ICICI Bank moves net banking to .bank.in and adds CAPTCHA protection
ICICI Bank has shifted its website and net-banking portal to RBI-mandated .bank.in domains, while retaining existing customer login credentials. The bank has also added CAPTCHA security and flagged a planned iMobile maintenance window for September 19, 2026.
What happened
ICICI Bank moved its website and net banking portal to RBI-mandated .bank.in addresses, retaining existing login credentials. It also added CAPTCHA protection
Key facts
- September 19, 2026
- April 22, 2025
- October 31, 2025
Why this matters
The RBI-mandated domain shift reinforces that secure digital identity and anti-fraud capabilities are increasingly strategic partnership and acquisition priorities across Indian banking.
What to watch
- Increase in ICICI-related phishing reports that use non-web channels or reference the new domain migration.
- Spike in failed logins, password-reset attempts, CAPTCHA failures, or contact-center traffic after redirects go live.
- Search-ad or social-media impersonation using variants of ICICI, iMobile, and .bank.in.
- Peer-bank announcements of .bank.in migrations, revised customer-security advisories, or similar login hardening.
- Evidence that credential-stuffing rates decline while authorized-push-payment or remote-access-scam incidents rise.
- Customer sentiment or app-store reviews citing confusion during the planned iMobile maintenance period.
- Run prominent in-app, SMS, email, branch, and social campaigns teaching customers to verify the .bank.in domain without clicking campaign links.
- Maintain long-lived redirects and monitor typosquatted .bank.in, legacy-domain, and mobile-app impersonation variants.
- Use CAPTCHA telemetry to identify bot attacks, then selectively deploy device fingerprinting and risk-based authentication to avoid broad conversion loss.
- Prepare elevated support staffing and outage communications around the September 19, 2026 iMobile maintenance window.
- Coordinate with browsers, search engines, telecom providers, and cybercrime teams to rapidly remove fraudulent domains and paid-search impersonation ads.