How Cybercriminals Exploit Banking APIs to Transfer Stolen Funds

Indian Cyber Crime Coordination Centre warns of AI-driven cyberattacks exploiting banking APIs for unauthorized transactions.

AI-Powered Threats and Unauthorized Transactions

The Indian Cyber Crime Coordination Centre (I4C) has issued a critical alert to financial institutions, including banks, non-banking financial companies (NBFCs), and fintech firms, regarding the escalating use of artificial intelligence (AI) in cyberattacks designed to execute unauthorized financial transactions at unprecedented speeds. The advisory, developed in collaboration with the Indian Computer Emergency Response Team (CERT-In), highlights the growing threat of autonomous AI agents compromising financial systems to siphon funds.

Exploiting Vulnerabilities in Financial Infrastructure

The advisory underscores that financially motivated threat actors are leveraging AI-powered tools to exploit vulnerabilities in financial infrastructure. Specific cases have involved unauthorized transactions totaling multiple crores of rupees through payment and fund-disbursement interfaces. These attacks operate at machine speed, drastically reducing the window for banks to detect and respond to suspicious activity.

Attack Methods and Fund Siphoning

Attackers typically gain initial access by exploiting unpatched software, misconfigured internet-facing servers, and poorly secured IT infrastructure. Customer-facing applications and complaint-handling platforms are also identified as potential entry points. Once inside, cybercriminals target automated fund-disbursement systems and application programming interfaces (APIs) responsible for processing payments.

AI-Driven Fraudulent Transactions

AI-driven frameworks enable these actors to execute fraudulent transactions faster than conventional security monitoring systems can detect. Stolen funds are allegedly transferred through a network of mule bank accounts spread across multiple financial institutions. These accounts serve as intermediaries to receive and redistribute illicitly obtained money.

Mitigation Strategies and Compliance Requirements

The advisory further recommends reinforcing security controls across customer-facing platforms and complaint-handling systems. Financial institutions must conduct secure architecture reviews and ensure mandatory checks, such as Know Your Customer (KYC) verification and approval workflows, are completed before fund releases.

Implementing CERT-In Advisories

To mitigate risks, I4C has mandated that financial institutions implement safeguards outlined in two CERT-In advisories, CIAD-2026-0046 and CIAD-2026-0049. These guidelines address unauthorized fund transfers via payment APIs and the misuse of AI agents. Institutions are required to maintain comprehensive inventories of payment APIs, disable obsolete or unused interfaces, and enforce daily transaction limits.

Strengthening Security Controls

Strengthening beneficiary verification processes, monitoring unusual transaction speeds, and detecting sudden changes in payment patterns are also emphasized. Coordination between cybersecurity, transaction-monitoring, and IT teams is critical to identifying and responding to emerging threats.

Reporting and Incident Response

Financial institutions are required to report cybersecurity incidents to CERT-In within six hours of detection. Banks and NBFCs must also submit reports to the Reserve Bank of India through the DAKSH portal within the same timeframe. For large-scale fraud, NBFCs and fintech companies can utilize the National Cybercrime Reporting Portal’s Citizen Financial Cyber Fraud Reporting and Management System to request immediate freezing of compromised funds.

Conclusion and Urgent Measures

The warning underscores the urgency of fortifying payment infrastructure as financial systems increasingly rely on automated transactions, interconnected APIs, and digital banking platforms. The advisory highlights the need for continuous vigilance against evolving threats and the implementation of robust defensive measures to protect financial ecosystems.