s largest and most dynamic, powered by real-time payment platforms that process billions of transactions, faces a new wave of sophisticated cyber risks. In response, the Indian Cybercrime Coordination Centre (I4C), under the Ministry of Home Affairs, recently collaborated with the Reserve Bank of India (RBI) and the FinTech Self-Regulatory Organisation (FACE) to organise a dedicated session for leading banks and fintech companies. More than 400 participants joined the discussion, which focused on emerging cyber threats, risks linked to payout and disbursement APIs, and practical measures to prevent attacks, including those involving artificial intelligence.
I4C serves as India’s central nodal agency for coordinating the fight against cybercrime. Established through a government scheme in 2018 and operational since 2020 (later upgraded as an attached office of the Ministry of Home Affairs), it works to improve coordination among law enforcement agencies, analyse threat patterns, support citizen reporting via the National Cybercrime Reporting Portal, and strengthen overall national capacity. The recent session aligns with I4C’s broader mandate and comes against the backdrop of formal advisories issued in early November 2026.
In early November 2026, the Indian Cybercrime Coordination Centre (I4C) issued a formal advisory warning banks, non-banking financial companies (NBFCs), and fintech firms of a rising trend of AI-assisted cyberattacks targeting payment and fund-disbursement systems. Prepared by I4C’s National Cybercrime Threat Analysis Unit in coordination with CERT-In, the advisory highlighted financially motivated attacks in which criminals exploit vulnerabilities in APIs and related infrastructure, then use AI agents to execute unauthorised transactions at machine speed. In individual cases, these incidents have involved multi-crore fund transfers routed through mule accounts across multiple banks and quickly moved via channels such as IMPS and NEFT. I4C urged institutions to maintain complete inventories of payment-related APIs, disable obsolete or unused interfaces, strengthen real-time transaction monitoring and beneficiary verification, set appropriate limits, and report incidents to CERT-In (and to the RBI’s DAKSH portal for banks and NBFCs) within six hours of detection. The advisory underscores the need for tighter coordination between cybersecurity, IT, and transaction-monitoring teams as AI-driven threats accelerate the pace and scale of financial fraud.
Financially motivated Hacking - Convergence of Fraud & Hacking
Cybercriminals are reportedly exploiting vulnerabilities in payment and fund-disbursement APIs, interfaces that allow systems to transfer money, and using AI agents (sometimes described as agentic AI frameworks) to accelerate the process. In documented cases, this has enabled unauthorised multi-crore transactions at machine speed, with funds routed through “mule” accounts across banks before being moved or withdrawn via channels such as IMPS and NEFT. Attackers may also attempt to erase digital evidence. Parallel RBI guidance has reinforced the need for stronger API controls, beneficiary verification, transaction limits, and monitoring, along with mandatory incident reporting to CERT-In and the RBI within six hours of detection.
The collaborative session brought banks, fintech firms, regulators, and industry representatives together to discuss these risks and prevention strategies in a practical setting. Topics included securing digital financial services against AI-based fraud, hardening payment APIs, improving inventory and lifecycle management of interfaces, enhancing real-time monitoring of unusual transaction patterns or speeds, and strengthening coordination between cybersecurity, IT, and transaction-monitoring teams. Such multi-stakeholder engagement is significant because India’s digital payments infrastructure has scaled rapidly, creating both enormous economic opportunity and a large attack surface that attracts global criminal networks.
For a global audience, India’s experience offers relevant lessons. Many countries are expanding real-time payments, open banking, and fintech ecosystems. The same technologies that enable seamless customer experiences, APIs, automated disbursement systems, and increasing use of AI, can be abused when security lags behind innovation. AI lowers the skill and time barriers for attackers, turning what were once slower, manual operations into high-volume, high-speed campaigns. India’s response illustrates the value of combining regulatory pressure (from the central bank), industry self-regulation (via SROs), specialised cybercrime coordination (I4C), and technical guidance (CERT-In). Recommended practices such as maintaining complete API inventories, disabling obsolete or test interfaces, setting velocity and volume controls, verifying beneficiaries, and enforcing tight incident-reporting timelines are transferable. At the same time, the scale of India’s digital economy means that successful defensive measures can influence global standards and vendor practices. As AI capabilities continue to advance, financial institutions worldwide will need layered controls that go beyond traditional perimeter security: continuous monitoring of payment flows, robust identity and beneficiary checks, rapid detection and response, and clear accountability between banks, fintech partners, and technology providers.
The recent I4C-RBI-FACE session is a concrete step in that direction. By convening hundreds of participants from the core of India’s financial sector to address AI-driven threats and payout API risks, it signals both recognition of the problem and a commitment to coordinated action. Sustained vigilance, timely information sharing, and ongoing investment in people, processes, and technology will be essential if digital finance is to remain both inclusive and resilient, in India and beyond.