The RBI Cybersecurity Alert follows reports of increased Reserve Bank of India scrutiny after incidents involving exposed customer information, compromised payment connections and unauthorised financial transfers.
Reuters reported on October 30 that RBI officials are checking banks’ cybersecurity compliance, vendor risks and preparedness for AI-assisted threats. This represents closer supervision, not a newly announced cybersecurity rule.
Key Highlights
- Regulator: Reserve Bank of India (RBI).
- Security concerns: Banking APIs, vendors and unauthorised transactions.
- SBI incident: 3,897 customer records flagged for personal information.
- Reported fraud: Two Mumbai-based NBFCs allegedly lost about $2 million.
- CERT-In advisory: Payment API threats highlighted on October 9, 2026.
| Detail | Information |
|---|---|
| Reported | October 30, 2026 |
| Regulatory focus | Existing cybersecurity rules |
| Main risks | Payment APIs and vendors |
| Cyber agency | CERT-In |
Why Is RBI Tightening Cybersecurity Scrutiny?
Banks use application programming interfaces (APIs) to connect payment processors and lenders. Weak security at connected providers can enable unauthorised instructions or data access.
Reuters reported RBI questions about security controls and vendors, with smaller institutions facing particular challenges.
What Cybersecurity Rules Already Apply?
The RBI issued its Commercial Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026 on July 31, later updated in October.
The framework covers security governance, testing, vendors and incident response. Covered banks must meet incident-reporting obligations, including through RBI’s DAKSH platform.
This is distinct from the reported October 30 supervisory checks.
What Happened in the SBI Data Incident?
SBI examined approximately 375,000 records reportedly circulating on the dark web and identified 3,897 records containing personal customer information. The bank investigated the suspected exposure and said it had contacted affected customers.
SBI said funds remained safe and core operations were unaffected. The exposure raises phishing risks but does not establish theft from customer accounts. Customers should verify any notification through official SBI channels instead of clicking unexpected links or sharing account details.
How Were Mumbai-Based Lenders Targeted?
Reuters cited a police complaint alleging two Mumbai-based NBFCs lost around $2 million through over 700 unauthorised transfers on October 8–9.
Attackers allegedly compromised an API used to transmit loan-disbursement instructions to ICICI Bank. This allegation concerns a payment integration; it does not establish that ICICI Bank’s core systems were breached.
CERT-In warned on October 9 that stolen API credentials and compromised applications could allow fraudulent transfers through apparently trusted connections. This makes authentication alone insufficient: institutions must also verify whether loan instructions and intended beneficiaries are legitimate.
How Can Banks Reduce Payment API Risks?
CERT-In recommends authentication, protected credentials, independent payment checks and transaction monitoring.
Banks should validate beneficiaries, reconcile records and disable compromised access promptly.
What Should Bank Customers Do?
Customers should monitor alerts, avoid suspicious links, protect OTPs and PINs, and report fraud immediately.
Contact your bank and report cybercrime through 1930 or cybercrime.gov.in. Keep transaction and complaint records.
Are Customers Responsible for Unauthorised Transfers?
Under RBI customer-protection rules, liability depends on the cause of the transaction and the reporting delay.
| Circumstance | General Liability Position |
|---|---|
| Bank negligence | Zero customer liability |
| Qualifying third-party breach reported within 3 working days | Zero liability |
| Reported within 4–7 working days | Limited liability under RBI rules |
| Reported after 7 working days | Bank’s approved policy applies |
| Customer shared credentials | Customer liable until reporting |
Reporting periods start when customers receive bank transaction communication. Eligible cases require provisional credit within 10 working days; NBFC corporate losses are treated separately. Where customers negligently share credentials, they generally bear losses until reporting the incident; subsequent losses are borne by the bank, subject to RBI conditions.
Eligible unresolved complaints can be escalated at cms.rbi.org.in, subject to Ombudsman Scheme conditions.
Conclusion
The RBI Cybersecurity Alert reporting highlights growing concerns about digital banking security following recent incidents involving customer data exposure and unauthorized financial transactions. The Reserve Bank of India’s increased scrutiny underscores the importance of stronger API security, third-party risk management and compliance with existing cybersecurity regulations.
For banks and financial institutions, effective security monitoring and timely incident response remain essential. Customers should also protect their banking credentials, monitor account activity and report suspicious transactions immediately to reduce potential financial losses.
