> ## Content Index > Fetch the complete content index at: https://www.cyberdelegate.com/llms.txt > Use this file to discover other available public pages before exploring further. # Machine-Speed Fraud: TGCSB Warns NBFCs and Fintechs of AI-Assisted Attacks on Payment Systems - URL: https://www.cyberdelegate.com/machine-speed-fraud-tgcsb-warns-nbfcs-and-fintechs-of-ai-assisted-attacks-on-payment-systems/ - Published: 2026-11-14T04:55:09.000Z - Updated: 2026-11-14T04:55:09.000Z - Description: Telangana's cyber agency says lenders must stop fraud at the source, not just report it after the money is gone - Author: The CyberDiplomat - Tags: Telengana, Cybersecurity Regulation India, AI Agentic Attack, Payment Systems, Finance, Telangana Cyber Security Bureau *Telangana's cyber agency says lenders must stop fraud at the source, not just report it after the money is gone.* The Telangana Cyber Security Bureau (TGCSB) has put non-banking financial companies (NBFCs), fintech platforms and banks on notice: attackers armed with AI-assisted tooling are going after the payment and loan disbursement systems that power India's digital lending boom, and the institutions themselves need to close the gaps before the next payout is hijacked. The warning came on Thursday, 12 November 2026, at an urgent coordination meeting at TGCSB's Hyderabad headquarters. Representatives of NBFCs, fintech platforms and banks sat alongside officials from the Reserve Bank of India (RBI) and the Department of Telecommunications (DoT). Rushi Mehta of the Indian Cyber Crime Coordination Centre (I4C) joined virtually to walk participants through payout-mechanism weaknesses and API compromises. TGCSB Director Shikha Goel's message was blunt: an institution's duty does not end with filing a complaint after it has been robbed. Lenders, she said, must block fraudulent transactions at the source, spot suspicious activity in real time, and break the flow of funds to mule accounts. ## A national campaign, now with a local response TGCSB's alert lands in the middle of a nationwide wave. Earlier this month, CERT-In escalated its warning about a campaign it calls **"Crafty Falcon"**, describing an AI-assisted, financially motivated threat actor that scans targets rapidly, builds custom attack tools and abuses victims' own payment and disbursement APIs. CERT-In noted that some NBFCs and fintechs that had already acted on its October advisory were hit again. I4C's National Cybercrime Threat Analysis Unit, together with CERT-In, has separately flagged multi-crore unauthorised transactions driven by AI agents that automate reconnaissance, compromise and fund transfer. Media reports have put losses at smaller NBFCs at roughly ₹300 crore over two months — a figure that has not been officially confirmed. One Delhi-based NBFC was reportedly hit twice within days, losing about ₹7.5 crore and then ₹7.25 crore. ## How the attacks unfold Based on incidents observed across the country, TGCSB laid out a consistent playbook: 1. **Pick a soft target.** Attackers favour smaller NBFCs whose cybersecurity frameworks are thinner than those of large banks. 2. **Study the victim for 10–12 days.** Before striking, they map internal processes and payment infrastructure, hunting for whitelisted identities, payment API credentials and weaknesses in code. 3. **Hide in trusted traffic.** Using credentials stolen from servers the platform already trusts, they send payout requests that look entirely legitimate. 4. **Automate the theft.** Scripts fire disbursements outside normal batch-processing windows, repeating transfers and slicing large sums into smaller ones that stay under fraud-detection thresholds. 5. **Launder at speed.** Funds are pushed in bulk through layers of mule accounts across multiple banks before anyone can freeze them. The AI element matters less for its novelty than for its pace. CERT-In has observed AI-assisted tooling compress the gap between initial access and final impact from days to hours, and attackers churning out large volumes of near-identical scripts that they rework in quick succession. Low-value test transfers — sometimes as little as ₹1 to a new beneficiary — are used to confirm that a hijacked payment route works before the big money moves. ## What TGCSB is asking institutions to do The bureau's prevention checklist focuses on the disbursement pipeline itself: - **Test continuously.** Run regular Vulnerability Assessment and Penetration Testing (VAPT) and immediately review every critical payment API. - **Lock down disbursement APIs.** Secure payment and loan disbursement interfaces and strengthen automated fraud detection. - **Watch velocity, not just value.** Deploy real-time fraud detection, transaction-velocity checks and limits — including caps on the *number* of transactions per account per day, not only on amounts. - **Stay reachable.** Maintain a 24x7 single point of contact for coordination with TGCSB. - **Share what you see.** Securely exchange intelligence on identified mule accounts. - **Commit to fixes.** Submit time-bound action plans to remediate vulnerabilities, and keep comprehensive records of all high-risk payout transactions. ## If an attack is under way TGCSB also set out an emergency drill for institutions that detect a live compromise: - Switch immediately to manual operations and shut down automated loan disbursement software. - Ask the partner bank to freeze the disbursement account. - Clear all pending API calls. - Restart automation only after a competent cybersecurity team has tested the systems and patched every vulnerability found. ## Report fast — every hour counts Speed of reporting is what gives investigators a chance to trace and freeze diverted funds before they vanish into the mule network. TGCSB's reporting map: | What | Where | | ------------------------- | ------------------------------------------ | | Suspected financial fraud | Helpline **1930** or **cybercrime.gov.in** | | Coordination | Alert beneficiary banks and I4C | | Cyber incidents | **CERT-In**, within six hours | | Regulatory reporting | RBI's **DAKSH** portal | Individual victims of cyber fraud are urged to use the same 1930 helpline or the national portal. ## Why this matters India's digital lending ecosystem runs on APIs, partner-bank integrations and automated payouts — the very plumbing that makes instant credit possible. That same automation is now being turned against lenders, with attackers operating at machine speed against defences that often still work at human speed. Notably, the weaknesses being exploited are not exotic: exposed APIs, stolen credentials, poorly configured servers and missing transaction limits. AI is accelerating the exploitation, but the fixes are well understood. TGCSB's core point is that regulators and police can help recover money, but only the institutions themselves can stop it leaving in the first place. For smaller NBFCs in particular, the 10–12 day reconnaissance window is both the threat and the opportunity — time in which proper monitoring could catch an intruder before a single rupee moves. --- **Sources:** [UNI India](https://www.uniindia.com/south-india/cyber-attacks-telangana-ai-tgcsb/243570?ref=cyberdelegate.com) · [NewsMeter](https://newsmeter.in/crime/12-days-of-planning-automated-money-transfers-how-cybercriminals-target-nbfcs-779209?ref=cyberdelegate.com) · [The Hans India](https://www.thehansindia.com/news/cities/hyderabad/plug-cyber-loopholes-before-fraudsters-strike-shikha-goel-1141528?ref=cyberdelegate.com) · [Moneylife](https://www.moneylife.in/article/crafty-falcon-cyber-threat-escalates-as-aidriven-attacks-target-banks-fintechs-and-nbfcs/82128.html?ref=cyberdelegate.com) · [The Federal](https://thefederal.com/category/business/i4c-warns-banks-nbfcs-and-fintech-firms-of-ai-assisted-attacks-payment-apis-261866?ref=cyberdelegate.com) · [Inventiva](https://www.inventiva.co.in/?p=443443&ref=cyberdelegate.com)