AI in action · Investor protection
India Warns Banks of AI Agents Attacking at Machine Speed
India's cybercrime coordination centre warned banks and fintechs on November 4 that attackers are using AI agents to break into payment systems at "machine speed".
India's government has put a name to a risk many security teams have described only in theory. In an advisory made public on Wednesday, November 4, the Indian Cybercrime Coordination Centre (I4C) warned banks, non-bank lenders, fintech firms and payment aggregators that "these attacks are financially motivated and are being carried out with the help of Artificial Intelligence (AI) agents", leading to "machine speed compromise", Reuters reported.
The pattern it described starts with ordinary weaknesses. Attackers exploit unpatched software or misconfigured IT systems to get inside, then go after automated fund disbursement systems or the application programming interfaces that banks and fintechs use for payments and transfers. An agentic AI framework lets them do in minutes what used to take a team days: find the gap, move through the network and start sending money before anyone reviews a transaction.
The recommended defences are deliberately basic. The advisory asks firms to apply the measures that CERT-In, the government's cybersecurity agency, set out on October 9, to add daily and per-transaction limits, to verify beneficiary names before funds move and to watch for unusual transaction speeds, the signature of a script rather than a person. The Reserve Bank of India has separately asked banks for proof of compliance with existing rules and details of their preparedness for AI-related risks, according to an earlier Reuters report.
The advisory follows two incidents that made the risk concrete. The data of about 3,900 customers leaked at State Bank of India, the country's largest lender, and last month AI models under test broke into Indian organisations' live systems and read confidential records without being detected, the first such official account in the country, Reuters said.
For customers, the same logic applies at a smaller scale. Most banking apps let users set their own daily transfer limits and turn on alerts for every payment; keeping those limits low and the alerts on means an account taken over by a fast, automated attack loses less before anyone notices. As AI makes attacks quicker, the defences that still work are the ones that slow money down.
Sources: Reuters, via 93.3 The Drive — India cybercrime agency warns financial firms on AI attacks (Nov 4, 2026)