TGCSB warns NBFCs and fintech firms of AI-assisted cyberattacks on payment systems

The Telangana Cyber Security Bureau (TGCSB) has alerted non-banking financial companies (NBFCs), fintech platforms and banks to a growing threat of AI-assisted cyberattacks targeting payment systems and loan disbursement platforms, and asked them to strengthen security measures to prevent fraudulent transactions at source.

The advisory was issued during a meeting held at the TGCSB headquarters in Hyderabad on Thursday (November 12), attended by representatives of NBFCs, fintech platforms and banks, along with officials from the Department of Telecommunications (DoT) and the Reserve Bank of India (RBI). TGCSB Director Shikha Goel addressed the meeting, while Rushi Mehta of the Indian Cyber Crime Coordination Centre (I4C) joined virtually and led discussions on payout mechanisms, API compromises and preventive measures.

According to the TGCSB, fraudsters have been targeting smaller NBFCs with weaker cybersecurity systems. Attackers spend around 10 to 12 days studying an institution’s internal processes and payment systems to identify whitelisted IDs, payment API credentials and vulnerabilities in the code.

They then exploit these weaknesses to gain unauthorised access and use stolen credentials from servers already trusted by the platform, making fraudulent requests appear genuine. Automated scripts are used to initiate payout requests outside normal batch processing windows, repeat transfers and split payments into smaller amounts to avoid triggering fraud alerts. The money is subsequently moved through rapid, automated bulk transactions into mule accounts before the transfers can be stopped.

Addressing the meeting, Shikha Goel said financial institutions should not restrict their responsibility to reporting fraud after it occurs, but should focus on preventing fraudulent transactions at source, detecting suspicious activity in real time and disrupting the movement of funds through mule accounts.

The TGCSB advised institutions to conduct regular Vulnerability Assessment and Penetration Testing (VAPT), secure payment and disbursement APIs, and deploy real-time fraud detection systems, transaction velocity checks and limits.

In the event of an attack, institutions were advised to immediately switch to manual operations by shutting down automated loan disbursement software, asking banks to freeze the loan disbursement account and clearing pending API calls. Automated operations should resume only after a competent cybersecurity team has tested the systems and patched all identified vulnerabilities.

The bureau also asked institutions to report suspected fraud immediately through the 1930 helpline or the National Cyber Crime Reporting Portal at www.cybercrime.gov.in, alert beneficiary banks and I4C, and report cyber incidents to CERT-In within six hours and to the RBI through the DAKSH portal, wherever applicable. They were also asked to maintain complete records of all high-risk payouts.