India Tightens Cybersecurity Scrutiny Across Banks

A series of cyber incidents has prompted India's central bank to intensify scrutiny of the connections that allow banks and financial technology companies to move money. The Reserve Bank of India is asking lenders for evidence that existing safeguards work, according to three people familiar with recent supervisory meetings.

The regulator has focused on application programming interfaces, or APIs, which connect banks with non-bank lenders and technology providers. These links can make lending faster and more convenient, but compromised credentials or weak controls may give attackers a route into payment systems. The RBI has also sought information on banks' preparedness for threats involving artificial intelligence.

The renewed attention follows several incidents. State Bank of India reported a leak affecting information belonging to 3,900 customers and said it was investigating the cause. Separately, two Mumbai-based non-bank lenders lost about $2 million through more than 700 unauthorised instant transfers from accounts held at ICICI Bank on 8 and 9 October, according to a police complaint.

That complaint said attackers compromised an API used to issue loan-disbursement instructions. India's cybersecurity agency, CERT-In, has also warned that stolen API credentials could be used to remove funds, possibly with AI-assisted techniques. The warning puts ordinary access credentials, rather than only sophisticated malicious software, at the centre of the risk. It recently provided cybersecurity training for 300 officials drawn from more than 55 financial institutions.

For the banking industry, the lesson is that security increasingly depends on the weakest connection in a network of partners. Monitoring a bank's own systems is insufficient if external applications can trigger transactions. Stronger authentication, vendor oversight and timely checks could become more central to maintaining customer confidence and limiting losses.

The sources said the RBI's existing cybersecurity rules were not always being implemented effectively. The central bank and ICICI Bank had not immediately commented on the reported discussions. With digital transactions expanding, the immediate priority is to turn established requirements into protections that hold under attack.