What happened?
Financial regulators and central banks across the globe have issued a series of warnings through 2025-26 about the escalating risk of AI-powered cyberattacks targeting banking and financial infrastructure. The concern: AI systems are making it dramatically easier for malicious actors to identify vulnerabilities in financial IT systems, generate convincing phishing attacks, automate credential theft, and conduct coordinated attacks at scale that would previously have required large criminal organisations or state-sponsored hackers. For India — home to one of the world's most rapidly growing digital financial ecosystems — these warnings carry immediate relevance.
Key Points
- Global financial regulators including the FSB, BIS, and national central banks have flagged AI cyber risk
- AI enables faster, more automated, more targeted attacks on financial systems
- India's UPI, banking, and insurance infrastructure face growing AI-assisted cyber threats
- RBI has issued guidelines on cybersecurity but AI-specific regulations are still developing
- Financial fraud using AI-generated deepfakes and voice clones is rising in India
- Indian banks are investing in AI-powered fraud detection to counter AI-powered fraud
Background
India's financial infrastructure has been transformed by digital payments — with UPI processing over 18 billion transactions monthly as of 2026. This digital depth creates enormous economic value but also creates an attack surface that grows with every new user and every new digital transaction.
Traditionally, cyberattacks on financial institutions required significant technical expertise and resources. AI is democratising those capabilities — making sophisticated attack tools available to a wider range of malicious actors. At the same time, AI is dramatically improving the quality of social engineering attacks, which rely on deception rather than technical exploitation.
Main Details
The Financial Stability Board (FSB), the Bank for International Settlements (BIS), and multiple national regulators have produced reports in 2025-26 specifically addressing AI cyber risk in financial services. Their common themes: AI enables attacks that are faster, more personalised, harder to detect, and more difficult to attribute to specific actors.
AI-powered phishing attacks can now generate highly convincing fake emails, SMS messages, and even voice calls that mimic trusted institutions or individuals. AI-generated deepfake videos of bank executives or government officials have been used to authorise fraudulent wire transfers.
In India, cyber fraud cases involving AI-generated voice clones of relatives or officials requesting emergency money transfers have been documented by police in multiple states. These social engineering attacks are particularly effective because they exploit trust rather than technical vulnerabilities.
The RBI has issued enhanced cybersecurity guidelines for banks and payment companies, but AI-specific regulations are still being developed. Indian banks are simultaneously investing in AI-powered fraud detection systems — using AI to fight AI-driven fraud.
Reactions
Indian banks and financial technology companies have acknowledged the growing AI cyber threat and are increasing cybersecurity investments. However, industry observers note that the pace of AI capability development is outrunning the pace of defensive investment in many smaller banks and payment companies.
Consumer protection advocates have raised concerns that the burden of AI-powered fraud is falling disproportionately on ordinary citizens who are least equipped to identify sophisticated AI-generated deception.
Impact Analysis
A large-scale successful cyberattack on India's banking infrastructure or UPI system would have severe economic consequences — disrupting payments for hundreds of millions of people and potentially triggering a loss of confidence in digital financial systems. The stakes of getting AI cyber defence right are enormous.
What Happens Next
The RBI is expected to issue more specific guidance on AI-related cyber risks for regulated financial institutions through 2026. Indian banks will be required to demonstrate AI cybersecurity preparedness as part of their regulatory compliance. Citizens should be aware that AI-generated fraud is becoming increasingly sophisticated and maintain healthy scepticism about any urgent financial requests received digitally.
FAQ
Q: What is AI cyber risk in banking?
A: The risk that AI tools are used to attack financial systems more effectively — through automated vulnerability detection, AI-generated phishing, deepfake fraud, and coordinated attacks.
Q: Is UPI safe from AI cyberattacks?
A: UPI's technical infrastructure is designed with multiple security layers. However, social engineering attacks that trick users into authorising fraudulent transfers are an increasing risk.
Q: What is a deepfake financial fraud?
A: A scam where AI-generated audio or video of a trusted person (bank official, family member, employer) is used to deceive victims into transferring money or revealing credentials.
Q: How can I protect myself from AI-powered fraud?
A: Never transfer money based on urgent digital requests alone. Call back known numbers to verify. Never share OTPs or PINs regardless of who is asking.
Q: What is the RBI doing about AI cyber risk?
A: The RBI has issued enhanced cybersecurity guidelines and is developing AI-specific regulatory frameworks for Indian banks and financial institutions.