India Reports 78% Surge in Cyberattacks on Banking Sector, CERT-In Mandates 6-Hour Reporting

India's Computer Emergency Response Team (CERT-In) has reported a 78 percent year-on-year increase in cyberattacks targeting the country's banking and financial sector in the first half of 2026, with digital payment platforms and mobile banking applications identified as the most frequently exploited entry points.

The surge has prompted the Reserve Bank of India to issue supplementary cybersecurity directives requiring financial institutions to maintain dedicated security operations centres and implement AI-driven fraud detection systems across all customer-facing platforms by December 2026.

CERT-In's landmark 2022 six-hour breach reporting mandate has matured into a comprehensive incident intelligence framework that is now being studied by regulators in Southeast Asia as a model for rapid national threat response. India's reporting data feeds into a real-time threat-sharing network covering 14 countries in the Asia-Pacific region.

Attackers have increasingly targeted India's Unified Payments Interface ecosystem, exploiting social engineering at scale using AI-generated voice and video deepfakes. Several major banks have deployed voice biometric verification as a countermeasure, reducing impersonation fraud by an estimated 52 percent in pilot programmes.

The government's National Cyber Security Coordinator has called for accelerated investment in domestic cybersecurity product development, citing concerns about strategic dependence on foreign security platforms for protecting critical national infrastructure.

The scale of deepfake-enabled fraud targeting Indian consumers has reached a level that distinguishes the country as a disproportionately affected market by global standards. A 2025 analysis of AI scams in India found that 47 percent of Indian adults have either been victims of, or know someone who has been a victim of, an AI voice-cloning or deepfake scam — nearly double the global average of 25 percent — with 83 percent of Indian victims of AI voice scams suffering monetary loss, and almost half losing over INR 50,000. India's UPI infrastructure, processing over 15 billion transactions monthly, represents a high-value target, with India's Cybercrime Coordination Centre projecting annual losses of ₹1.2 lakh crore driven predominantly by investment fraud, UPI scams, and fake stock trading platforms. The sheer transaction volume of the UPI ecosystem, combined with the speed at which payments settle, creates a narrow and shrinking window for fraud detection and reversal that attackers have learned to exploit with precision.

Enterprise-level impersonation attacks are simultaneously escalating alongside consumer-facing fraud, creating a two-front threat that is stretching institutional response capacity. India in 2026 is experiencing a surge in deepfake-based Business Email Compromise attacks in which fraudsters impersonate CEOs, CFOs, and government officials using AI-generated voice recordings and video calls to authorise financial transfers or extract credentials — with the impersonation quality exceeding what traditional security awareness training prepares employees to recognise. Unlike conventional fraud attempts, deepfake-based attacks are designed to exploit trust at scale, with synthetic voice, video, and identity manipulation deployed to bypass traditional verification mechanisms — a trend that Seqrite Labs recorded at an average rate of 505 detections per minute across more than 8 million endpoints between October 2024 and September 2025. Security architects warn that cognitive attacks of this nature cannot be countered by perimeter defences alone and require a fundamental rethinking of identity verification protocols at every layer of customer and employee interaction.

Cloud infrastructure vulnerabilities are adding a third dimension to the threat picture that regulators have been slower to address. Telemetry from India's Data Security Council shows that 62 percent of all detections occurred in cloud environments, with misconfigured APIs, publicly exposed storage buckets, excessive IAM permissions, and absent workload protection representing the most exploited weaknesses — with multiple Indian financial institutions having suffered data exposure due to misconfigured cloud storage buckets exposing customer identity details and transaction logs. Supply chain risk compounds the problem further, as cybercriminals are exploiting vulnerabilities in third-party fintech systems to gain access to sensitive banking data — a dynamic illustrated by the Nupay incident, in which a single fintech partner's misconfiguration exposed data from 38 banking institutions simultaneously. Industry bodies are pressing for mandatory third-party security certification standards for all fintech providers integrated into core banking infrastructure, a measure the RBI is widely expected to formalise before the end of 2026.