RBI Intensifies Cybersecurity Checks on Banks After Attacks Target Customer Data and Transfers

India's central bank is intensifying scrutiny of the technology systems used by banks and their financial-services partners after a series of cybersecurity incidents. In a report published on October 30, Reuters said the Reserve Bank of India has asked lenders to demonstrate that they are complying with existing security requirements and to examine weaknesses in the software connections linking banks with non-bank lenders and fintech companies.

The account is based on three people familiar with the discussions, rather than a newly published RBI rulebook. That distinction matters: the reported development is closer supervision and a push for implementation of current obligations, not proof that every bank has been issued an identical new public directive. The RBI had not immediately commented on the report.

Why application interfaces are in focus

Application programming interfaces, or APIs, let different financial systems exchange instructions and data. They are essential for services such as digital lending, payment processing and account information sharing. But a compromised API credential can also become a route into a bank-linked transaction system if authentication, authorisation or monitoring controls fail.

Reuters reported that officials had pressed banks to examine these connections and their preparedness for risks involving artificial intelligence. Smaller lenders, non-bank finance companies and external technology vendors were described by sources as potentially softer targets. A weak point at a partner can matter to a larger institution when the two systems are trusted to communicate.

Recent incidents raised the stakes

The reporting followed several incidents that have drawn attention to financial-sector security. State Bank of India disclosed that data belonging to approximately 3,900 customers had leaked and said it was investigating the underlying vulnerability. Separately, two Mumbai-based non-bank lenders reported losses of roughly $2 million through more than 700 unauthorised transfers on October 8 and 9, according to a police complaint reviewed by Reuters.

In that case, the complaint alleged that attackers compromised the API used to send loan-disbursement instructions to accounts at ICICI Bank. The complaint is evidence of an allegation and an investigation, not a final judicial determination about every technical step. ICICI Bank had not immediately responded to the news agency's request for comment.

India's computer emergency response agency, CERT-In, also warned in an October 9 advisory that stolen API credentials were being used to move money from lenders' systems. The agency raised the possibility of AI-assisted techniques, but that does not mean artificial intelligence was conclusively established as the method used in each reported attack.

The difference between having rules and enforcing them

Banks already operate under cybersecurity and risk-management requirements. The issue described by people familiar with the RBI's discussions is that implementation can lag behind formal policy. A lender may have a security framework on paper while still leaving gaps in credential protection, vendor access, transaction monitoring or incident response.

The current push appears designed to make institutions show how their controls work in practice. That could include reviewing third-party access, identifying unusual transfers and demonstrating how quickly compromised connections can be disabled. These are reasonable implications of the risks being discussed, rather than a list of new requirements announced by the RBI.

What customers should understand

For ordinary account holders, the report does not establish that every Indian bank account is compromised. It does reinforce the importance of distinguishing a bank's own security incident from scams that trick customers into authorising payments. Customers should continue using official bank apps and channels, checking transaction alerts and promptly reporting unfamiliar transfers. They should not share passwords, one-time codes or remote-access permissions with callers claiming to offer security help.

The most useful indicator of progress will be whether banks can trace and restrict instructions that originate outside their own systems. That includes knowing which partner is allowed to initiate a transfer, whether a request is consistent with normal activity and what happens when a credential is stolen. The recent unauthorised-transfer case illustrates why simple perimeter security is insufficient in a network of interconnected firms. At the same time, the reported RBI conversations do not provide a consumer-facing deadline or a new universal banking fee. Any claim that customers must immediately re-register an account or share credentials to comply with an RBI cybersecurity drive should be treated with suspicion and checked against the bank's official communications.

The report also highlights a governance question for lenders: security responsibility does not disappear when a service is outsourced. Customers may see only one banking brand, while the underlying transaction can cross several technical and organisational boundaries.

Financial institutions face a different task: protecting the links through which legitimate instructions enter their systems. The RBI's closer attention reflects the fact that a modern bank's security depends not only on its central network but also on every partner allowed to connect to it. The October 30 report gives the issue fresh urgency without justifying alarmist claims about the safety of all digital payments.