Nearly Rs 7.80 crore was transferred out of a bank account belonging to microfinance lender Spandana Sphoorty Financial on November 1. The transactions were unauthorised, and the money had gone to 82 beneficiary accounts. The company stopped the affected services and asked its bank to reverse the transfers and freeze the recipient accounts.
The incident was the latest in a series of cyber frauds involving lending companies. In the wake of these attacks, the Ministry of Home Affairs (MHA) issued an advisory warning banks, non-banking financial companies (NBFCs), and fintech firms about a growing threat from artificial intelligence (AI)-assisted cyberattacks.
In an advisory on November 3, the National Cybercrime Threat Analysis Unit (NCTAU) of the Indian Cybercrime Coordination Centre (I4C), under the MHA, flagged a trend of financially motivated cyberattacks on financial institutions. It warned that criminals were using AI agents to compromise systems at what it described as "machine speed", with some attacks involving unauthorised fund transfers worth several crores of rupees.
The warning follows a string of incidents that have exposed weaknesses in the technology connecting banks, NBFCs and payment service providers.
In October, two Mumbai-based NBFCs reportedly lost around $2 million through more than 700 unauthorised transfers from accounts held with ICICI Bank. The transactions took place on October 8 and 9 after hackers allegedly compromised an application programming interface (API) used by the companies to send loan-disbursal instructions to the bank, according to a police complaint cited in reports of the incident.
APIs are software connections that allow banks and lending companies to exchange information and process transactions. A breach involving these connections can allow criminals to initiate fraudulent transfers through systems ordinarily used for legitimate payments.
How the hackers operate
The MHA advisory explains that attackers exploit outdated software and poorly configured internet-facing servers to gain access to financial institutions' networks. Customer complaint portals and other connected services can also provide an entry point.
Once inside, hackers target automated fund-disbursal systems and APIs used for payments and money transfers. AI-assisted tools can help them identify weaknesses and carry out operations rapidly, leaving financial institutions with less time to detect suspicious activity.
The stolen money is then routed through mule accounts across different banks before being quickly transferred or withdrawn using payment systems such as IMPS and NEFT. Attackers may also delete records and conceal their activities to make investigations more difficult, the advisory said.
The Indian Computer Emergency Response Team (CERT-In) had issued two critical advisories in October highlighting the risks to financial institutions.
The first, issued on October 9, warned that cybercriminals were exploiting vulnerabilities in payment and loan-disbursal APIs to carry out unauthorised fund transfers. The second, issued on October 15, focused on the use of AI agents as attack vectors.
The MHA advisory specifically refers to both warnings, asking financial institutions to take the recommended precautions.
What banks need to do now
The MHA has asked banks, NBFCs, fintech companies, payment aggregators and payment gateways to implement the cybersecurity measures recommended in the two CERT-In advisories.
Among the measures are maintaining an updated list of APIs used for payments, disabling outdated or unused interfaces, and introducing stronger checks before money is transferred.
Financial institutions have also been advised to set daily and per-transaction limits, verify beneficiary names and account details, and monitor unusually rapid or frequent transactions that could indicate automated fraud.
The advisory calls for closer coordination between information security, IT and transaction monitoring teams. It also recommends keeping a watch on sudden changes in transaction patterns, beneficiary profiles and transaction volumes.
Banks and lending companies have been asked to ensure that funds cannot be transferred unless mandatory checks, including know-your-customer (KYC) verification and necessary approvals, have been completed.
The government has also recommended simulated cyberattack exercises to assess how quickly security teams and payment systems can respond to attacks carried out at high speed.
The advisory also stresses the need for prompt reporting of cyber incidents. Financial institutions must report cybersecurity incidents covered by CERT-In's reporting requirements within six hours of noticing them. Banks and NBFCs must also report incidents to the Reserve Bank of India (RBI) through its DAKSH portal within six hours of detection.
NBFCs and fintech firms may contact I4C for bulk reporting of fraudulent transactions through the National Cybercrime Reporting Portal's Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS), so that steps can be taken to freeze the stolen funds.
The warning comes amid increased scrutiny of banks' cybersecurity preparedness by the RBI. The central bank has reportedly asked lenders to examine vulnerabilities in their APIs, demonstrate compliance with existing cybersecurity requirements and assess their readiness to deal with AI-related threats.
In a separate advisory issued on November 4, CERT-In identified an AI-assisted threat actor named CRAFTY FALCON and warned that a campaign targeting financial institutions remained active.
The agency said attackers were using AI-driven tools to scan for vulnerabilities, generate customised attack scripts and adapt their methods to overcome security measures.
It also warned that some institutions had been targeted again despite taking corrective measures following earlier attacks. Several attacks were timed around weekends and holidays, when security monitoring may be less intensive.
CERT-In said attackers had also carried out small test transactions, sometimes involving just Re 1, to check whether unauthorised transfers could be made before attempting larger transactions.
The recent incidents have put the security of automated payment and loan-disbursal systems under scrutiny, particularly as banks and lending companies increasingly rely on interconnected digital platforms to process transactions.
