AI Cyberthreats Target Banks, NCERT Warns
AI cyberthreats could target banks and critical infrastructure in Pakistan, the National Cyber Emergency Response Team (NCERT) has warned in a new advisory.
The advisory, dated November 5, says attackers are making greater use of artificial intelligence (AI), automated bots, botnets and agentic tools to carry out credential-based and coordinated cyberattacks. It warns that financial services and critical infrastructure face the highest risk. Dawn reported the advisory, which is published on the pkcert.gov.pk site.
“These capabilities may help threat actors and sophisticated cyber criminal groups to broaden the scale, speed and sophistication of their operations,” NCERT said.
AI cyberthreats put banks at risk
NCERT warned banks that attacks could hit core banking systems, digital banking platforms, payment systems and customer-facing applications. The possible effects include disruption of online services, automated credential attacks and manipulation of displayed account balances.
The team listed warning signs that may point to an attack on a financial institution. These include frequent automated login attempts, repeated authentication failures and unusual application programming interface (API) requests.
Abnormal transaction patterns are another red flag. So is a difference between core banking records and the balance shown to the customer, along with unauthorised payment access.
NCERT urged financial institutions to check the security of their core banking systems, APIs, third-party integrations, payment gateways and digital banking applications. It also urged them to use multi-factor authentication and protection against automated login attempts, and to enforce integrity checks between consumer-facing applications and core banking records.
Banks should also monitor bot-driven attempts, potential service disruption and abnormal API activity, the advisory said.
Critical infrastructure in the firing line
The warning extends well beyond banks. NCERT said third-party service providers, connected internet-of-things (IoT) devices, flaws in industrial control systems and insecure remote access could expose oil and gas facilities, water utilities, power generation and distribution networks, manufacturing, transport and other essential services.
“A compromise could disrupt physical processes and critical services,” the advisory said.
NCERT cited recent incidents in Europe, where supermarket refrigerators and freezers were targeted in cyberattacks, as examples of the physical and commercial damage that attacks on connected operational systems can cause. It added, however, that AI involvement in those incidents has not been confirmed yet.
What NCERT wants utilities to do
For utility providers, NCERT advised limiting direct internet exposure and remote access, and checking the security of IoT assets and industrial control systems.
“Enforce OT/IT network segmentation and continuously monitor access to operational systems,” it recommended. “Keep applying security updates and maintain backup operating procedures for essential processes.”
The team also urged all organisations to check their readiness against bot-driven AI cyberattacks, keep incident logs, and improve arrangements for incident response, business continuity and security monitoring.
Why the warning matters now
The warning lands as Pakistan’s financial system goes digital at speed. The prime minister has ordered a roadmap for 100pc digital payments, with most government payments set to be fully digitised by December 2026. The State Bank has also launched a core banking network and data centre with US help. More digital services mean more targets, and the systems NCERT names are now the front line.
Pakistan has already seen the scale of modern cybercrime. North Korean hackers were blamed for a $6.3bn heist from Binance, one of the largest crypto thefts on record. NCERT’s warning is that AI tools can now put that kind of scale within reach of smaller criminal groups too.
The PTA is already running network quality surveys in Lahore and Karachi, and Pakistan aims to train one million AI professionals by 2030. The skills push and the security warning are two sides of the same shift: AI is becoming central to Pakistan’s economy, and defending it is now a national task.
What is NCERT?
NCERT is the National Cyber Emergency Response Team, Pakistan’s national body for responding to cyber emergencies. It issues advisories to organisations on emerging threats and how to defend against them.
Which sectors are most at risk?
Financial services and critical infrastructure face the highest risk, according to NCERT. That covers banks, payment systems, oil and gas facilities, water utilities, power generation and distribution, manufacturing and transport.
How can banks spot an attack?
Warning signs include frequent automated login attempts, repeated authentication failures, unusual API requests, abnormal transaction patterns, and any gap between core banking records and the balance shown to customers.
What should organisations do?
NCERT advises checking core banking and industrial control security, using multi-factor authentication, segmenting operational networks, applying security updates, keeping incident logs and maintaining backup procedures for essential services.
