For Prelims: Indian Cyber Crime Coordination Centre (I4C), CERT-In, DAKSH Portal, API (Application Programming Interface), Nodal Agency, Threat Type, Reporting Time, Targets
For Mains: AI-enabled cyber threats, financial sector resilience, API vulnerability, multi-agency coordination (I4C, RBI, CERT-In)
Source:
Hindustan
New update
New facts from Hindustan, 5 November 2026
- CERT-In is a co-issuer of the advisory, not just a reporting authority
- CERT-In is under the Ministry of Electronics and Information Technology
- Attackers use AI agents to exploit outdated software and API vulnerabilities
- Unauthorised transactions worth crores are being carried out
- Attackers delete records to make detection difficult
5 facts for one-day exams
SSC, railway, police and teaching exams ask direct questions like these.
- I4C issued a severe advisory on AI-driven cyberattacks on financial institutions.
- Reporting of cyber incidents must be done within 6 hours to CERT-In and RBI DAKSH portal.
- The advisory covers banks, NBFCs, and fintech companies.
- Institutions must close obsolete or test APIs to reduce vulnerabilities.
- I4C is the central cyber security agency under the Ministry of Home Affairs.
Why in the news?
The Indian Cyber Crime Coordination Centre (I4C) has issued a high-severity advisory to banks, NBFCs, and fintech companies warning of rising AI-enabled cyberattacks targeting financial systems. Institutions must immediately implement security measures, report breaches within 6 hours to CERT-In and the RBI's DAKSH portal, and close unused APIs.
Summary
- AI agents are being used by hackers to breach financial networks and execute fraudulent transactions, often through vulnerable APIs.
- The I4C advisory classifies this as a 'severe' cyber threat and mandates reporting within 6 hours to CERT-In and the RBI DAKSH portal.
- Measures include maintaining an inventory of all payment APIs, decommissioning obsolete or test interfaces, and enhancing coordination among CISO, transaction monitoring, and IT teams.
Highlights
Rising AI Threat
Hackers are using AI agents to break into financial systems and carry out fraudulent transactions at speed.
I4C Advisory
The central cyber security agency has issued a severe advisory to banks, NBFCs, and fintech firms to bolster defenses.
6-Hour Reporting Mandate
Institutions must report breaches to CERT-In and the RBI DAKSH portal within six hours of detection.
Background
With the rapid digitisation of financial services, cybercriminals have increasingly turned to AI tools to automate and scale attacks. The Indian Cyber Crime Coordination Centre (I4C), the central agency under the Ministry of Home Affairs, coordinates responses to cybercrime. This advisory reflects a growing recognition of AI as a force multiplier for financial fraud.
Key Analysis and Impact
The advisory targets three pillars of financial cybersecurity: vulnerability management (closing unused APIs), incident response (6-hour reporting), and institutional coordination (CISO, transaction monitoring, IT teams). The focus on APIs is critical because they are the backbone of digital payments and fund transfers. The RBI's DAKSH portal is the central platform for reporting cyber incidents in the financial sector. Failure to comply could lead to systemic risks and loss of public trust.
Way Forward
Financial institutions must urgently adopt the recommended measures. The government may follow up with stricter compliance timelines and penalties. For the long term, the RBI and I4C may issue binding cybersecurity standards for all regulated entities. Aspirants should note the role of CERT-In as the national nodal agency for cyber security incident response.
Background GK
Textbook concepts you need to understand this news
- Indian Cyber Crime Coordination Centre (I4C)
- A central agency under the Ministry of Home Affairs, established to coordinate cybercrime investigations and responses across states and union territories.
- CERT-In
- The Indian Computer Emergency Response Team, the national nodal agency for responding to cyber security incidents. It operates under the Ministry of Electronics and Information Technology.
- DAKSH Portal
- The RBI's portal for reporting cyber security incidents in the banking and financial sector. It facilitates real-time information sharing between banks and the regulator.
- API (Application Programming Interface)
- A set of protocols that allows different software applications to communicate with each other. In banking, APIs enable payment processing, fund transfers, and customer data access.
Facts to remember
Tap a card to see the answer. Try to recall it first.
How exams will ask this
- Data: 6 hours – time frame for reporting cyber incidents to CERT-In and RBI DAKSH portal
- Nodal Body: Indian Cyber Crime Coordination Centre (I4C) – central agency that issued the advisory
Don't make this mistake!
Examiners may confuse I4C with CERT-In or the National Cyber Security Coordinator. I4C coordinates investigations; CERT-In is the incident response node. Also, the 6-hour reporting requirement applies to both CERT-In and RBI DAKSH, not just one.
Write these in mains answers
- AI-enabled cyber threats, financial sector resilience, API vulnerability, multi-agency coordination (I4C, RBI, CERT-In)
Stuck? Get it in one tap
Hackers are using AI to break into banks and financial companies. The government's cyber security agency, I4C, has told these companies to quickly fix weak spots, report any attack within 6 hours, and shut down old computer connections that hackers could use.
- I4C issued a severe advisory on AI-driven cyberattacks on financial institutions.
- Reporting of cyber incidents must be done within 6 hours to CERT-In and RBI DAKSH portal.
- The advisory covers banks, NBFCs, and fintech companies.
- Institutions must close obsolete or test APIs to reduce vulnerabilities.
- I4C is the central cyber security agency under the Ministry of Home Affairs.
- Security: Cyber security and financial sector
- Economy: Banking and financial regulation
Related concepts: Indian Cyber Crime Coordination Centre (I4C), CERT-In, DAKSH Portal, API (Application Programming Interface)
Practice questions
Pick an answer, then read the explanation.
- Q1Easy
Which central agency issued the advisory on AI-driven cyberattacks targeting financial institutions?
Explanation: The advisory was issued by the Indian Cyber Crime Coordination Centre (I4C), the central cyber security agency. The RBI is the banking regulator, CERT-In handles incident response, and the NCSC is a different coordinating body. Hence option B is correct.
- Q2Hard
Consider the following statements regarding the I4C advisory on AI cyberattacks:
- 1.The advisory mandates reporting of cyber incidents within 6 hours to both CERT-In and the RBI DAKSH portal.
- 2.The advisory only applies to public sector banks and not to NBFCs or fintech companies.
- 3.The advisory recommends closing obsolete or test APIs to reduce vulnerabilities.
Which of the statements given above is/are correct?
Explanation: Statement 1 is correct: reporting must be done within 6 hours to CERT-In and the RBI DAKSH portal. Statement 2 is incorrect: the advisory explicitly targets banks, NBFCs, and fintech companies. Statement 3 is correct: closing obsolete or test interfaces is one of the recommended measures. Hence option C is correct.
- Q3Medium
Within how many hours must financial institutions report a cyber incident to CERT-In and the RBI DAKSH portal as per the I4C advisory?
Explanation: The I4C advisory mandates that institutions report breaches within 6 hours of detection to both CERT-In and the RBI DAKSH portal. Options 4, 8, and 12 hours are not the specified time frame. Hence option B is correct.
- Q4Medium
What is the primary objective of the I4C advisory on AI-driven cyberattacks in the financial sector?
Explanation: The advisory aims to enhance security coordination by recommending specific measures like API inventory management, 6-hour reporting, and inter-departmental coordination. Penalties are not the focus; banning AI or transferring transactions is not suggested. Hence option B is correct.
Frequently asked questions
1. What is the I4C advisory on AI cyberattacks about?
The Indian Cyber Crime Coordination Centre (I4C) issued a severe advisory warning banks, NBFCs, and fintech companies about rising AI-enabled cyberattacks and recommending immediate security measures.
2. What is the 6-hour reporting requirement in the I4C advisory?
Financial institutions must report cyber incidents within 6 hours to CERT-In and the RBI DAKSH portal.
3. Which institutions are covered by the I4C advisory?
The advisory covers banks, non-banking financial companies (NBFCs), and financial technology (fintech) companies.
All sources
- Original4 November 2026 · Read story
- Update5 November 2026 · Read story
