RBI urges lenders to strengthen defenses against AI-powered cyberattacks

Traders Union
All News
Central Banks
RBI scrutinizes bank security

Highlights

RBI increases cybersecurity checks on banks.
API breaches caused about $2 million in losses.
SBI reported a leak affecting 3,900 customers.

Reuters reported that the RBI has held several meetings with banks to examine vulnerabilities in their digital systems. Officials have focused particularly on application programming interfaces, or APIs, which connect banks with fintech companies and non-bank financial institutions.

RBI targets weaknesses in banking technology

The central bank is seeking detailed information about how lenders protect their systems, monitor suspicious activity, and prepare for increasingly sophisticated cyberattacks. Its scrutiny extends to third-party technology providers, whose connections to banking networks can create additional security vulnerabilities.

Although India already has cybersecurity regulations for financial institutions, implementation remains uneven. The latest supervisory push is intended to ensure that banks apply existing safeguards rather than merely demonstrate that they have established security policies.

Smaller lenders and non-bank financial companies are receiving particular attention because their technology infrastructure and external service providers may offer attackers easier access to larger banking networks. The RBI has also requested information about preparedness for AI-related threats, reflecting concerns that automated tools could make attacks harder to detect.

Recent attacks expose customer data and payment systems

Several incidents have highlighted weaknesses in India's financial infrastructure. State Bank of India, the country's largest lender, disclosed that information belonging to approximately 3,900 customers had been leaked. The bank is investigating the incident and has not yet identified the underlying vulnerability.

A separate attack affected two Mumbai-based non-bank lenders on October 8-9. According to a police complaint, the companies lost approximately $2 million through more than 700 unauthorized instant transfers involving accounts at ICICI Bank.

Investigators identified a compromised API connection used to transmit loan disbursement instructions as the apparent entry point. The incident illustrates how attackers can exploit links between financial institutions without necessarily breaching a bank's core systems.

Digital banking expansion increases security pressure

India's cybersecurity agency, CERT-In, issued an October 9 advisory warning that attackers were stealing banking API credentials to move funds from financial institutions. The agency also identified the possible use of AI-assisted tools in such attacks.

The incidents underscore the financial risks associated with increasingly interconnected banking services. The reported $2 million loss and exposure of 3,900 customer records demonstrate how weaknesses in separate parts of the financial system can affect both institutions and their customers.

For banks, stronger API authentication, continuous transaction monitoring, and oversight of technology vendors are becoming central compliance priorities. The RBI's intervention signals that regulators expect existing cybersecurity requirements to be enforced more consistently as digital financial services expand.

We also reported Binance hit by a suspected $6 billion hack, the potentially largest crypto attack ever.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.