CERT-In flags an AI threat actor targeting BFSI payment APIs for unauthorized fund transfers (opens in a new tab)
Why readIndia's national CERT has told banks, insurers and fintechs that an AI-assisted actor is actively abusing payment APIs to move money without authorisation, which turns an abstract threat into a control review due this week.
CERT-In has issued a warning to the BFSI sector that a threat actor using AI tooling is targeting payment APIs to initiate unauthorised fund transfers. The reported attack path is the API layer itself rather than endpoints or staff, so the relevant defences are transaction authorisation logic, rate and anomaly controls on payment endpoints, and review of partner and aggregator integrations. Coverage is secondary reporting on the advisory, so operators should pull the CERT-In notice directly for indicators and affected interfaces.