The Reserve Bank of India met bankers for nearly two hours on Wednesday, MediaNama reported on November 6. It cited Head and Tale's Arti Singh, who reported a confidential advisory dated November 3. A banker said individual frauds ran from Rs. 3 crore to Rs. 15 crore. The advisory reportedly asks NBFCs (non-bank lenders) that use APIs to pass an audit by a CERT-In empaneled auditor. New clients need it before onboarding. Existing ones have until February 3, 2027.
The advisory is confidential, so this rests on Head and Tale's reporting. On November 4, CERT-In named a group, CRAFTY FALCON. It said the group made tiny Rs. 1 payments as a trial run for larger ones. It also said the group got past IP allow-lists by sending traffic through shared third-party IP pools. MediaNama's report does not say how AI was used, or that the advisory answers these attacks.
This is our reading, not the report's. An allow-list checks the network path, not intent. Beneficiary whitelisting, reportedly required, checks where money goes. Approval on a separate channel checks that someone authorised the debit. Neither depends on the source address. Banks and NBFCs could ask: which integrations rely on allow-lists alone? Can we add a safeguard by December 3, 2026? Are our API clients audited by February 3, 2027?