NEW DELHI — India’s banking, financial services, and insurance (BFSI) sector is facing an unprecedented wave of cyber threats, with artificial intelligence (AI) and deepfake technologies increasingly weaponized to exploit vulnerabilities in digital payment systems, according to the Digital Threat Report 2025-26 released by the Ministry of Electronics and Information Technology (MeitY). Developed in collaboration with cybersecurity firm SISA, the report paints a stark picture of a sector under siege, where financial fraud, ransomware attacks, and third-party breaches have surged by 40% in the past year alone.
The findings underscore a critical paradox: while India’s rapid digital transformation has democratized financial access—with over 1.5 billion digital transactions processed daily—it has also created a lucrative target for cybercriminals. The report reveals that nearly 60% of all cyber incidents in the BFSI sector in 2025-26 involved financial fraud, including unauthorized transactions and identity theft, while ransomware attacks on banks and insurance firms have doubled since 2024. Alarmingly, 30% of breaches originated from vulnerabilities in vendor ecosystems, exposing the sector’s reliance on often under-secured third-party service providers.
MeitY has called for urgent reforms, including the adoption of multi-factor authentication (MFA), real-time threat monitoring, and AI-driven anomaly detection systems. The ministry also stressed the need for stricter adherence to the Reserve Bank of India’s (RBI) cybersecurity guidelines, which mandate regular audits, breach disclosures, and employee training. However, the report’s reliance on self-reported data from financial institutions raises questions about the true scale of the threat, as many breaches remain undetected or unreported due to fears of reputational damage or regulatory penalties.
—
What Happened: Key Findings of the Digital Threat Report 2025-26
The Digital Threat Report 2025-26 is the second edition of MeitY’s annual assessment of cyber risks in India’s BFSI sector, following its inaugural release in 2024. Compiled with technical support from SISA, a Bengaluru-based cybersecurity firm specializing in financial sector protections, the report analyzes data from over 200 banks, insurance companies, and fintech firms across India. Its findings are based on incident reports submitted to the Indian Computer Emergency Response Team (CERT-In), RBI compliance filings, and proprietary threat intelligence gathered by SISA.
# 1. Escalation of AI-Powered Threats
The most alarming trend identified in the report is the rapid adoption of AI by cybercriminals to bypass traditional security measures. Deepfake technology, in particular, has emerged as a major threat, with fraudsters using AI-generated voice and video clones to impersonate bank officials or customers and authorize fraudulent transactions. The report notes a 150% increase in deepfake-related financial fraud cases in 2025, compared to the previous year, with losses exceeding ₹1,200 crore ($144 million).
Phishing attacks have also evolved, with cybercriminals leveraging AI to craft highly personalized “spear-phishing” emails that mimic legitimate communications from banks or government agencies. These attacks have a success rate of nearly 22%, up from 8% in 2023, according to the report. SISA’s data suggests that smaller banks and cooperative credit societies, which often lack advanced cybersecurity infrastructure, are disproportionately targeted by such attacks.
# 2. Ransomware and Supply Chain Vulnerabilities
Ransomware attacks on financial institutions have surged, with the report documenting a 90% increase in incidents since 2024. The average ransom demand has also risen sharply, from ₹5 crore ($600,000) in 2023 to ₹18 crore ($2.16 million) in 2025. Notably, 40% of ransomware attacks in the past year were linked to cybercriminal groups operating from outside India, including syndicates based in Russia, North Korea, and Southeast Asia.
The report also highlights the growing risk of supply chain attacks, where cybercriminals exploit vulnerabilities in third-party vendors—such as payment processors, cloud service providers, or software suppliers—to gain access to financial institutions. Nearly 30% of all breaches in 2025 originated from such third-party compromises, a figure that has doubled since 2022. The RBI’s 2024 directive requiring banks to conduct due diligence on vendors has had limited impact, as many institutions struggle to enforce compliance across their sprawling ecosystems.
# 3. Financial Fraud and Identity Theft
Financial fraud remains the most prevalent cyber threat in the BFSI sector, accounting for 58% of all reported incidents in 2025-26. The report identifies three primary vectors:
– Unauthorized transactions: Fraudsters exploit weak authentication protocols to siphon funds from customer accounts. The report notes a 70% increase in such incidents, with losses totaling ₹3,500 crore ($420 million) in the past year.
– Identity theft: Cybercriminals use stolen personal data—often obtained through data breaches or phishing—to open fraudulent accounts or apply for loans. The report estimates that identity theft cases have risen by 50% since 2024.
– SIM-swap fraud: Criminals hijack mobile numbers to intercept one-time passwords (OTPs) and bypass two-factor authentication. The report documents a 35% increase in SIM-swap fraud, with victims losing an average of ₹2.5 lakh ($3,000) per incident.
# 4. Regulatory Gaps and Compliance Challenges
While the RBI has introduced stringent cybersecurity norms—including the Master Direction on Digital Payment Security Controls (2023) and the Guidelines on Information Security, Electronic Banking, Technology Risk Management, and Cyber Frauds (2024)—the report reveals significant gaps in enforcement. Smaller banks, regional rural banks (RRBs), and cooperative credit societies, which collectively serve over 40% of India’s population, often lack the resources to implement advanced security measures. The report notes that only 60% of RRBs have fully complied with the RBI’s 2024 guidelines, compared to 95% of private sector banks.
MeitY has urged financial institutions to prioritize the following measures:
– Multi-factor authentication (MFA): Mandating MFA for all high-value transactions, including those above ₹50,000 ($600).
– Real-time threat monitoring: Deploying AI-driven systems to detect anomalies in transaction patterns and user behavior.
– Vendor risk management: Conducting regular audits of third-party service providers and enforcing contractual cybersecurity obligations.
– Employee training: Implementing mandatory cybersecurity awareness programs to combat phishing and social engineering attacks.
—
Why It Matters: The Stakes for India’s Digital Economy
The Digital Threat Report 2025-26 arrives at a critical juncture for India’s digital economy. The BFSI sector is the backbone of the country’s financial infrastructure, processing over $3 trillion in transactions annually—equivalent to nearly 120% of India’s GDP. The sector’s rapid digitization, driven by initiatives like the Unified Payments Interface (UPI), Aadhaar-enabled payments, and the Reserve Bank’s Digital Rupee pilot, has made it a prime target for cybercriminals.
# 1. Economic and Reputational Risks
A single large-scale cyberattack on a major bank or payment gateway could have cascading effects on India’s economy. The report warns that a ransomware attack on a systemically important financial institution (SIFI) could disrupt digital payments nationwide, eroding public trust in digital banking. The 2023 ransomware attack on the All India Bank Employees’ Association (AIBEA), which temporarily crippled the banking operations of 12 public sector banks, serves as a cautionary tale. While the attack was contained within 48 hours, it exposed the sector’s vulnerability to coordinated cyber campaigns.
Reputational damage is another critical concern. The report notes that 45% of customers who fall victim to financial fraud switch to a different bank within six months, costing institutions an estimated ₹5,000 crore ($600 million) annually in lost business. For fintech startups, which rely on customer trust to scale, even a single high-profile breach can be existential.
# 2. National Security Implications
The report’s findings have broader national security implications. Cyberattacks on financial institutions are increasingly being used as tools of economic warfare by state-sponsored actors. In 2025, CERT-In attributed a series of attacks on Indian banks to a North Korean-linked group, which attempted to siphon funds to finance Pyongyang’s nuclear program. The report warns that such attacks could escalate, particularly as India deepens its digital integration with global financial systems.
The use of AI by cybercriminals also poses a unique challenge. Deepfake technology, for instance, could be weaponized to manipulate stock markets, spread disinformation, or impersonate government officials to authorize fraudulent transactions. The report highlights a 2025 incident where deepfake audio of a senior RBI official was used to trick a bank into transferring ₹50 crore ($6 million) to an offshore account. While the fraud was detected within hours, it underscored the need for advanced authentication systems.
# 3. The Fintech Dilemma: Innovation vs. Security
India’s fintech sector, which has grown at a compound annual rate of 22% since 2020, faces a fundamental tension between innovation and security. Startups often prioritize rapid product development and market expansion over cybersecurity, leaving them vulnerable to attacks. The report notes that 70% of fintech breaches in 2025 involved startups with fewer than 500 employees, many of which lacked dedicated cybersecurity teams.
The RBI’s 2024 guidelines require fintech firms to implement the same security standards as traditional banks, but compliance remains uneven. The report recommends the creation of a centralized fintech cybersecurity framework, with incentives for startups to adopt best practices. It also calls for greater collaboration between fintech firms, banks, and government agencies to share threat intelligence in real time.
—
Background and Context: How India’s BFSI Sector Became a Cyber Battleground
India’s BFSI sector has undergone a dramatic transformation over the past decade, driven by three key trends: digital payments, financial inclusion, and regulatory reform.
# 1. The Digital Payments Revolution
The launch of the Unified Payments Interface (UPI) in 2016 marked a turning point for India’s digital economy. UPI, which enables instant bank-to-bank transfers via mobile phones, has grown exponentially, processing over 10 billion transactions per month in 2025—up from just 10 million in 2017. The system’s success has made India a global leader in digital payments, but it has also created a vast attack surface for cybercriminals.
The report highlights several vulnerabilities in UPI’s ecosystem:
– Fraudulent UPI handles: Criminals create fake UPI IDs that mimic legitimate businesses to trick users into transferring money.
– SIM-swap attacks: Fraudsters hijack mobile numbers to intercept UPI authentication messages.
– Malware-infected apps: Fake UPI apps, often distributed via third-party app stores, steal user credentials and drain accounts.
The RBI’s 2023 directive requiring all UPI transactions to be tokenized—replacing sensitive card details with unique tokens—has mitigated some risks, but the report notes that implementation has been slow, particularly among smaller banks.
# **2
Corrections
If you believe this article contains an error, contact Herald Express with the source URL and supporting evidence.
Corrections
If you believe this article contains an error, contact Herald Express with the source URL and supporting evidence.
Story synopsis gathered from: Google News India Technology — source.
