There has been considerable debate about whether artificial intelligence (AI) will eventually become an existential threat to humanity. Some believe increasingly powerful machines could escape human control, while others dismiss such fears. Whether these predictions materialise is debatable, but one threat is no longer theoretical—AI is transforming cybercrime, with serious implications for banking, financial markets, and economic stability.
In India, cyber incidents involving smaller NBFCs reportedly resulted in losses of nearly ₹300 crore over two months, with around 150 complaints and FIRs. Attackers exploited vulnerabilities in APIs and payment infrastructure to initiate unauthorised transfers. The incident involving the country's largest lender, SBI, is equally instructive. Recently, SBI disclosed a suspected data breach. Preliminary examination identified thousands of records containing personal information, including names, telephone numbers, addresses, and loan-related details. Although core operations and customer balances remained unaffected, the incident raises questions about data security and third-party access.
South Korea has reported breaches involving 16 financial institutions and approximately 100,000 exposed records. In Italy, fraudsters reportedly used an AI-replicated voice and fraudulent WhatsApp communication, impersonating a senior executive, to induce a banking institution to transfer €95 million, much of which remained unrecovered.
The recent Binance incident also offers an alarming illustration. A week ago, hackers reportedly stole approximately $6.3 billion in cryptocurrency from the exchange's hot wallets across multiple blockchains. Investigations pointed to a compromised DevOps engineer's laptop and unauthorised access to internal systems and wallet signing infrastructure. On Ethereum, attackers reportedly exploited an account delegation feature to execute malicious transactions through a hot wallet. Blockchain cryptography itself was not broken. The vulnerability lay in internal access controls and transaction authorisation. Investigators attributed the attack to North Korea's TraderTraitor group.
Not all these incidents can be attributed directly to AI. Nevertheless, they demonstrate how technology and compromised systems can threaten financial institutions on an unprecedented scale. AI has, however, lowered the barriers to sophisticated cybercrime. Criminals can automate vulnerability detection, generate convincing impersonations, conduct phishing campaigns, and execute simultaneous attacks. What once required considerable expertise can now be attempted with readily accessible tools.
The asymmetry is worrying. A financial institution may spend decades building customer confidence. Cybercriminals may need just one compromised employee credential and an unpatched vulnerability or weakness in transaction approval to cause enormous damage.
Cybersecurity And Financial Stability
The threat extends beyond financial losses or confidential information. A coordinated attack could disrupt a bank's payment infrastructure, compromise a clearing corporation, interfere with a stock exchange's trading systems or paralyse a securities depository. Payments could be delayed, trading suspended, and settlements disrupted. The possibility of hostile nations or enemy elements targeting India's financial infrastructure during a war or geopolitical conflict cannot be ruled out. Such attacks could undermine economic confidence and create wider instability.
Cybersecurity is no longer merely an IT concern; it is a financial stability issue and an increasingly important component of national security.
What Needs To Be Done?
First, cybersecurity must become a boardroom responsibility. Boards and senior management must be accountable for assessing vulnerabilities, ensuring investment, and reviewing preparedness. Independent audits should be periodic and substantive.
Second, the RBI and SEBI must move beyond compliance-based inspections towards mandatory cyber stress testing. Banks, NBFCs, exchanges, clearing corporations and depositories should simulate attacks involving compromised credentials, manipulated APIs, ransomware, and unauthorised transactions, testing prevention, containment, and recovery.
Third, India needs a real-time financial sector cyber intelligence network. Threat information must be shared across banks, NBFCs, fintech companies, payment operators, and securities market institutions. An attack detected at one institution should immediately alert others exposed to the same vulnerability.
Fourth, institutions must use AI defensively. Continuous monitoring should identify abnormal logins, unusual transactions, and suspicious employee access. High-value transactions should require multiple independent approvals and transaction-specific authentication. Voice recognition or WhatsApp instructions should never independently authorise substantial transfers.
Fifth, smaller NBFCs and third-party technology vendors need particular attention. Their systems may connect to major banking and payment networks despite limited cybersecurity resources. Shared security facilities, threat intelligence platforms, independent vendor audits and minimum-security standards should be mandated.
Sixth, crisis preparedness must become a regulatory priority. Institutions should maintain geographically separated backups and tested business continuity arrangements. Regulators should conduct sector-wide simulation exercises to assess the ecosystem's ability to withstand simultaneous attacks.
Finally, international cooperation is indispensable. Governments must strengthen intelligence sharing, digital evidence preservation, and cross-border law enforcement against cybercriminals.
The Regulatory Challenge
The RBI has intensified scrutiny of cybersecurity preparedness, seeking greater assurance on API vulnerabilities and readiness for AI-related risks. CERT-In has also warned about AI agents exploiting exposed credentials, excessive access permissions, and vulnerable systems. Effective implementation must take precedence over simply issuing additional guidelines.
The RBI must ensure consistent cybersecurity standards across banks, NBFCs and payment institutions. SEBI must treat cyber resilience as integral to market integrity and investor protection, extending oversight to exchanges, clearing corporations, depositories, brokers, and critical technology service providers. Both regulators need clear accountability, reporting, and recovery requirements, with coordinated supervision wherever responsibilities overlap.
The answer is not to slow technological progress or fear AI. Financial innovation must continue, but resilience must evolve alongside it. The next major financial crisis may not originate in excessive lending, a liquidity mismatch, sovereign default or collapsing asset prices. It could originate in a compromised computer system.
Unlike conventional financial crises, where warning signs may build over months or years, a sophisticated cyberattack could unfold in minutes. Governments and regulators must prepare today rather than wait for a catastrophic incident. Building a technologically advanced financial system is important. Building one capable of withstanding technology used against it is even more important.
The writer is a retired IRS officer and Ex-Chief of Surveillance at SEBI. Advisor to corporates, market participants and tech entrepreneurs.
To get details on exclusive and budget-friendly property deals in Mumbai & surrounding regions, do visit: https://budgetproperties.in/
