Telangana Cyber Security Bureau warns NBFCs and fintech firms against AI-assisted cyber attacks on payment systems
The Telangana Cyber Security Authority (TGCSB) has alerted non-banking financial companies (NBFCs), fintech platforms and banks to the growing threat of artificial intelligence-assisted cyber-attacks targeting payment systems and loan disbursal platforms and asked them to strengthen security measures to prevent fraudulent transactions at source.
The recommendation was issued during a meeting at the TGCSB headquarters in Hyderabad on Thursday, which was attended by representatives of NBFCs, fintech platforms and banks along with officials from the Department of Telecommunications (DoT) and the Reserve Bank of India (RBI). TGCSB Director Shikha Goel addressed the meeting, while Rushi Mehta from India’s Cyber Crime Coordination Center (I4C) joined virtually to lead discussions on payout mechanisms, API compromises and preventative measures.
According to the TGCSB, fraudsters are targeting smaller NBFCs with weaker cyber security systems. Attackers spend approximately 10 to 12 days studying an institution’s internal processes and payment systems to identify whitelisted IDs, payment API credentials, and code vulnerabilities.
They then exploit these weaknesses to gain unauthorized access and use stolen credentials from servers already trusted by the platform, making fraudulent requests appear genuine. Automated scripts are used to initiate payout requests outside of normal batch processing windows, repeat transfers, and split payments into smaller amounts to avoid triggering fraud alerts. The money is then moved in quick, automated bulk transactions to the mule accounts before the transfers can be stopped.
Speaking at the meeting, Shikha Goel said financial institutions should not limit their responsibility to reporting fraud after it occurs, but should focus on preventing fraudulent transactions at source, detecting suspicious activity in real time and disrupting the movement of funds through mule accounts.
The TGCSB advised institutions to regularly conduct vulnerability assessments and penetration testing (VAPT), secure payment and disbursement APIs, and deploy real-time fraud detection systems, transaction speed controls and limits.
In the event of an attack, institutions were advised to immediately switch to manual operations by shutting down automated loan disbursement software, asking banks to freeze the loan disbursement account, and settling pending API calls. Automated operations should only resume after a competent cybersecurity team has tested the systems and patched any vulnerabilities found.
The authority has also asked institutions to immediately report suspected fraud through the 1930 helpline or the national cybercrime reporting portal at www.cybercrime.gov.in, alert the beneficiary banks and I4C and report cyber incidents to CERT-In and RBI within six hours through the DAKSH portal wherever possible. They were also required to keep complete records of all high-risk payouts.
Published – 12 Nov 2026 19:38 IST