RBI Cybersecurity Advisory Highlights Risks from AI Driven Attacks

A report published on October 23 says the Reserve Bank of India has asked banks and other regulated financial organisations to strengthen their cybersecurity as attackers use AI tools to find and exploit weaknesses faster. The report links the advisory to a CERT-In warning issued on October 15. The RBI advisory itself was not available in the material provided, so its details should be confirmed against an official RBI notice before publication.

As reported, the guidance asks financial organisations to review systems after credentials are exposed, keep administrative interfaces off the public internet and require multi-factor authentication for administrator accounts. It also highlights limiting access to what staff need, checking code and cloud storage for exposed passwords or API keys, rotating compromised credentials, closing unused APIs and watching for unusual bulk requests or data extraction. These measures can help reduce the chance that one stolen account becomes a wider breach.

Customers may not see the APIs and partner systems behind a banking app, but weaknesses in those connections can put personal information and payments at risk. Small businesses face similar concerns when they connect to banks, payment gateways or lending services, particularly if they store access keys in code or shared files. AI may speed up attacks, but strong account controls and careful handling of credentials remain practical safeguards.

Customers should use unique passwords, enable multi-factor authentication where available, turn on transaction alerts and check account statements. Never share an OTP or install an app at a caller’s request. If you suspect financial fraud, contact your bank promptly and report it through India’s cybercrime helpline at 1930. Businesses should secure administrator, email and cloud accounts with MFA, rotate exposed credentials, disable unused integrations, keep systems updated and have a clear incident-reporting plan.

These precautions also depend on protecting the devices people use to access accounts and business systems. NPAV’s Total Security lists anti-phishing protection, while its Admin Console Corporate Edition Endpoint Security offers centralised security management and device controls for organisations. These endpoint products do not secure a bank’s APIs, but they can help protect the computers used to connect to online services.