RBI Orders Banks to Audit API Security After AI-Driven Fraud Wave

By Daniel Okafor

Frauds of Rs. 3 crore to Rs. 15 crore each pushed the Reserve Bank of India into a rare, nearly two-hour meeting with bankers on November 3. The regulator then issued a confidential advisory the same day, mandating annual security audits of API arrangements and hard deadlines banks cannot ignore, according to an exclusive report by Head and Tale's Arti Singh. This appears to be the first such meeting since CERT-In began publishing advisories on AI-assisted attacks.

One banker present told the reporter the RBI "gave banks a dressing down" and stressed that lenders bear responsibility for securing these arrangements. That banker added that the sheer number of attack attempts worried banks more than individual fraud sizes.

What does the advisory actually require?

The RBI reportedly directed banks and their NBFC clients toward a long list of controls, each with dates attached:

• Full API client inventories, capturing business profiles, transaction limits, integration details and security contacts.
• CERT-In-empaneled audits — approved auditors under the Ministry of Electronics and Information Technology — completed before onboarding any new NBFC. Existing clients have until February 3, 2027.
• Annual audits at minimum, repeated after any material cyber incident, with non-compliance tracked.
• Risk assessments and periodic audits within three months for business correspondents, payment aggregators, payment service providers and fintechs — sooner if risk warrants.
• Threat briefings to all API clients every three months.

How tight are the transaction controls?

Tighter than most banks will find comfortable. The advisory reportedly brings API transactions under fraud-risk frameworks with per-client thresholds and behavioural baselines. Banks must flag volume or value spikes, transactions just below limits, odd-hour and holiday activity, bursts of new beneficiaries, mule patterns, failed logins and invalid API requests. They must also monitor changes in user-agent, app version, OS and network attributes, with technical changes due by December 3.

Beneficiary whitelisting becomes mandatory. Banks must pre-register verified end-customer accounts, reject unregistered payouts and allow changes only through a separate MFA-protected channel. Maker-checker or out-of-band confirmation is required for API debit requests.

The deadlines stack up quickly. Per-transaction and daily cumulative limits take effect immediately. Intra-day or velocity limits fall due within one month, with material limit increases requiring documented risk assessment. Regulated entities using API-based fund transfers must deploy at least one safeguard, with new integrations compliant before go-live and existing ones until December 3, 2026. Narrow exceptions demand a written application and documented risk assessment. Debit information must be available fast enough for one-by-one reconciliation.

Note what the advisory does not say. The RBI has not publicly released its text, so every requirement above rests on a single anonymous banker's account relayed through one outlet.

Who is behind the attacks?

CERT-In's November 4 advisory named a threat actor, "CRAFTY FALCON." The agency said attackers tested fund flows with Rs. 1 transfers before executing larger transactions and bypassed IP allow-listing by routing traffic through shared third-party IP pools. CERT-In recommended beneficiary cooling periods and maker-checker approval for merchant settlements.

The following day, November 4, the Indian Cyber Crime Coordination Centre under the Ministry of Home Affairs issued a public advisory on AI-assisted attacks on banks, NBFCs and fintechs. CERT-In also released AI Security Auditing Guidelines the same day.

What does CERT-In's chief say?

Director General Dr Sanjay Bahl, in written answers to MediaNama on November 2 and 3, identified the core problem: "delegated authority without commensurate guardrails and that AI agents are being trusted faster than they are being secured." His interview predates the advisory's disclosure.

He also framed the defensive challenge in one sentence: "What would change is the speed, scale and level of automation at which cyber activities take place. Defensive capabilities would therefore need to evolve accordingly from human-speed monitoring and manual containment to continuous, automated machine-speed defence."

How bad is India's breach backdrop?

Recent incidents explain the regulator's urgency:

• CoinDCX confirmed a loss of about Rs. 152 crore after first dismissing breach reports.
• Central Bank of India alleges hackers siphoned Rs. 13.97 crore through its financial messaging system, with 187 transfers untraceable.
• SBI confirmed a suspected breach of 3,897 customer records; customers were informed by email or WhatsApp.
• AU Small Finance Bank is probing a "potential data leak" on a Salesforce-hosted platform after hackers claimed a breach.
• CBFC reportedly exposed scripts, distribution deals and censorship records for over 500 films.

CERT-In also disclosed that AI agents accessed live Indian systems without authorisation during research and evaluation. Anthropic, separately, said its Claude model found vulnerabilities across Chrome, Android, Windows and Linux — but disclosed neither success rates nor computing costs. A promise of offensive capability without cost data deserves scrutiny, not applause.

Banks now have calendars, not suggestions. February 3, 2027 is the outer boundary; the first month brings velocity limits. Whether audits find anything before attackers test another Rs. 1 transfer remains the open question.