CERT-In and I4C Flag AI-Driven Payment API Attacks on Financial Firms: Bank Monitoring Priorities

What the agencies reported

The Indian Cyber Crime Coordination Centre (I4C) and the Indian Computer Emergency Response Team (CERT-In) issued warnings on 3 and 4 November 2026 about attempts to exploit internet-facing systems and payment-processing interfaces at financial institutions. The first advisory, as reported by Hindustan Times and PTI, describes attacks against vulnerable servers and fund-disbursement interfaces. The subsequent CERT-In/CSIRT-Fin alert describes an escalating campaign designated CRAFTY FALCON.

The affected sector described in the reporting includes non-banking financial companies, fintech platforms, digital lenders, payment intermediaries and other financial entities. Banks were among the institutions being warned, but the public reporting does not establish that every bank suffered an intrusion. This distinction matters when responding to a threat alert without exaggerating its incidence.

How the payment risk develops

The reports describe attackers exploiting exposed or poorly configured systems to access application programming interfaces, or APIs, used to instruct payments and loan disbursements. Once access is misused, funds may be routed to mule accounts and rapidly moved using payment channels, including Immediate Payment Service (IMPS) and National Electronic Funds Transfer (NEFT). The attacker’s subsequent attempts to erase activity records can complicate reconciliation and investigation.

CERT-In’s reported analysis says publicly available artificial-intelligence tools help the attackers discover weaknesses and change attack sequences quickly. Describing an attack as AI-assisted does not mean that AI independently authorised a legitimate banking transaction, nor does it prove a state-sponsored attack. The agency has not publicly identified every affected entity or a definitive total loss attributable to this named campaign.

Operational priorities for bank teams

• Payments and technology: keep an accurate inventory of production, test and legacy APIs. Disable interfaces no longer in authorised use and isolate test access from live disbursement paths.
• Information security: review access logs, credentials, privileged permissions and suspicious traffic to internet-facing infrastructure. Coordinate with third-party service providers where API connections cross institutional boundaries.
• Fraud monitoring: flag unusual transaction velocity, repeated beneficiary changes, new mule-account patterns and payments inconsistent with approved lending or settlement workflows.
• Branch and operations staff: escalate unexplained debit, settlement or customer-complaint patterns promptly under the bank’s incident procedure rather than relying only on end-of-day reconciliation.
• Holiday coverage: ensure monitoring and escalation remain active during weekends, festivals and other periods when fewer personnel may be on duty.

These are operational implications drawn from the reported advisories, not a new instruction that every branch must independently run a cyber-security operations centre. Bank staff should follow their institution’s approved escalation matrix and regulator-specific requirements.

Incident reporting and what remains unverified

The inspected reports say institutions were reminded of CERT-In’s six-hour cyber incident reporting requirement and of RBI reporting through the DAKSH portal for applicable bank and non-bank financial-company incidents. The relevant starting point, incident classification and reporting route must be checked against each institution’s current binding requirements. An advisory should not be mistaken for an FIR, confirmed bank loss or completed enforcement action.

The public articles were inspected directly; the complete restricted original November advisories were not available for independent clause-by-clause inspection. Consequently, this report attributes technical detail and deadlines to named publishers rather than claiming to reproduce an unseen source notice.

Sources and References

1. Hindustan Times — Cert-In, I4C warn financial firms of AI-driven cyberattacks, unauthorised fund transfers
2. The Week / PTI — AI-based cyber threat executing unauthorised fund transfers from banking firms: Cert-In
3. Reuters — India cybercrime agency warns financial firms of AI-driven cyberattacks