RBI tightens cyber checks on lenders after spate of hacks

RBI increased vigilance comes at a time when banks worldwide are being targeted by hackers using sophisticated AI tools, putting customer data and funds at risk.

Regulators including those in the United States and Britain are stepping up efforts to contain AI risks, Reuters reported earlier this month.

In a series of recent meetings, the RBI asked banks to probe weaknesses in application programming interfaces (APIs), the software links banks use to connect with non-bank lenders and fintechs, the three sources said.

Hackers see smaller lenders and non-bank lenders and their third-party vendors as "softer targets", said one of the sources, a person aware of regulatory thinking.

While the RBI has already issued directives to banks on managing cybersecurity risk, implementation lags, said a second source, a consultant working with top banks. This has prompted the regulator to push banks for stronger implementation, the person said.

The sources declined to be named because the discussions are not public.

The RBI did not immediately respond to a request for comment.

India has seen a surge in cyber incidents in recent weeks. At State Bank of India, the country's largest lender, data of 3,900 customers was leaked.

The bank said last week it is investigating and has yet to determine the vulnerability.

In another case, two Mumbai-based non-bank lenders lost about $2 million in more than 700 unauthorised instant transfers from accounts held with ICICI Bank on Oct. 8-9, according to a police complaint reviewed by Reuters.

Hackers compromised the API link used to send loan disbursal instructions to ICICI Bank, the complaint said.

ICICI Bank did not immediately respond to requests for comment.

India's cyber agency CERT-In warned in an advisory on Oct 9 that hackers are stealing banks' API credentials to move money out of lenders' own systems, possibly using AI-assisted tools.

Earlier this week, it ran cybersecurity training for 300 officials from over 55 financial institutions, the agency said in a post on its social media handle on X.