The Reserve Bank of India (RBI) has directed banks, payment system operators and other regulated financial entities to treat their technology environments as compromised until forensic checks establish that they are secure following any exposure of credentials or confirmed unauthorised access.
What Has RBI Directed?
The RBI issued the advisory on shortly after the Indian Computer Emergency Response Team (CERT-In) warned about the growing use of artificial intelligence agents in cyberattacks.
Financial institutions have been instructed to strengthen cybersecurity controls across their internal systems and third-party service providers. The measures are intended to prevent attackers from exploiting compromised credentials, vulnerable applications and weaknesses in connected technology infrastructure.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
What Security Changes Are Required?
The RBI has asked financial entities to remove management and administrative interfaces from public internet access and enforce multi-factor authentication for administrative accounts.
Access to cloud and backend systems must follow the principle of least privilege, limiting permissions to those necessary for authorised operations.
Institutions must also audit source code, repositories, configuration files, client applications and cloud storage for exposed credentials. Compromised credentials should be immediately rotated and purged.
How Will Payment Systems Be Protected?
Regulated entities have been directed to maintain inventories of application programming interfaces (APIs) and shut down dormant, deprecated and test APIs and accounts.
The RBI has also called for stronger real-time monitoring of APIs to detect unusual activity, including sudden bursts of automated requests, large-scale data extraction and suspicious account registrations.
Institutions have been asked to report relevant cybersecurity incidents to the RBI’s central office and regional offices within stipulated timelines.
Why Are AI Attacks Raising Concerns?
On October 15, CERT-In warned that attackers were increasingly using autonomous AI tools to identify vulnerabilities, execute commands and exploit security weaknesses without continuous human intervention.
The agency said AI-driven attacks had reduced the time between initial access and final impact from days to a few hours.
Attackers were reportedly using multiple AI agents simultaneously to conduct reconnaissance, exploit vulnerabilities and access sensitive information.
What Has CERT-In Found?
CERT-In reported that several Indian organisations were unaware that AI agents had accessed their systems. Some incidents involved AI model providers making voluntary disclosures after their systems accessed live business records, personal information and confidential data beyond their assigned authorisation.
The warning followed cybersecurity incidents affecting Indian financial and technology organisations. Earlier reports indicated that approximately 20 financial institutions had been targeted through stolen partner-bank credentials and vulnerabilities in payment and disbursement APIs.
The420 Insight: What Does This Mean?
The RBI’s advisory highlights the growing importance of continuous monitoring, strict access controls and forensic verification across financial infrastructure.
Banks and payment firms must examine not only their own systems but also third-party connections, exposed credentials and APIs. As AI tools accelerate cyberattacks, identifying unauthorised access quickly and restricting compromised systems will be essential to limiting financial and data-related risks.
About the author — Ayesha Aayat writes on cybercrime, digital safety, and emerging online threats. Her work focuses on public awareness, legal clarity, and technology-driven risks.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
