RBI Tightens Cybersecurity Oversight as AI-Driven Bank Attacks Rise

The Reserve Bank of India (RBI) has escalated its examination of the cybersecurity measures implemented by banks, responding to a growing wave of attacks exploiting artificial intelligence (AI) tools against financial institutions. According to three individuals familiar with the matter, the central bank is demanding evidence of adherence to current cybersecurity regulations and requesting detailed information on how banks are preparing to counter AI-related threats.

This move by the RBI aligns with a broader global trend where regulators in countries such as the United States and the United Kingdom are intensifying efforts to mitigate risks posed by AI-powered cyberattacks. As financial systems become more interconnected and reliant on digital platforms, hackers are increasingly targeting vulnerabilities in these infrastructures to gain unauthorized access to sensitive customer data and financial assets.

In recent discussions with banking officials, the RBI has urged scrutiny of application programming interfaces (APIs), which serve as critical software bridges connecting banks with non-bank lenders and fintech companies. These APIs have been identified as potential weak points, as cybercriminals often view smaller financial entities and their third-party partners as easier targets for exploitation.

One source, knowledgeable about regulatory perspectives, described these smaller lenders and their associated vendors as "softer targets" for cyber intrusions. Despite existing RBI directives aimed at managing cybersecurity risks, implementation across many banks has lagged behind expectations. This has prompted the regulator to push for more stringent enforcement and improved cybersecurity practices, according to a consultant working with leading banks.

The RBI has not publicly commented on these developments. However, recent cyber incidents in India underscore the urgency of its actions. For instance, the State Bank of India, the country’s largest lender, recently disclosed a data breach affecting approximately 3,900 customers. The bank is still investigating the source of the vulnerability.

Additionally, two non-bank lenders based in Mumbai reported losses of nearly $2 million following over 700 unauthorized instant fund transfers from accounts held at ICICI Bank on October 8 and 9. A police complaint indicates hackers exploited the API link responsible for loan disbursement instructions to ICICI Bank, allowing these fraudulent transactions to occur. ICICI Bank has not issued an immediate response to inquiries regarding the incident.

India’s national cyber agency, CERT-In, issued a warning on October 9 highlighting that cybercriminals are stealing API credentials from banks to move funds illicitly from their systems. The advisory also mentioned the potential use of AI-enhanced tools in these attacks. In an effort to strengthen resilience, CERT-In recently conducted cybersecurity training sessions for 300 officials representing more than 55 financial institutions, aiming to enhance their preparedness against such threats.

The increasing sophistication of cyber threats targeting the financial sector reflects a global challenge as banks adopt more advanced technologies and digital services. Regulators worldwide are now focusing on ensuring that financial institutions not only comply with existing security standards but also remain vigilant and agile in addressing emerging risks, particularly those involving AI.

As India’s banking sector continues to evolve with the integration of fintech and digital lending platforms, maintaining robust cybersecurity protocols will be critical in safeguarding customer data and financial assets. The RBI’s heightened oversight signals a commitment to fortify the country’s financial infrastructure against the growing menace of AI-driven cyberattacks.