Join WhatsApp Channel
India’s banking and digital payments industry faces a fundamental shift in cyber risk as artificial intelligence transforms identity into the primary attack surface, with identity compromise, AI-generated deception, machine identities and software supply-chain attacks expected to dominate the next generation of financial cybercrime, according to the government’s Digital Threat Report 2025-26.
The report, released by the Ministry of Electronics and Information Technology (MeitY), CERT-In, CSIRT-Fin and cybersecurity firm SISA, argues that the country’s financial institutions are moving into an era where attackers no longer need to breach network perimeters. Instead, they increasingly exploit trusted identities, authenticated sessions, business workflows and software development pipelines—making cyberattacks far harder to detect and contain.
For India’s rapidly expanding digital financial ecosystem, the implications are profound.
With UPI transactions, digital lending, online banking and API-driven financial services becoming the backbone of the economy, traditional cybersecurity models built around firewalls, passwords and perimeter security are steadily losing effectiveness. The report argues that the attack surface has shifted from systems to trust itself.
Identity replaces passwords as the primary target
The report predicts that identity inheritance and session compromise will emerge as the defining cyber threat over the coming years.
Rather than attempting to steal passwords or bypass multi-factor authentication (MFA), attackers are increasingly hijacking authenticated sessions by stealing session tokens, abusing OAuth permissions and exploiting “adversary-in-the-middle” (AiTM) frameworks that intercept legitimate user sessions. Once a session is compromised, attackers can operate as legitimate users without triggering conventional authentication alerts.
As financial institutions adopt single sign-on platforms, open banking APIs and cloud-native architectures, long-lived session tokens are becoming more valuable than passwords themselves.
The report warns that monitoring login events alone is no longer sufficient. Banks will increasingly need continuous verification throughout an authenticated session rather than assuming that successful login equals trusted activity.
AI-generated deception scales cybercrime
Artificial intelligence is also transforming social engineering into an industrial-scale operation.
The report forecasts an explosion in AI-generated phishing campaigns, QR code-based “quishing”, synthetic identity documents, deepfake-enabled customer impersonation and cloned executive voices capable of authorizing fraudulent financial transactions.
Unlike traditional phishing campaigns, AI-generated attacks can be grammatically flawless, contextually accurate and personalized using publicly available and previously breached data, making them significantly harder for customers and employees to identify.
The combination of AI-generated content, behavioral profiling and automated campaign management removes many of the cost and language barriers that historically limited sophisticated cybercrime.
For India’s financial institutions—which onboard millions of customers digitally every year—the report suggests that existing Know Your Customer (KYC) and remote verification systems may require substantial redesign to distinguish genuine customers from AI-generated identities.
Machine identities emerge as the weakest link
One of the report’s more significant observations is that attackers are increasingly targeting machine identities—service accounts, APIs, application credentials and software agents—rather than human users.
As banks automate operations using artificial intelligence, cloud computing and microservices, non-human identities now vastly outnumber employees.
Many of these machine identities possess privileged access to sensitive financial infrastructure but receive far less governance than human users.
The report recommends managing machine credentials with the same rigor as employee accounts, including continuous monitoring, lifecycle management and behavioral analytics.
Business logic becomes the new attack vector
The report also signals a shift away from conventional software vulnerabilities towards business logic attacks.
Instead of exploiting programming flaws, attackers increasingly manipulate legitimate workflows, transaction sequencing, authorization rules and payment logic to execute fraudulent transactions without technically breaching security controls.
Recent investigations found that many payment systems correctly validated normal transactions but failed when subjected to concurrent requests, API manipulation or carefully sequenced fraudulent workflows.
Because these attacks operate within the intended behavior of an application, they often evade conventional security monitoring.
The report argues that banks must begin designing applications around adversarial behavior rather than expected customer behavior, embedding continuous validation throughout payment and transaction lifecycles.
Software supply chains become strategic assets
Perhaps the most significant structural change identified by the report is the growing vulnerability of software supply chains.
As financial institutions rely on cloud platforms, fintech partners, open-source software and third-party vendors, the software delivery pipeline itself has become a critical battleground.
The report warns that compromised software development pipelines can distribute malicious code at the same speed as legitimate software updates, while weaknesses in third-party vendors increasingly expose entire financial ecosystems to systemic cyber risk.
It recommends embedding security testing, software provenance, secrets management and cryptographic verification directly into continuous integration and deployment (CI/CD) pipelines instead of treating security as a post-development exercise.
From perimeter security to continuous trust
Taken together, these trends point to a broader transformation in cybersecurity strategy.
The report concludes that the next generation of financial cyberattacks will focus less on breaking into systems than on exploiting trusted identities, authenticated sessions, AI models and interconnected software ecosystems.
For India’s financial sector, that means cyber resilience will increasingly depend on continuous verification, behavioral analytics, zero-trust architectures and AI-assisted defense rather than static compliance frameworks. As India deepens its digital economy ambitions, protecting trust—not merely infrastructure—may become the defining cybersecurity challenge of the coming decade.
