INDUSTRY FACT FILE · BANKING

Threat Landscape: Top Cyber Threats Facing Banks

The 18 most relevant cyber threats, attacks and industry challenges for banks in India, and the impact each one has on banks and their customers.

RBI's Annual Report for 2025-26 shows banks and financial institutions reported 10,114 frauds of ₹1 lakh and above involving ₹48,021 crore; advances-related frauds accounted for the largest share by value. Reports based on Indian Cybercrime Coordination Centre (I4C) data put cyber-fraud losses across all channels at about ₹19,813 crore in 2025. The industry response includes RBI Innovation Hub's MuleHunter.AI, which the Government told Parliament in July 2026 had been adopted by 29 banks, and the Digital Payments Intelligence Platform, then in a pilot with seven banks.

The list below is a practical assessment framework, not a statistical ranking. Priority varies by bank type, technology estate and existing controls.

Different bank types experience the same threat with different intensity. The matrix is a qualitative guide for prioritising the first round of security reviews.

Figure 5: Qualitative threat relevance by bank segment (Codec Networks assessment).

4.1 Account takeover and mule accounts

Account takeover and mule accounts are two halves of the same fraud chain: one steals the money, the other moves it. Attackers exploit SIM swaps, OTP sharing under pressure, malware and remote-access apps; the proceeds flow through accounts opened with rented or synthetic identities and are moved out within minutes over UPI and IMPS. RBI's 2026 Directions expect risk-based transaction monitoring across channels and customer notification through alternate channels for payments above a customer-set value.

• Questions to test: Do onboarding and V-CIP controls detect synthetic and rented identities? Are dormant and new accounts subject to velocity and pass-through rules? Are SIM-change and device signals used in risk scoring?
• Relevant services: mobile app and authentication testing, mule-detection use cases in the CSOC, fraud-scenario simulation, forensic investigation.

4.2 Ransomware

Ransomware remains the threat most likely to stop a bank. Attackers enter through phishing, exposed remote access or vulnerable systems, escalate to domain administrator, delete backups and encrypt servers. RBI's 2026 Directions require DR drills for critical systems at least half-yearly, with DR operating for at least a full working day, and a documented Cyber Crisis Management Plan.

• Questions to test: Are backups isolated and restorable? Is EDR deployed and monitored on every endpoint and server? Has the crisis plan, including 6-hour reporting, been rehearsed?
• Relevant services: ransomware simulation, backup security testing, EDR/XDR validation, DR drill observation, incident response retainer.

4.3 Third-party and ATM switch compromise

Banks rely on shared ATM switch providers, core banking vendors, data-centre operators, cloud providers and fintech partners. RBI's 2026 commercial bank Direction specifies baseline controls that third-party ATM switch service providers must implement, requires those controls in contracts, and extends audit and RBI inspection rights to IT and cyber third-party arrangements not already covered by the outsourcing directions.

• Questions to test: Do contracts contain the baseline controls and audit rights? Are privileged actions at the provider logged and alerted to the bank? When were the provider's controls last independently tested?
• Relevant services: third-party risk management, ATM switch provider assessments, contract security review, CSOC monitoring of provider activity.

4.4 Digital channel and API attacks

Internet banking, mobile banking and partner APIs are where most data-exposure findings occur. Broken object-level authorisation, excessive data in API responses and leaked partner credentials are common. The 2026 Directions require application security testing throughout the lifecycle—explicitly not limited to the OWASP Top 10—and VA at least six-monthly and PT at least annually for customer-facing DMZ systems.

• Questions to test: Is every partner API inventoried, minimised and tested? Are partner credentials scoped, rotated and monitored? Are business-logic flaws tested, not only technical vulnerabilities?
• Relevant services: web, mobile and API testing, secure code review, DevSecOps integration, partner API assurance.

4.5 Weak detection and the 6-hour clock

A bank that cannot see an incident cannot report it. RBI's 2026 Directions require cyber incidents to be reported on the DAKSH platform within six hours of detection and require a CSOC with round-the-clock Level 1 monitoring and deeper Level 2 and Level 3 capabilities. CERT-In's Directions separately require reporting within six hours and retention of ICT logs for 180 days in India.

• Questions to test: Are all critical systems feeding the SIEM? Are detection use cases tested? Is there a 2 a.m. escalation path that ends with a DAKSH submission?
• Relevant services: managed or co-managed CSOC, SIEM use-case tuning, incident playbooks, tabletop exercises.

• Reporting clocks: cyber incidents to RBI on DAKSH within six hours of detection; specified incidents to CERT-In within six hours.
• Evidence: ICT logs retained for 180 days in India under CERT-In's Directions; incident analysis and root cause expected by supervisors.
• Customer liability: from 1 January 2027, RBI's revised framework for fraudulent electronic banking transactions places the burden of proving customer liability on banks.
• Privacy: once DPDP breach provisions commence in May 2027, personal data breaches must be intimated to the Data Protection Board, with a detailed report within 72 hours.
• Governance: under the 2026 Directions, the CISO reviews cyber risk with the Board, Risk Management Committee or ITSC at least quarterly.

• Which critical systems and customer-facing DMZ systems have not had VA in the last six months or PT in the last year?
• Could we detect, triage and report a material incident to RBI within six hours—tonight?
• Which third parties, including ATM switch and core providers, could hurt us most, and when were their controls last tested?
• How quickly would we spot a mule account or an unusual high-value transfer?
• When did we last run DR for a full working day and restore from backup?
• Does the Board receive cyber risk indicators that show control effectiveness, not just activity?

Note: Threat descriptions and relevance ratings are general guidance, not findings about any specific bank. RBI fraud figures relate to frauds of ₹1 lakh and above reported in 2025-26, which may include frauds that occurred earlier; I4C figures cover all channels. Confirm regulatory obligations against official instruments.