Why Banks Are Adopting the .bank.in Domain and What It Means for You?

The Reserve Bank of India (RBI) had mandated all banks in the country to migrate their website domains from commonly used suffixes like .com or .co.in to the exclusive .bank.in domain. This decisive step comes in response to the persistent threat of phishing scams and online fraud targeting digital banking customers, with a clear deadline for compliance set for October 31, 2025.

RBI’s Directive: Purpose and Implementation

The RBI’s official directive instructs that only RBI-regulated banks are permitted to use the .bank.in domain. This exclusivity is a critical cybersecurity measure, aiming to make fraudulent banking websites dramatically easier to identify and block. The Institute for Development and Research in Banking Technology (IDRBT), authorised by the National Internet Exchange of India (NIXI) and under the aegis of the Ministry of Electronics and Information Technology, serves as the exclusive registrar, as mentioned in the RBI Circular. Banks were required to contact the IDRBT to commence application and migration procedures, ensuring that only genuine, verified financial institutions could register for the new domain.

Background: The Rise of Phishing and Domain Spoofing

Before this mandate, banks typically operated sites with domains like .com, which are available for registration by anyone globally. Cybercriminals exploited this by creating lookalike domains (for example, using a ‘0’ instead of an ‘O’) to mimic legitimate bank websites, thereby deceiving customers into revealing sensitive credentials. Reports indicate that such domain spoofing and phishing attacks have become a leading cause of digital financial fraud in India, resulting in significant monetary losses for affected customers.

The Security Edge using Domains

The .bank.in domain provides a layer of exclusivity and security that goes well beyond generic web addresses. Only entities recognised and regulated by the RBI may register a .bank.in domain, effectively preventing miscreants from operating phishing portals with credible-seeming addresses. As a result, customers can now easily identify authentic banking sites and distinguish them from potentially malicious lookalikes.

Further, banks have been instructed to maintain their former domains with an automatic redirect to the new .bank.in address during the transition, helping users smoothly adapt to the change while minimising disruption.

Impact on Digital Banking Safety

This domain migration is expected to bring a measurable reduction in cyber threats, particularly phishing and website spoofing. Customers, payment aggregators, and tech platforms dealing with banking sites will now find it easier to verify the legitimacy of web addresses, fostering higher confidence in the safety of online banking. RBI’s move is regarded as a timely and proactive measure, especially as the digital banking landscape in India experiences rapid growth.

Customer Advice and Next Steps

With the change now in effect, all the bank customers need to double-check web addresses when conducting online transactions, ensuring they access only .bank.in websites for banking services. By October 31, 2025, all Indian bank websites are required to have completed the transition.

In summary, the RBI’s directive to shift all Indian banks to .bank.in domains is a significant move for digital trust and cyber safety. By drastically reducing the attack surface for scammers, this move is set to strengthen public confidence in India’s rapidly expanding digital financial ecosystem.