The RBI has stepped up its scrutiny of banks’ cyber defences after a run of attacks on Indian lenders, asking for proof that they comply with existing rules and for details of how ready they are for risks from artificial intelligence, Reuters reported on Friday, October 30, citing three people familiar with the matter.
In a series of recent meetings, the central bank asked banks to look for weaknesses in their application programming interfaces (APIs), the software links that connect them with non-bank lenders and fintech companies for services such as loan disbursals. One source said hackers see smaller lenders, non-bank lenders and their third-party vendors as softer targets. A consultant who works with large banks said the RBI already has cybersecurity directions in place, but banks have been slow to implement them.
The push follows several incidents this month. Data of 3,900 State Bank of India customers leaked, and the bank said it had not yet found the cause. Two Mumbai-based non-bank lenders lost about $2 million through more than 700 unauthorised instant transfers from their ICICI Bank accounts on October 8 and 9, after hackers compromised the API link used to send loan disbursal instructions, according to a police complaint. CERT-In warned on October 9 that attackers were stealing banks’ API credentials, possibly with AI tools.
Why it matters: Much of India’s digital lending runs on these bank-to-partner connections, so tighter API controls land on fintechs and NBFCs as much as on banks. Expect banks to ask partners for more audits, stricter credential handling and limits on what each connection can do, which raises costs for smaller lenders. With the Supreme Court also pushing to make banks pay for fraud losses, banks have more reason to drop partners whose security they cannot verify.
Source: Business Standard (Reuters); CNBC-TV18
Image: ProjectManhattan, CC BY-SA 3.0, via Wikimedia Commons
