“The only thing we have to fear is fear itself,” Franklin D Roosevelt famously said in his first inaugural address as US President in 1933, when America was in the grip of the Great Depression.
Nearly a century later, the words offer an interesting perspective on the predicament confronting financial institutions. Their greatest fear is no longer a run on deposits or a sudden deterioration in asset quality. It is the possibility that an invisible adversary could penetrate their systems overnight, compromise customer data and move money before anyone notices.
A few years ago, the chief executive of a leading bank said that cyber fraud was what kept him awake at night. That fear is hardly misplaced. State Bank of India on October 21 disclosed a suspected data exposure after 3,897 customer records containing personally identifiable information surfaced within a larger cache of approximately 3.75 lakh records found on the dark web. Two Mumbai-based non-banking financial companies reportedly suffered losses of around $2 million following more than 700 unauthorised fund transfers on October 8 and 9.
The scale of the wider problem is equally concerning. CERT-In recorded 29.44 lakh cybersecurity incidents in 2025, against 20.41 lakh in 2024, an increase of around 44 per cent. These figures cover incidents reported across India, not just the financial sector. But they underline how rapidly the threat environment is changing.
The price of becoming interconnected
Banks have invested heavily in technology, strengthened surveillance and appointed dedicated information security officers. The RBI, too, has tightened its requirements. Yet breaches continue to occur. This raises an uncomfortable question: are financial institutions building their defences as quickly as they are expanding their digital operations?
Part of the problem lies within the institutions themselves. Fraud prevention, technology security and risk management are often handled by separate teams. Each may be doing its job, but that does not necessarily give the organisation a complete picture of the threat.
The problem becomes more serious when money moves across institutions. A fraudster may compromise an account at one bank, transfer funds through a payment intermediary and move them into several other accounts. By the time the first institution detects the fraud, the money may have travelled much further. Banks tend to focus on what happens within their own systems, while criminals exploit the connections between them.
The rapid expansion of partnerships between banks, NBFCs and fintech companies has widened this exposure. Lenders increasingly depend on outside technology providers for customer acquisition, loan processing, payments and disbursements. These arrangements have made financial services more convenient, but they have also created vulnerabilities that institutions do not always control directly.
A bank may have strong internal security and still be exposed through a fintech partner with weak systems, compromised credentials or poorly secured application programming interfaces (APIs). Smaller technology companies may lack the resources and expertise to maintain the same security standards as large banks, even when they have access to sensitive customer information and systems handling substantial transactions.
The reported losses at the two NBFCs underline this concern. According to a police complaint, hackers compromised the API used to send loan-disbursement instructions to the bank. The alleged exploitation shows how weaknesses in the connections between institutions can be as damaging as breaches within the institutions themselves. As financial services become more dependent on automated communication between systems, API security can no longer be treated as a technical detail.
Artificial intelligence is making the challenge more serious. Fraudsters can use it to write convincing phishing messages, imitate voices, impersonate senior executives and identify weaknesses in systems. What once required considerable time and technical skill can increasingly be automated. Financial institutions, meanwhile, are still trying to bring together information scattered across departments and technology platforms.
In an advisory issued on November 4, CERT-In identified an AI-assisted financial threat actor, designated CRAFTY FALCON, targeting NBFCs, digital lending platforms, fintech companies, payment aggregators and other financial entities. The agency said attackers were using AI-driven tools to survey targets, develop customised attack scripts and exploit payment and disbursement APIs at machine speed. Some institutions that had attempted to fix vulnerabilities were targeted again. Attacks were also timed to coincide with weekends and holidays, when monitoring could be weaker.
This should be a wake-up call for the industry. AI can help banks detect suspicious transactions and identify patterns that conventional systems may miss. But deploying another fraud-detection tool is not enough. If information remains fragmented and departments do not act on alerts quickly, even sophisticated technology will have limited value.
Regulation is only part of the answer
The RBI has recognised the growing threat. On July 31, it issued new cybersecurity and technology-risk directions for commercial banks and NBFCs, covering board oversight, information security, third-party arrangements and operational resilience. The regulator has also stepped up its scrutiny following recent attacks. Reuters reported on October 30 that banks had been asked to demonstrate compliance with existing requirements, examine vulnerabilities in APIs connecting them with fintech companies and assess their preparedness for AI-related threats.
The RBI has also penalised institutions for compliance failures. In May 2025, it imposed a penalty of Rs 97.80 lakh on ICICI Bank for three deficiencies, including failure to report a cybersecurity incident within the stipulated timeline and inadequate software alerts for certain categories of accounts.
But regulations can only go so far. Responsibility ultimately rests with the boards and managements of financial institutions. Cybersecurity cannot remain an issue passed on to the IT department or discussed only after an incident. It must be treated with the same seriousness as credit and liquidity risk.
Banks cannot simply assume that their fintech partners are secure. Every third-party connection needs to be examined, tested and monitored. APIs must have strong authentication and restricted access, while unusual disbursements and large transfers should trigger additional checks. Institutions need independent security assessments and round-the-clock monitoring, rather than discovering vulnerabilities after money or customer data has been compromised.
Banks, NBFCs and fintech companies also need to share information about suspicious accounts, mule networks and emerging fraud methods. A warning issued by one institution is of little use if another, through which the money is being routed, remains unaware. There must be clear arrangements for responding to attacks and freezing suspicious transactions quickly, within the applicable legal and regulatory framework.
Innovation cannot come at the cost of trust
Digital technology has transformed banking in India. Customers can open accounts, transfer money and access credit with a speed that would have been difficult to imagine a decade ago. Financial institutions will continue to embrace new technologies. But the rush to innovate has sometimes meant that security considerations follow business expansion rather than precede it.
Roosevelt’s words are relevant here, not because banks should stop worrying about cyberattacks, but because fear must lead to action rather than paralysis. No financial institution can promise that it will never be attacked. What it can do is ensure that an intrusion is detected quickly, the damage is contained and the money does not disappear before anyone can respond.
Banks have spent years building systems that allow money to move almost instantly. They now need to put equal effort into systems that recognise when that movement is fraudulent. Customers do not care how sophisticated a bank’s technology is if their money and personal information are not safe. Digital banking rests on trust. Once that trust is lost, rebuilding it can be considerably harder than rebuilding a firewall.
CFOs must put a price on cyber risk
The challenge extends well beyond banks. CFOs across India Inc can no longer treat cybersecurity merely as an IT expenditure or leave it entirely to the chief information security officer. A cyberattack can quickly translate into financial losses, business disruption, regulatory penalties, litigation and reputational damage.
CFOs need to ensure that security budgets reflect the risks their organisations face and that investments are judged by their effectiveness, not simply their cost. They should factor in vulnerabilities at third-party technology providers, insist on regular security assessments and ensure adequate resources for incident response and business continuity.
Cyber risk must become part of financial planning and enterprise risk assessment. The cost of preventing an attack may appear high on the balance sheet, but the cost of recovering from one can be considerably higher.
Please share your feedback, suggestions if any. You can reach me on amol.dethe@timesinternet.in.
(Editor’s note is a column written by Amol Dethe, Editor, ETCFO. Click here to read more of his articles exploring several buzzing topics)
