Why RBI’s .bank.in Initiative Must Not Remain a Half-Finished Exercise: A Consumer Protection Perspective
Executive Summary
The Reserve Bank of India (RBI), through Circular No. RBI/2025-26/28 dated 22 April 2025, has directed all commercial banks, cooperative banks, and district cooperative banks operating in India to migrate their digital presence to the exclusive “.bank.in” domain framework on or before 31 October 2025.
The initiative is said to be part of RBI’s broader strategy to strengthen cybersecurity resilience, curb phishing and online fraud, establish a trustworthy digital identity ecosystem for regulated entities, and enhance public confidence in digital banking channels.
The migration to the exclusive “.bank.in” domain is not merely a technical or administrative exercise. It represents a significant regulatory intervention aimed at protecting customers from illusive/deceptive digital practices, email spoofing, fraudulent websites, and other cyber threats.
Accordingly, every regulated bank was expected not only to undertake domain migration but also to ensure transparent customer communication and the implementation of robust authentication mechanisms.
Failure to effectively implement these requirements in their entirety would expose customers to confusion, misinformation, fraudulent activities, and potential financial losses.
Promise of a Safer Digital Banking Ecosystem
India’s banking sector is experiencing an unprecedented digital transformation. Crores of customers now conduct banking transactions through internet banking portals, mobile applications, emails, UPI platforms, and digital payment systems. While digital banking has brought convenience, it has also created fertile ground for cyber fraudsters, identity thieves, and impersonators.
Recognising these risks, the Reserve Bank of India (RBI) introduced a significant cybersecurity and customer protection initiative in April 2025 by directing banks to migrate their digital infrastructure to the exclusive “.bank.in” domain ecosystem.
The intention behind this move was simple yet powerful:
If every legitimate bank communication originated from a standardised and RBI-recognised “.bank.in” domain, customers could easily identify genuine banking communications and distinguish them from fraudulent messages.
The initiative was widely welcomed by cybersecurity experts, banking professionals, and consumer rights advocates because it promised to establish a trusted digital framework for the Indian banking sector.
However, an important question now arises:
After 7 months, has the initiative been fully implemented in the spirit intended by the RBI?
For many customers, the answer appears to be uncertain.
What was RBI’s intent?
The RBI’s domain migration initiative was not merely about changing website names.
Its broader objectives included the following:
- Creating a uniform and trusted banking identity.
- Reducing phishing and impersonation attacks.
- Strengthening digital trust among customers.
- Enhancing cybersecurity.
- Simplifying identification of genuine bank communications.
- Protecting customers from increasingly sophisticated cyber frauds.
In theory, a customer receiving an email from:
customercare@xyz.bank.in
would immediately recognise it as authentic.
Conversely, suspicious communications from unrelated domains could be easily identified and ignored. Such standardisation would reduce the number of successful phishing attempts via email.
The Ground Reality: Multiple Domains Continue to Exist
More than a year after the RBI initiative was announced (seven months from expiry of the deadline to migrate to a new domain), many banking customers continue to encounter email communications originating from a variety of domain structures, including:
- .com
- .co.in
- .in
- .bank
- Other legacy domains
In several cases, banks may have migrated selected customer-facing portals (including core banking) to “.bank.in” while continuing to operate other critical communication systems on older domains.
Customers continue receiving:
- OTP communications
- Transaction alerts
- Account notifications
- Promotional emails
- Service updates
- Authentication messages
from a mixture of different domain formats.
A promotional message coming as an email from a non “.bank.in” domain could also lead to fraud if the receiver acts on it, assuming it is authentic.
This creates confusion rather than certainty.
Why This Matters to Ordinary Consumers like us
Many banking customers are not cybersecurity experts.
The average customer cannot be expected to understand:
- Domain authentication protocols
- Email security standards
- DNS records
- SPF and DKIM validation
- SSL certificates
- Anti-phishing mechanisms
When banks communicate from multiple domains simultaneously, customers are forced to make difficult judgments regarding authenticity.
This defeats one of the primary objectives behind the RBI initiative.
Example 1: The OTP Email from a domain other than the “.bank.in” domain
Imagine a customer receives an OTP email from the following:
otp@securebank.com
while the bank’s website prominently advertises:
www.securebank.bank.in
The customer may legitimately wonder the following:
“Is this OTP genuine, or is somebody trying to steal my credentials?”
This uncertainty may cause either:
- Avoidance of legitimate banking transactions, or
- Acceptance of fraudulent communications.
Both are undesirable. However, this is a very common situation.
Example 2: The Phishing Trap
Suppose a fraudster sends an email from:
support@secure-bankindia.com
claiming:
“Your account will be blocked within 24 hours due to ______ . “Click here immediately to avoid blocking of account.”
If legitimate bank communications already originate from several different domains, customers may find it difficult to distinguish between genuine and fraudulent messages.
Fraudsters thrive in such ambiguity. Despite the passage of over 1 ¼ years of issuance of directives and 7 months from the expiry of the deadline to implement the directives, many banks have not moved their net banking to the domain advised. Several banks have not moved the emails to the new domain.
The entire purpose of a standardised domain framework and announcing a cut-off line was to eliminate this confusion and associated uncertainty.
Example 3: Senior Citizens at Risk
Senior citizens are among the most vulnerable banking customers.
A retired pensioner may receive:
- A transaction alert from one domain.
- A promotional email from another.
- A credit card communication from a third.
- An internet banking alert from a fourth.
Expecting such customers to determine which communication is genuine is unrealistic.
A fully implemented “.bank.in” ecosystem would greatly simplify trust verification.
However, currently, in 5-10% of cases, all customer-centric communication comes from the “.bank.in” domain.
Partial Compliance Can Create False Comfort
Perhaps the greater concern is not outright non-compliance but partial compliance.
Some institutions may have:
- Migrated their primary core banking website.
- OTP or transaction failure/success notification from other than “.bank.in”.
- Introduced selected communications from “.bank.in” portals.
However, if customer communication systems continue operating through legacy domains, customers may wrongly assume that complete migration has occurred.
This creates what may be described as an “appearance of compliance” rather than actual realisation of the security objectives of RBI behind the new framework.
In some cases, customers may even visit a “.bank.in” website only to be redirected to older domain structures during transactions. While technically appears functional, such arrangements dilute the intended security benefits. In such cases internet banking customers are able to log in using both domains. I am not sighting names of such banks that have carried out an ‘eye-wash exercise’ to satisfy the RBI.
Cyber Fraud Is Becoming More Sophisticated
The urgency of this issue becomes apparent when viewed against the backdrop of rapidly evolving cybercrime.
Fraudsters use:
- Artificial intelligence-generated content.
- Spoofed email addresses.
- Fake websites.
- Voice cloning technologies.
- SMS impersonation.
- Social engineering attacks.
Fraudulent communications increasingly resemble genuine banking correspondence.
As criminals become more sophisticated, customers need not more complicated methods of verifying authenticity.
The “.bank.in” framework offers exactly such a mechanism, only if implemented strictly and comprehensively.
Why RBI Must Look Beyond Websites
Compliance assessment should not be restricted to checking whether a bank has migrated its homepage.
A meaningful review should examine whether the following systems have also migrated:
Email Infrastructure
Customer service emails, account communications, service notices, and regulatory disclosures.
OTP Systems
Authentication and transaction verification messages.
Transaction Alert Platforms
Debit alerts, credit alerts, card transactions, and account activity notifications.
Push Notifications
Push notifications and digital communication systems.
Customer Authentication Frameworks
Password resets, login verification, and identity confirmation processes.
Only then can regulators determine whether migration has been completed in substance rather than merely in appearance.
What Customers Deserve
Banking customers deserve clarity.
They should not have to wonder:
- Which domain is genuine?
- Which email can be trusted?
- Is an OTP message authentic?
- Whether a transaction alert is legitimate
A customer should be able to understand the following:
“If it originates from the authorised “ .bank.in” ecosystem, can it be trusted?”
Measures RBI Could Consider
To fully realise the benefits of the initiative, the RBI may consider the following:
1. Compliance Audit
A comprehensive review of actual implementation status across all regulated entities.
2. Public Compliance Certification
Banks should compulsorily disclose their full migration to “ .bank.in” publicly, as mandated by the RBI. Banks should specify that Migration of all customer-facing systems has taken place. Not merely websites, but all communication infrastructure.
3. Customer Awareness Campaigns
Educating customers about how to identify genuine bank domains and e-communications (emails, also SMS of different types, namely service, publicity, transaction, etc.)
4. Enforcement Action/Levy of penalty
Where implementation timelines have expired without satisfactory compliance.
A Consumer Protection Issue, Not Merely a Technology Project
The “.bank.in” initiative should not be viewed as a routine technology migration.
It is fundamentally a:
- Consumer protection, Cybersecurity and Trust-building initiative.
Its success must be measured not by the number of websites migrated but by whether customers can confidently identify authentic banking communications.
Conclusion
The Reserve Bank of India deserves credit for conceiving a forward-looking initiative aimed at strengthening trust and security in India’s digital banking.
However, the true value of any regulatory reform lies not in the issuance of directives but in their effective implementation.
As cyber frauds continue to rise and fraudsters become increasingly sophisticated, incomplete implementation risks weaken the very protection that the initiative was designed to provide.
For crores of Indian banking customers, a fully yet quickly implemented and uniformly enforced “.bank.in” ecosystem could become a powerful shield against digital fraud.
The time has come for rigorous implementation of the directive, ensuring transparent (not eye-wash) compliance and coordinated regulatory oversight to ensure that the promise of the “.bank.in” framework translates into meaningful protection for every internet banking customer in India.
I have listed some banks that have not complied, those that have complied partially, who did an eye-wash exercise and so on. Since the object of this article is not to specify the names of banks that are non-compliant (as of the date). I have sent RBI a separate communication highlighting associated aspects.
Like few other initiatives, I am afraid that due to supervisory failure, lack of coordination between RBI’s departments, absence of proper guidance, absence of strict oversight of RBI, and considerable dependence on IDRBT, the intended object of creating a safer, more trustworthy, and more secure digital banking environment should not fail.
******
Shivaprasad Laxman Chhatre | Email: chhatres@yahoo.co.in Mobile: 9819380114
Disclaimer: The views, opinions, observations, and suggestions expressed in this article are solely those of the author and are based on information available at the time of writing. The article is intended for informational and academic discussion purposes only and should not be construed as legal, regulatory, financial, or professional advice. Taxguru.in does not independently verify the accuracy, completeness, or correctness of the facts, allegations, or opinions expressed herein and shall not be responsible for any loss or damage arising from reliance on the contents of this article. Readers are advised to seek appropriate professional advice and refer to the relevant laws, regulations, circulars, and official communications before taking any action.
Author Bio
