MediumII Cyber Warfare & Critical Infrastructure4 November 2026, Wednesday

India's cybercrime centre warns banks of AI-agent attacks

India's Cyber Crime Coordination Centre (I4C) issued a warning on 4 November to banks, non-bank finance companies and fintechs about attacks carried out with AI agents. Attackers have made unauthorised transfers worth several crore rupees (1 crore = 10 million) through payment and loan-disbursement APIs.

Location: NEW DELHI

According to India TV, the warning was issued jointly by I4C's threat analytics unit and CERT-In. The attack runs in 6 steps. In the first 3, the attacker breaches an unpatched server, gains access to the customer interface and uses agentic AI to target payment APIs. In the last 3, money is moved to mule accounts, withdrawn via IMPS or NEFT and the traces are wiped. An API is the interface that lets 2 systems send each other payment instructions automatically.

CERT-In had issued 2 critical advisories on this campaign: CIAD-2026-0046 of 9 October covers the exploitation of payment APIs, and CIAD-2026-0049 of 15 October treats AI agents as an attack vector. Institutions must report an incident to both CERT-In and the Reserve Bank of India's DAKSH portal within 6 hours of detecting it.

According to Reuters, the RBI asked banks a few days before 4 November for proof of compliance with existing rules and details of their preparedness for AI risk. At State Bank of India, the country's largest lender, data on 3,900 customers was leaked. I4C recommends daily and per-transaction limits, payee-name verification and monitoring for transactions at unusual speed; the warning contains not a single figure on insurance cover.

Talay assessment

Bottom line

In India's financial sector, attackers now move faster than defenders: agentic AI cuts the path from a single unpatched server to money in mule accounts down to minutes. The 6-hour reporting rule and the RBI's demand for proof of compliance will bring forward security spending at smaller finance firms. Cyber cover terms are likely to tighten for institutions that cannot meet the controls, but the sources give no figures to show this.

Likely effects

NBFC and fintech costsNegative1–6 months
Once API inventories, transaction limits and red-team exercises become mandatory, compliance costs rise for smaller lenders.
Payment experienceUncertainWeeks
Payee-name verification and per-transaction limits could add delay and friction to instant payments and loan disbursement.
Cyber insuranceNegative1–6 months
Claims from institutions that fail to apply the controls named in the advisories will be weaker; insurers may lean on unpatched-system exclusions.

Possibilities, ranked

1
RBI makes the controls binding50%
The RBI turns its compliance-evidence process into a circular with transaction-limit and API-audit requirements.
Watch: RBI cybersecurity circulars in November–December
2
A new major loss is disclosed35%
An NBFC or fintech reports a loss on the scale of a billion rupees from an agentic attack.
Watch: Cyber incident disclosures by listed financial companies
3
The advisory regime suffices15%
The wave of attacks slows and institutions apply the controls themselves without new regulation.
Watch: Monthly incident statistics from I4C and CERT-In

Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.

Market reaction

Indicators affected

Reporting deadline▲ 6 hours
CERT-In critical advisories▼ 2
SBI customer records leaked▼ 3,900

Bottom line

Likely effects

Possibilities, ranked

Sources