ETCISO reports RBI tightens scrutiny of bank APIs after fraud incidents

What happened

According to ETCISO, published on November 5, 2026, a series of incidents involving Indian banks, NBFCs and fintech platforms has led the Reserve Bank of India (RBI) and cybersecurity agencies to step up scrutiny of financial institutions’ technology. This advisory rests on that single article. We have not reviewed the RBI, CERT-In or I4C advisories directly, so every claim below is ETCISO’s account of them.

ETCISO says that on November 4 the Indian Cyber Crime Coordination Centre (I4C) and CERT-In warned financial institutions about financially motivated attacks involving AI agents. Per ETCISO, the incidents behind the warnings are:

• SBI data exposure: ETCISO reports that State Bank of India disclosed on October 21 that 3,897 customer records had been exposed on the dark web. The records reportedly held names, mobile numbers, dates of birth, email and residential addresses and loan-related information. ETCISO says SBI stated that customer balances were safe, that there was no material impact on operations, and that it engaged an independent agency to investigate.
• NBFC fraud: ETCISO says two Mumbai-based NBFCs lost around $2 million through more than 700 unauthorised instant transfers on October 8 and 9. It attributes to a police complaint reviewed by Reuters the claim that hackers compromised the API used to send loan disbursement instructions to ICICI Bank.

On the attack method, ETCISO says an October 9 CERT-In advisory describes attackers using vulnerabilities in internet-facing applications, exposed APIs and privileged access to enter networks and steal credentials. They then reportedly call payment and disbursement APIs from inside the institution’s own authorised infrastructure. Separately, ETCISO says CERT-In’s November 4 advisory named the actor behind the latest campaign CRAFTY FALCON and reported use of publicly available AI offensive tools (ARTEX, PentAGI, Cairn and CyberStrikeAI). Per ETCISO, that campaign tested payment routes with transactions as small as Rs 1 and was timed for weekends and holidays.

Not confirmed: the article does not say whether the SBI exposure and the NBFC fraud are linked to CRAFTY FALCON. It gives no independent verification of the attribution, and the outcome of the SBI investigation is not stated.

Am I affected?

ETCISO’s account is aimed at banks, NBFCs, digital lending platforms, fintech companies, payment service providers and wallet operators in India, along with their technology vendors. You are most likely in scope if you operate or connect to payment or loan disbursement APIs.

According to ETCISO, the October 9 CERT-In advisory identifies these weaknesses as exploited by attackers:

• long-lived API tokens hard-coded into source code
• plaintext credentials in configuration files and databases
• deprecated APIs
• applications without multi-factor authentication

ETCISO attributes different findings to CERT-In’s November 4 advisory: attackers targeting cloud infrastructure, exploiting exposed testing environments, and using shared credentials to move from non-production systems into live production environments.

ETCISO does not list affected software versions, and no CVE identifiers are given. Whether any specific product is vulnerable is not confirmed.

What to do now

The steps below are the measures ETCISO attributes to RBI, I4C and CERT-In. They are not independently verified here.

1. Inventory your APIs and shut down dormant, deprecated and testing interfaces (RBI, per ETCISO).
2. Remove administrative interfaces from public internet access and enforce multi-factor authentication for administrative access (RBI, per ETCISO).
3. Restrict cloud and backend access on a least-privilege basis, and audit source code and configuration files for exposed credentials (RBI, per ETCISO).
4. After credential exposure or confirmed unauthorised access, treat the environment as potentially compromised until forensically cleared (RBI’s October 19 advisory, per ETCISO).
5. Isolate testing environments from production, strengthen authentication of third-party providers, and monitor transactions around the clock, especially on weekends and holidays (CERT-In, per ETCISO).
6. Consider daily and per-transaction payment limits, beneficiary-name verification and monitoring of unusually rapid transactions (I4C, per ETCISO).
7. Report incidents to CERT-In within six hours of detection. Banks and NBFCs must also report to RBI through its DAKSH portal within the same period (November 4 advisory, per ETCISO).
8. Read the primary RBI, CERT-In and I4C advisories for exact requirements, since this summary relies on a news report of them.

Sources

• ETCISO: RBI intensifies scrutiny on banks amid rising cyber fraud incidents involving AI and vulnerabilities