RBI tightens bank cyber checks after rising hacks

The Reserve Bank of India (RBI) is tightening its cybersecurity oversight of banks following a series of attacks on financial institutions. The central bank is seeking evidence that lenders are complying with existing security guidelines and addressing vulnerabilities in their digital infrastructure.

According to Reuters, the RBI has raised concerns with banks over the implementation of its cybersecurity directives. It has asked lenders to
review vulnerabilities in application programming interfaces (APIs), which connect banks with non-bank lenders and fintech platforms. Banks have
also been asked to explain how they are preparing for emerging risks associated with artificial intelligence (AI).

The scrutiny follows several incidents that have exposed weaknesses in financial systems. The State Bank of India (SBI) is investigating the
exposure of personal information belonging to 3,900 customers.

In a separate incident, two Mumbai-based non-bank lenders reportedly suffered losses of Rs 20 lakh after more than 700 unauthorised
transactions were carried out through accounts held with ICICI Bank on October 8 and 9. A police complaint alleged that attackers had
compromised an API used to send loan-disbursement instructions.

The Indian Computer Emergency Response Team (CERT-In) has also warned that cybercriminals are stealing banking and payment API
credentials to initiate fraudulent transfers while bypassing safeguards such as customer verification and transaction limits.


In its October 9 advisory, CERT-In identified attacks targeting non-banking financial companies, digital lending platforms and other financial service providers. It also flagged the possible use of AI-assisted tools to accelerate cyber intrusions.

The RBI’s concerns extend beyond individual security breaches to gaps in the implementation of cybersecurity controls. Smaller lenders and third-party technology providers have emerged as potential weak points in the financial ecosystem.

To address these risks, CERT-In has recommended stronger authentication measures, the removal of unused APIs, tighter credential
management, independent transaction verification and real-time monitoring.

The agency has also conducted cybersecurity training for 300 officials from more than 55 financial institutions, highlighting the importance of improving threat detection and incident response capabilities across the sector.

As banking services become increasingly interconnected, securing APIs and third-party technology networks is becoming essential to preventing
financial fraud and protecting customer information.