TGCSB warns NBFCs, fintech firms against AI-assisted cyberattacks on payment systems
Hyderabad, Nov 12 (TNT): The Telangana Cyber Security Bureau (TGCSB) on Thursday alerted banks, Non-Banking Financial Companies (NBFCs) and fintech platforms to the growing threat of AI-assisted cyberattacks targeting payment and loan disbursement systems, urging them to strengthen security mechanisms and prevent fraudulent transactions at the source.
At a meeting with representatives of financial institutions and officials of the Department of Telecommunications (DoT) and the Reserve Bank of India (RBI) here, TGCSB Director Shikha Goel called for real-time fraud detection, enhanced security of payment application programming interfaces (APIs) and immediate disruption of suspicious transactions.
Rushi Mehta of the Indian Cyber Crime Coordination Centre (I4C), who participated virtually, led discussions on vulnerabilities in payout mechanisms, API compromises and preventive measures.
Explaining the modus operandi, the Bureau said cybercriminals were increasingly targeting smaller NBFCs with weak cybersecurity systems.
Fraudsters typically spend 10 to 12 days studying an institution’s internal processes and payment systems before identifying vulnerabilities, including whitelisted IDs and payment API credentials.
Using stolen credentials from trusted servers, they generate unauthorised payout requests that appear legitimate.
Automated scripts trigger repeated transfers outside normal batch processing windows, splitting transaction amounts to evade fraud alerts.
The funds are subsequently routed through rapid bulk transfers into mule accounts.
“The responsibility of financial institutions should not be limited to reporting fraud after it has occurred. The priority must be to prevent fraudulent transactions at the source,” Goel said, stressing the need for real-time monitoring and disruption of fund transfers through mule accounts.
The TGCSB advised financial institutions to conduct regular Vulnerability Assessment and Penetration Testing (VAPT), secure payment and disbursement APIs, and introduce real-time fraud detection systems, transaction velocity checks and transfer limits.
In the event of a cyberattack, institutions were asked to immediately switch to manual operations, suspend automated loan disbursement software, seek freezing of the concerned disbursement accounts by banks and clear pending API calls. Automated operations should resume only after cybersecurity experts test the systems and rectify vulnerabilities.
The Bureau also directed institutions to report suspected fraud immediately through the national cybercrime helpline 1930 or www.cybercrime.gov.in, alert beneficiary banks and I4C, and report incidents to CERT-In within six hours and to RBI through the DAKSH portal, wherever applicable.
Other measures include reviewing critical payment APIs, strengthening automated fraud detection, establishing a 24×7 single point of contact with TGCSB, imposing daily transaction limits on accounts and sharing intelligence on mule accounts.
The institutions were also asked to submit time-bound action plans to strengthen their cybersecurity infrastructure.
The Bureau urged citizens who fall victim to financial cyber fraud to immediately dial 1930 or lodge a complaint through the national cybercrime reporting portal.
TNT TS
