MHA Warns Banks About AI Cyberattacks – How the Threat Works and How to Stay Safe

Banks, NBFCs and fintech companies in India have been warned about a rise in AI-powered cyberattacks aimed at stealing money through payment and fund-disbursement systems.

The advisory comes from the Indian Cyber Crime Coordination Centre, or I4C, which works under the Ministry of Home Affairs, along with CERT-In. The warning is mainly for financial institutions, but it also matters to customers because a successful attack on a bank or payment platform can put accounts, transactions and personal data at risk.

The concern is not just fake AI images or chatbot scams. Authorities have flagged attacks where criminals use AI tools to scan systems, identify weaknesses, generate attack scripts and attempt unauthorized fund transfers at very high speed.

What the AI-powered bank attack involves

CERT-In has identified an active financial threat campaign called CRAFTY FALCON. According to the advisory, attackers are using AI-assisted tools to target banks, NBFCs, digital lending companies, payment aggregators, payment-service providers and cryptocurrency exchanges.

The attackers look for familiar security gaps, such as unpatched software, poorly configured cloud systems, exposed credentials and weak payment APIs. An API is the digital connection that allows different software systems to exchange information or process actions, such as checking an account or making a payment.

Once inside, attackers may try to access automated payment or loan-disbursal systems. They can test small transactions first and then attempt larger transfers if they find a weakness. Stolen money may be sent to mule accounts and quickly moved through banking channels to make recovery harder.

AI makes these attacks more dangerous because it can speed up repetitive tasks. Instead of manually checking one system at a time, criminals can use AI tools to scan, adapt and launch multiple attempts quickly.

Why banks and fintech firms are at risk

As per HT report, financial institutions increasingly rely on connected systems for payments, customer verification, lending, cards and digital banking. This improves convenience, but every connected service can create another point that needs protection.

For example, a lending platform may use an API to automatically release an approved loan amount. If an attacker gains access to that API or tricks the system into accepting a false request, money could be sent out without proper approval.

CERT-In has also warned that attacks may be timed for weekends, holidays or other periods when security teams have fewer people monitoring alerts. Some affected organizations were reportedly targeted again after incomplete corrective action.

What banks and fintechs should do

The advisory calls for continuous security monitoring, stronger cloud controls and regular security checks. Financial institutions should separate testing systems from live production systems so that a weakness in a test environment cannot easily lead to a live financial breach.

They should also review payment APIs, remove unused access, protect credentials, apply software updates promptly and use multi-factor authentication for sensitive accounts.

Transaction controls are equally important. Banks can set daily and per-transaction limits, verify beneficiary details, monitor unusual payment patterns and ensure that high-value transfers require the right approvals.

When a serious incident is detected, financial institutions have been asked to report it to CERT-In within six hours. Banks and NBFCs must also report incidents to the Reserve Bank of India through the DAKSH portal within the same time frame.

What customers can do to protect themselves

Customers cannot control a bank’s internal security, but they can reduce the risk of account-level fraud.

Never share OTPs, UPI PINs, card CVV details, passwords or remote-access codes with anyone. A bank employee will not ask for a UPI PIN to reverse a payment or receive money.

Be cautious if you receive a call, video or voice note that appears to come from a bank official, friend or relative. AI can create convincing fake voices and videos. Instead of trusting the incoming call, use the official number on the bank’s website or app to verify the request.

Turn on transaction alerts, review your account activity regularly and act immediately if you notice an unknown debit. Contact your bank through an official channel, call the national cybercrime helpline at 1930 and file a complaint at Cybercrime-portal.