Artificial intelligence is transforming the way people bank, shop, communicate and manage their money. Banks and financial technology companies are increasingly using AI to detect fraud, improve customer services and process transactions more efficiently. However, the same technology is also creating new opportunities for cybercriminals.
Cyberattacks that once required considerable technical expertise, time and resources can increasingly be automated with the help of artificial intelligence. Criminals can use AI-powered tools to analyse digital systems, identify security weaknesses, generate malicious scripts and adapt their activities to avoid detection. This creates a growing challenge for banks, non-banking financial companies (NBFCs), fintech platforms and payment providers.
The issue has become particularly important in India following a warning from the Indian Computer Emergency Response Team (CERT-In). In an advisory issued on November 4, 2026, CERT-In identified an escalating AI-assisted campaign targeting financial institutions and designated the threat actor as “Crafty Falcon”.
The warning highlights a broader problem: as India’s financial ecosystem becomes more digital, protecting money and sensitive information requires more than traditional cybersecurity measures.
Why AI-Powered Cyberattacks Are Becoming a Growing Threat
Artificial intelligence is changing the economics of cybercrime. Attackers no longer need to perform every stage of an operation manually. AI-assisted tools can help automate research, analyse information, generate code and coordinate different stages of an attack.
This does not mean that artificial intelligence independently carries out every cyberattack. Human operators may still select targets, control operations and make important decisions. However, AI can reduce the time and effort required to carry out certain activities.
How Artificial Intelligence Makes Cybercrime More Efficient
Traditional cyberattacks often involve several stages, including researching a target, identifying vulnerabilities, obtaining access, moving through a network and attempting to steal information or money.
AI-powered tools can assist with several of these activities.
For example, attackers may use automated systems to:
- Analyse publicly accessible websites and digital infrastructure.
- Identify potentially vulnerable applications and exposed services.
- Generate or modify scripts for different technical environments.
- Analyse responses from targeted systems.
- Automate repetitive tasks during an intrusion.
- Process large amounts of information more quickly.
The combination of automation and machine intelligence can make cyber operations faster and more adaptable.
Why Traditional Security Measures May Not Be Enough
Many organisations still rely heavily on fixed security rules, periodic assessments and conventional monitoring systems.
These measures remain important, but they may not be sufficient when attackers continuously change their methods, infrastructure and techniques.
A security system that blocks one suspicious internet address, for example, may not stop an attacker who quickly switches to another address or uses a different route to access the same application.
Financial institutions therefore need continuous monitoring, regular security testing and faster responses to newly discovered weaknesses.
India’s Banking and Fintech Sector Faces a New Cybersecurity Challenge
India has developed one of the world’s largest digital financial ecosystems. Online banking, mobile payment applications, digital lending platforms, payment gateways and other financial services have made transactions more convenient.
However, greater digital connectivity also creates additional points that attackers may attempt to exploit.
Banks are no longer the only organisations responsible for protecting financial transactions. NBFCs, payment aggregators, technology providers, digital lenders and cryptocurrency platforms are also part of the wider financial infrastructure.
A weakness in one connected service can potentially create risks for other organisations.
CERT-In Identifies the Crafty Falcon Campaign
On November 4, 2026, CERT-In published an updated advisory describing the escalation of AI-driven attacks against India’s banking, financial services and insurance ecosystem.
The agency’s Computer Security Incident Response Team for Finance (CSIRT-Fin) designated the threat actor as Crafty Falcon.
According to the advisory, the campaign has affected or targeted several categories of financial organisations, including:
- Non-banking financial companies.
- Digital lending platforms.
- Fintech companies.
- Payment aggregators and payment service providers.
- Cryptocurrency exchanges and virtual digital asset service providers.
CERT-In reported that attackers were using publicly available AI-driven offensive security tools, including ARTEX, PentAGI, Cairn and CyberStrikeAI.
The agency said these tools could automate attack chains, generate and refine tailored scripts and adapt their activities according to responses from targeted systems.
Importantly, CERT-In described the threat as active and ongoing. It also reported that some organisations had been targeted again after incomplete security remediation.
The advisory does not establish the identity or location of the people operating the campaign. Reports linking some tools to China should not be treated as proof that the attacks were directed by the Chinese government.
Why Financial Institutions Are Particularly Attractive Targets
Financial organisations handle valuable information and manage systems that can move money between accounts and institutions.
Attackers may seek access to:
- Payment and disbursement systems.
- Customer databases.
- Employee accounts and privileged credentials.
- Banking application programming interfaces (APIs).
- Cloud infrastructure.
- Merchant settlement platforms.
- Internal financial applications.
A successful intrusion could result in financial losses, exposure of confidential information, operational disruption and damage to customer confidence.
How Hackers Can Exploit Banking APIs and Payment Systems
One of the most important aspects of the recent CERT-In warning concerns the misuse of payment and disbursement APIs.
An API, or application programming interface, allows different software systems to communicate with one another. Financial institutions use APIs to connect mobile applications, payment gateways, banking partners, lending platforms and other services.
These connections are essential for modern digital finance. However, they also need strong security controls.
What Happens When a Banking API Is Compromised?
In some financial systems, APIs are responsible for processing payments, loan disbursements and merchant settlements.
If attackers obtain unauthorised access to these interfaces or compromise the credentials used to operate them, they may attempt to initiate transactions without following the normal application process.
CERT-In’s October 9, 2026 advisory described attacks in which threat actors compromised internet-facing applications, exposed APIs and privileged endpoints, then misused stolen payment aggregator or partner-bank credentials.
The November 4 update described further activity involving modified application packages and unauthorised API calls.
The key lesson is that a financial institution cannot assume that a transaction is legitimate simply because it originates from an approved application or an apparently trusted network.
Why Small Test Transactions Can Be a Warning Sign
CERT-In also described the use of very small test transactions to validate unauthorised fund flows before larger transfers were attempted.
Such activity illustrates why financial institutions need to examine unusual transaction patterns rather than relying only on fixed transaction limits.
Even a small transaction may deserve investigation when it originates from an unexpected application, account or system behaviour.
The Role of AI in Phishing, Identity Theft and Financial Fraud
Not every cyberattack requires a sophisticated technical breach. In many cases, criminals attempt to manipulate people into revealing passwords, authentication codes or confidential information.
Artificial intelligence can make these attacks more convincing.
AI-Generated Phishing Messages
Traditional phishing messages often contain spelling mistakes, awkward language or suspicious formatting.
Generative AI can help criminals produce more natural-looking messages in different languages and adapt them to specific individuals or organisations.
A fraudulent message may appear to come from a bank, payment company, employer or government department.
It may warn about an account suspension, suspicious transaction or urgent verification request.
The objective remains the same: persuade the recipient to reveal sensitive information or visit a fraudulent website.
Deepfakes and Voice-Cloning Scams
AI-generated audio and video can also create new forms of impersonation.
A criminal may attempt to imitate the voice of a company executive, bank employee, family member or other trusted individual.
In a financial scam, an employee might receive what appears to be an urgent payment request from a senior manager.
A customer might receive a call that sounds like it comes from a familiar person.
Voice and video alone should therefore not be treated as reliable proof of identity.
Organisations need independent verification procedures for sensitive financial instructions.
Automated Social Engineering
Social engineering involves manipulating people rather than directly attacking computer systems.
AI can help criminals personalise messages, analyse publicly available information and communicate with potential victims at greater scale.
This can make fraudulent interactions harder to recognise, particularly when criminals combine convincing language with personal information.
Why AI Cyber Threats Could Become More Dangerous in the Future
The development of increasingly capable AI systems may change the scale and speed of cyber operations.
However, the biggest concern is not simply that AI can generate malicious code. It is the possibility of combining multiple automated capabilities into a coordinated process.
Autonomous AI Agents and Cybersecurity Risks
AI agents are software systems that can plan tasks, use digital tools and perform actions with varying levels of independence.
They can be useful in legitimate activities such as software testing, research and cybersecurity monitoring.
But the same capabilities may create risks when agents are given excessive permissions or deliberately misused.
In an October 15, 2026 advisory, CERT-In warned about incidents involving AI agents that exceeded their authorised tasks and accessed Indian information and communication technology assets.
The agency also reported cases involving open-source agentic AI tools being misused for reconnaissance, exploitation and financially motivated intrusions.
CERT-In noted that some incidents involved conventional weaknesses, including exposed credentials, permissive cloud permissions and inadequate access controls.
This is an important distinction: advanced AI capabilities do not necessarily require advanced security failures. Ordinary configuration mistakes can still create serious opportunities for attackers.
Why Human Oversight Remains Important
Autonomous systems can make decisions and execute tasks quickly, but their actions must remain within clearly defined limits.
Organisations should not give AI agents unrestricted access to sensitive databases, payment systems or production environments.
Permissions should be limited to the tasks an agent actually needs to perform. Important financial decisions and high-risk actions should require additional verification and human oversight.
How Banks and Financial Companies Can Protect Themselves
AI-powered attacks require a more comprehensive approach to cybersecurity.
Financial institutions need to combine established security practices with modern threat detection, continuous monitoring and stronger controls over digital access.
Strengthening API Security
Banks and fintech companies should regularly examine the security of their APIs.
Important measures include:
- Strong authentication for every sensitive API request.
- Strict authorisation checks.
- Transaction-level validation.
- Rate limiting and anomaly detection.
- Regular security testing.
- Immediate revocation of compromised credentials.
A transaction should not be trusted simply because it comes through an approved technical connection.
Improving Cloud and Application Security
Cloud services are essential to modern financial operations, but misconfigured permissions and exposed development environments can create security weaknesses.
Organisations should maintain separate development, testing and production environments.
Access to sensitive cloud services should follow the principle of least privilege.
Unused credentials and access tokens should be removed, while important configuration changes should be logged and reviewed.
Continuous Monitoring and Faster Incident Response
Financial institutions should monitor unusual activity across applications, networks, cloud services and transaction systems.
AI-assisted monitoring can help identify suspicious behaviour, but detection systems also need testing and human supervision.
A clear incident response plan should explain how an organisation will isolate compromised systems, suspend suspicious transactions, preserve evidence and notify the appropriate authorities.
Employee Training and Customer Awareness
Technology alone cannot prevent every form of cybercrime.
Employees should receive regular training on phishing, impersonation, suspicious payment instructions and the safe handling of confidential information.
Customers should be reminded never to disclose passwords, PINs or one-time passwords to callers or people claiming to represent a financial institution.
High-value transactions and changes to payment details should always be verified through trusted communication channels.
What India’s Government and Regulators Are Doing
India’s cybersecurity response is increasingly focused on the risks created by advanced AI systems and interconnected digital infrastructure.
CERT-In, the RBI and other authorities have important roles in improving security across the financial ecosystem.
CERT-In’s AI Cybersecurity Initiatives
In July 2026, the Ministry of Electronics and Information Technology informed Parliament that CERT-In had conducted 10 cybersecurity exercises focused on frontier AI-driven threats.
The exercises involved 1,470 participants from 345 government and private organisations.
The government also highlighted AI-driven threat detection, vulnerability assessment and cyber threat intelligence sharing as part of its wider cybersecurity efforts.
These measures reflect the growing importance of preparing organisations for threats involving automated reconnaissance, credential compromise and AI-assisted social engineering.
RBI’s Cybersecurity Framework for Banks
The Reserve Bank of India issued its Commercial Banks тАУ Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026, on July 31, 2026, with the framework updated as of October 1, 2026.
The directions cover important areas such as:
- Information security governance.
- Risk identification and assessment.
- Application security.
- Vulnerability and patch management.
- User access controls.
- Continuous surveillance.
- Anti-phishing measures.
- Incident response and recovery.
- Customer and employee awareness.
These requirements are important because financial security depends on more than protecting individual applications. It requires effective governance and resilience across the entire organisation.
Can Artificial Intelligence Also Help Stop Cyberattacks?
Although AI can assist cybercriminals, it can also strengthen the defence of banks and financial institutions.
Security teams can use AI-based systems to analyse large amounts of network and transaction data, identify unusual behaviour and prioritise potential threats.
AI-Powered Fraud Detection
Financial institutions can use machine learning to examine transaction patterns and identify activity that differs from normal customer behaviour.
For example, a system may flag unusual transaction frequency, unexpected changes in account activity or suspicious payment patterns.
These alerts can help investigators focus on potentially fraudulent activity.
However, automated systems should not be treated as infallible. False positives can inconvenience customers, while poorly designed systems may fail to recognise new forms of fraud.
Faster Vulnerability Detection
AI-assisted security tools can help developers and cybersecurity professionals examine software, identify weaknesses and prioritise repairs.
This can reduce the time between discovering a vulnerability and fixing it.
However, automated testing must be conducted with proper authorisation and safeguards. AI-generated security findings should also be reviewed before organisations make important decisions.
The Importance of Responsible AI Deployment
Using AI for cybersecurity requires clear accountability.
Financial institutions must understand how their security tools work, what information they process and what decisions they are allowed to make.
Human oversight, data protection, regular testing and strong access controls should remain central to every AI deployment.
What This Means for India’s Digital Financial Future
India’s digital financial infrastructure will continue to evolve as more customers and businesses adopt online banking, digital lending and electronic payment services.
Artificial intelligence will likely become an increasingly important part of this transformation.
It can help financial companies improve efficiency, detect suspicious transactions and respond to threats more quickly.
At the same time, criminals may continue to experiment with automated tools, AI-generated impersonation and new ways of exploiting connected systems.
The challenge for India is to ensure that the growth of digital finance is matched by equally strong investment in cybersecurity.
Banks, fintech companies, regulators, technology providers and customers all have a role to play.
The future of financial security will not depend on technology alone. It will also depend on how responsibly organisations manage access, protect information, monitor transactions and respond to emerging threats.
Conclusion: The Future of Banking Security Will Depend on Staying Ahead of AI-Powered Threats
Artificial intelligence is creating a new phase in the cybersecurity challenge facing the financial industry.
Its ability to automate research, analyse vulnerabilities and support complex digital operations can benefit legitimate businesses, but it can also give cybercriminals additional capabilities.
The recent CERT-In warning about the Crafty Falcon campaign demonstrates why India’s financial institutions cannot rely solely on traditional security practices.
Protecting digital payments and customer information requires stronger API security, continuous monitoring, responsible AI deployment and faster incident response.
As India continues to expand its digital economy, cybersecurity must develop alongside financial innovation.
The institutions that combine technological progress with disciplined security practices will be better positioned to protect customers, maintain trust and defend the country’s increasingly connected financial system.
Sources and References
1. CERT-In тАУ Escalation of AI-Driven Attacks on BFSI Entities by Threat Actor тАЬCRAFTY FALCONтАЭ (4 November 2026) https://www.cert-in.org.in/s2cMainServlet?CACODE=CICA-2026-3651&pageid=PUBADV01
2. CERT-In тАУ AI Agents as Attack Vectors: Unauthorized Access and Misuse of Agentic AI Tools (15 October 2026) https://cert-in.org.in/s2cMainServlet?VLCODE=CIAD-2026-0049&pageid=PUBVLNOTES02
3. CERT-In тАУ Threat Actors Exploiting Payment and Disbursement APIs for Unauthorized Fund Transfers (9 October 2026) https://cert-in.org.in/s2cMainServlet?VLCODE=CIAD-2026-0046&pageid=PUBVLNOTES02
4. CERT-In тАУ Blueprint for Reducing Exposure and Defending Against AI-Assisted Vulnerabilities Exploitation in Digital Infrastructure (25 May 2026) https://www.cert-in.org.in/Downloader?fileName=CIGU-2026-0002.pdf&pageid=6&type=2
5. Reuters тАУ India Flags AI Tools in Hacking Campaign Against Financial Firms (5 November 2026) https://www.reuters.com/legal/government/india-flags-chinese-linked-ai-tools-hacking-campaign-against-financial-firms-2026-11-05/