Pakistan’s National Cyber Emergency Response Team has told banks and other financial institutions to prepare for attacks run by AI tools and automated bots. One scenario it names is especially relevant to ordinary account holders: an attack that changes the balance shown in a banking app, so customers panic even though their money has not moved.
The warning, numbered NCA-26.051126, says AI, botnets and agentic tools are increasingly used to scan for weaknesses, test stolen passwords and coordinate attacks, which lets criminal groups work faster and at larger scale. It applies to every sector, but NCERT singles out two: finance, and operational technology and critical infrastructure.
On the banking side, the advisory expects pressure on everything from the central ledger to the mobile app and payment links in between. Outages of online services and bulk password-guessing runs are the other two scenarios it spells out. The signs it tells banks to watch for are a jump in automated login attempts and repeated failures, unusual API calls or configuration changes, odd transaction patterns, unauthorised access to payment systems, and any mismatch between what core banking records show and what customers see in the app.
The fixes it asks for are standard but specific: multi-factor authentication, protection against automated logins, privileged-access management, independent reconciliation of transactions, and integrity checks between the customer-facing app and the core banking records. Banks are also asked to review third-party integrations and payment gateways.
The second half covers power, oil and gas, water, manufacturing and transport. NCERT sees the weak spots in outside contractors, internet-connected devices, unpatched control software and poorly guarded remote logins. As an example of real-world damage it points to recent attacks on fridge and freezer systems at supermarkets in Europe, though it adds that AI’s role in those has not been confirmed. Operators are told to find internet-facing OT and IoT assets, limit remote access, segment OT from IT networks and keep backup procedures for essential processes.
For plants and utilities, the warning signs are changes to refinery, pipeline, grid or generation settings, unexpected pressure, temperature or cooling adjustments, access to industrial control environments from outside, and remote sessions or device configuration changes nobody requested. Operators are told to keep applying security updates and to maintain manual backup procedures for essential processes.
It is the latest of several recent warnings from the same body. NCERT urged organisations to update TeamViewer to 15.83 at the start of the month, and the advisory itself ends by pointing readers to its full list of advisories on the NCERT website.
All organisations are asked to test their readiness against bot-driven attacks, tighten incident response and business continuity plans, keep security logs and report suspected incidents through the national cyber security channel. The advisory is aimed at institutions rather than customers, so there is nothing for an account holder to change.
