Threat of AI-based cyber attacks on payment systems increases

The Telangana Cyber Security Bureau (TGCSB) has warned Non-Banking Financial Companies (NBFCs), fintech platforms, and banks regarding the increasing risk of Artificial Intelligence (AI) based cyber attacks targeting payment systems and loan disbursement platforms. According to a report by The Hindu, TGCSB has instructed these institutions to strengthen security measures to prevent fraudulent transactions at the source.

The advisory was issued during a meeting held in Hyderabad on Thursday. The meeting was attended by representatives of NBFCs, fintech platforms, and banks, as well as officials from the Department of Telecommunications (DoT) and the Reserve Bank of India (RBI). TGCSB Director Shikha Goel addressed the meeting, while Rishi Mehta from the Indian Cyber Crime Coordination Centre (I4C) joined virtually to lead discussions on payout mechanisms, API tampering, and preventive measures.

According to TGCSB, fraudsters are targeting small NBFCs with weak cyber security. Attackers spend approximately 10 to 12 days studying an institution's internal processes and payment systems. During this period, they identify whitelisted IDs, payment API credentials, and vulnerabilities in the code. They then use these weaknesses to gain unauthorised access and use credentials stolen from the server, making fraudulent requests appear legitimate.

Attackers use automated scripts to initiate payout requests outside of normal batch processing times, perform frequent transfers, and split payments into small amounts to evade fraud alerts. Subsequently, before the transfers can be stopped, funds are moved into mule accounts through rapid and automated bulk transactions.

Addressing the meeting, Shikha Goel stated that financial institutions should not limit their responsibility to merely reporting after fraud has occurred, but should focus on preventing fraudulent transactions at the source, detecting suspicious activities in real-time, and stopping the movement of funds through mule accounts.

Institutions have been advised to regularly conduct Vulnerability Assessment and Penetration Testing (VAPT), secure payment and disbursement APIs, and implement real-time fraud detection systems along with transaction velocity checks and limits. In the event of an attack, institutions should immediately shut down automated loan disbursement software and switch to manual operations, request banks to freeze loan disbursement accounts, and clear pending API calls. Automated operations should only be resumed after the system has been tested and vulnerabilities rectified by the cyber security team.

The Bureau has instructed institutions to immediately report suspicious fraud via the 1930 helpline or the www.cybercrime.gov.in portal, alert beneficiary banks and I4C, and report cyber incidents to CERT-In within six hours and to the RBI via the DAKSH portal where applicable. Furthermore, instructions have been given to maintain complete records of all high-risk payouts.