The Reserve Bank of India (RBI) has stepped up scrutiny of banks’ cybersecurity systems, seeking details of their preparedness for artificial intelligence-related threats amid a rise in attacks targeting financial infrastructure.
In a series of recent meetings, the central bank asked lenders to examine vulnerabilities in their application programming interfaces (APIs), the software connections banks use to work with non-bank lenders and fintech companies. It also sought evidence that banks were complying with existing cybersecurity requirements, according to three people familiar with the discussions who spoke to Reuters.
The RBI’s increased vigilance comes as hackers worldwide are using increasingly sophisticated AI tools to target financial institutions, potentially putting customer data and funds at risk.
One concern raised during the discussions is the vulnerability of smaller lenders, non-bank financial companies and third-party technology vendors. These entities may offer hackers easier entry points into larger banking systems.
Although the RBI has previously issued cybersecurity directives, implementation remains uneven, according to a consultant working with major banks. The regulator is now pressing lenders to strengthen compliance and address gaps in their security systems.
Recent incidents have highlighted the risks. State Bank of India, the country’s largest lender, is investigating a data leak involving approximately 3,900 customers. In a separate incident, two Mumbai-based non-bank lenders reportedly lost around $2 million through more than 700 unauthorised instant transfers from accounts held with ICICI Bank on October 8 and 9.
A police complaint reviewed by Reuters said hackers had compromised the API connection used to send loan disbursal instructions to ICICI Bank.
India’s cybersecurity agency CERT-In had warned on October 9 that hackers were stealing banking API credentials to transfer money out of lenders’ systems, potentially using AI-assisted tools.
Earlier this week, CERT-In also conducted cybersecurity training for 300 officials from more than 55 financial institutions.
Source: Reuters
