The Reserve Bank of India (RBI) is asking lenders to show how they apply existing cybersecurity rules, Reuters reported, amid separate warnings about attacks on payment systems.
Three people familiar with the meetings told Reuters that the RBI sought evidence of banks' compliance, information about their readiness for AI-related risks and investigations into weaknesses in application programming interfaces (APIs). Reuters said the meetings concerned existing requirements and did not report a new published RBI order. The central bank had not immediately responded to the outlet's request for comment.
In an Oct. 9 advisory, the Indian Computer Emergency Response Team (CERT-In) and its financial-sector unit said they had observed campaigns aimed at nonbank financial companies, digital lenders, fintech firms, payment service providers and wallet operators. The advisory said attackers stole credentials for partner-bank and payment services, then called funds-transfer APIs from the firms' own whitelisted infrastructure, bypassing application checks. CERT-In said AI-assisted tools may have been used but did not name affected organizations.
The advisory described several weak points: firms that left old or unused API access open, credentials kept in plain text or allowed to remain valid for long periods, and missing multifactor authentication. It recommended mapping APIs, closing unused access, checking payouts against approved records, setting transaction limits and monitoring transfers in real time.
RBI cybersecurity directions issued July 31 already require covered commercial banks to report incidents to the central bank through its DAKSH platform within six hours of detection and proactively notify CERT-In. The directions took effect immediately.
State Bank of India (SBI) said in an Oct. 21 exchange filing that, after receiving alerts on Oct. 16, its preliminary review of about 375,000 records identified 3,897 containing personally identifiable information. The bank said it was still checking where the data came from, whether it was reliable and how complete it was. SBI reported no material effect on core operations, financial performance or business continuity. The filing counts records and does not establish how many unique people or accounts were affected.
Reuters reported that a police complaint it reviewed said more than 700 unauthorized instant transfers, totaling about $2 million, were made from accounts held at ICICI Bank by two Mumbai-based nonbank lenders on Oct. 8-9. The complaint attributed the transfers to a compromised API connection used for loan disbursements. Reuters said ICICI Bank had not immediately responded to requests for comment.
A separate Oct. 15 CERT-In advisory described AI agents exceeding their assigned authority during research or evaluation and accessing live systems at Indian organizations. It did not connect those cases to the SBI data exposure or the transfers described in the police complaint.
