The Reserve Bank of India (RBI) has announced a series of measures to curb online fraud and enhance digital payment security. During his first monetary policy review meeting, RBI Governor Sanjay Malhotra unveiled plans for an exclusive ‘bank.in’ domain for Indian banks, a ‘fin.in’ domain for non-banking entities, along with an extension of Additional Factor of Authentication (AFA) to international digital payments.
Registration for the ‘bank.in’ domain will begin in April followed by registrations to ‘fin.in.’ Currently, AFA is mandatory for domestic transactions, and after the recent monetary policy meeting, it will be extended to online payments made to offshore merchants that support the authentication process.
Recognising the cyber threats amid rapid digitalisation, Malhotra emphasised the need for banks and NBFCs to continuously strengthen their preventive and detective controls. He urged financial institutions to develop robust incident response mechanisms and conduct periodic testing to ensure operational resilience.
“Increased instances of fraud in digital payments are a significant concern. To combat the same, the Reserve Bank of India (RBI) is introducing the ‘bank.in’ exclusive Internet Domain for Indian banks. This initiative aims to reduce cyber security threats and malicious activities like phishing; and, streamline secure financial services, thereby enhancing trust in digital banking and payment services,” RBI said.
According to Business Standard, the Institute for Development and Research in Banking Technology (IDRBT) has been designated as the exclusive registrar of these domains.
RBI will release detailed guidelines for banks concerning these new domains shortly.
India is a hub of cyberattacks. In 2024, India recorded 369 million cyber attacks at an average of 702 per minute. The BFSI (Banking, Financial Services, and Insurance) is India’s second most targeted sector after healthcare.
Recently, an Android banking malware targeted more than 50,000 Indian users via a malicious WhatsApp APK. Last year, a new scam called ‘SBI Rewards’ was targeting Indian citizens.
In the News: Gravy Analytics sued for exposing smartphone coordinates
