Banking Fraud and Cybersecurity Basics
Banking Fraud and Cybersecurity Basics. A detailed chapter in KYC, AML, Cybersecurity & Customer Protection, with explanations and examples for Indian banking examinations.
By Akhilesh Saini · Reviewed 8 Oct 2026
1. What is cyber risk in banking?
Banking depends on information systems for accounts, loans and payments. Cyber risk arises when systems, data or electronic services are compromised or disrupted. The harm may include theft of money, exposure of personal data, operational outage, falsified information or loss of trust.
A cyber incident and a financial fraud can overlap but are not synonyms. A system outage may not be fraud; a deceptive telephone call may cause fraud without any hacking of the bank's core system.
2. Information security: the CIA triad
The classic information-security framework is:
- Confidentiality: only authorised people can access information.
- Integrity: data remain accurate and protected from unauthorised alteration.
- Availability: authorised users can access systems/services when needed.
Examples: a leaked statement violates confidentiality; altered beneficiary details threaten integrity; an unavailable banking app threatens availability.
3. Authentication vs authorisation
Authentication answers: Who is requesting access?
Authorisation answers: What is that authenticated party allowed to do?
A bank employee may authenticate successfully but have no authority to approve a particular high-value transaction. A customer may log in safely but be required to provide further authentication to authorise a payment.
4. Multi-factor authentication
Authentication factors commonly fall into:
- Something you know: password, PIN.
- Something you have: registered device, hardware token.
- Something you are: biometric characteristic.
Using two independent factors is stronger than repeatedly asking for two passwords of the same kind. Actual RBI/customer authentication rules depend on the channel and current product.
5. Encryption, hashing and tokenisation
- Encryption transforms readable information into protected ciphertext using cryptographic methods; authorised decryption recovers it.
- Hashing produces a fixed-length digest often used in integrity/security workflows; it is not normal reversible encryption.
- Tokenisation replaces a sensitive value such as card credentials with a restricted substitute/token in an approved framework.
Exam trap: tokenisation does not mean money has become a cryptocurrency. It can be a way of reducing exposure of sensitive card credentials.
6. Phishing, vishing and smishing
| Threat | Typical approach | Defensive principle |
|---|---|---|
| Phishing | Fake e-mail/site solicits credentials | Verify destination independently |
| Vishing | Voice call impersonates bank/official | End the call and contact verified number |
| Smishing | Fraudulent SMS/link | Do not follow unexpected payment/KYC links |
| Quishing | QR-code-based deception | Verify who receives money and why |
| Spear phishing | Targeted message tailored to victim | Independently confirm unusual requests |
The goal is often social engineering: manipulating a person into taking an unsafe action.
7. UPI collect requests and QR-code misunderstandings
To receive an ordinary UPI transfer, the payee normally does not need to enter a UPI PIN or authorise an outgoing debit. A scam may falsely present a collect request as a "refund" or "receive money" action.
Golden exam and consumer fact: Entering a UPI PIN authorises a payment/debit in the ordinary payer flow—not the mere receipt of money. Product variations exist; rely on verified app instructions rather than a caller's direction.
8. Remote-access and screen-sharing scams
A fraudster may claim to provide:
- customer support;
- KYC correction;
- cashback/reward;
- investment help;
- fraud reversal.
The victim is persuaded to install software or disclose screen contents, making it possible for the attacker to observe credentials or manipulate the device. Legitimate bank support should never require sharing an OTP or allowing unknown remote control merely to receive a refund.
9. SIM swap and device compromise
A SIM-swap incident occurs when an attacker manages to transfer control of a mobile number. This can undermine SMS-based security and account recovery. Other threats include malicious apps, spyware, device theft and weak phone locks.
Practical controls include registered-device checks, strong device security, rapid reporting of unexpected SIM loss and reviewing active payment mandates.
10. QR codes are instructions, not magic money
A QR code may encode a merchant/payment destination or link; a deceptive QR can point to a different beneficiary or unsafe site. A user must verify the recipient and action displayed by the trusted payment app before confirming a payment.
A QR image is not evidence that a company or charity is genuine.
11. ATM and card fraud
Common risks include:
- card skimming or tampered terminals;
- shoulder surfing of PIN;
- lost/stolen cards;
- fake merchant/payment pages;
- card-not-present credential theft.
Practical safeguards: shield PIN entry, review alerts, use card controls where available and notify the issuer promptly of misuse.
12. Malware and ransomware
Malware is malicious software. Ransomware can encrypt or disrupt systems and demand payment. For a bank, resilience means preventing compromise, maintaining safe backups, limiting lateral movement and restoring services.
No legitimate organisation should assume that paying a ransomware demand guarantees recovery or confidentiality.
13. DDoS and availability
A Distributed Denial-of-Service (DDoS) attack floods or exhausts public-facing services. It primarily threatens availability. DDoS does not necessarily mean customer account data have been stolen.
14. Bank defence in depth
Banks combine controls at multiple levels:
- secure development and change management;
- access controls and segregation of duties;
- multi-factor authentication;
- encryption and secure key management;
- network and endpoint monitoring;
- transaction-anomaly detection;
- incident response and business continuity;
- independent review, audit and customer communication.
The lesson is layers: no single password or firewall provides complete protection.
15. RBI's payment security and IT-governance framework
RBI's Digital Payment Security Controls Directions prescribe a governance and controls framework for the relevant regulated institutions and channels. RBI's IT governance and outsourcing requirements provide additional oversight for covered entities.
Rules for banks, card-issuing NBFCs and non-bank payment-system operators are not automatically identical. A current page should preserve appliesTo metadata.
16. EWS, red-flagging and institutional fraud classification
Early Warning Signals (EWS) are indicators of possible fraud or deterioration. A Red Flagged Account (RFA) is an account identified for closer investigation under the bank's applicable fraud-risk framework.
Under RBI's revised Fraud Risk Management Directions, 2024, governance, fair procedures, detection and regulatory/law-enforcement reporting have defined roles.
Crucial distinctions:
- A cybersecurity alert is not a judicial finding of guilt.
- A customer reporting that they were scammed is not automatically the same thing as a bank classifying the customer's own loan account as fraud.
- A fraud classification is not the same as an NPA classification or a conviction.
17. Natural justice and fraud-risk decisions
Fraud-related institutional decisions can cause severe consequences. Applicable RBI directions therefore require safeguards such as due process where they apply. A bank must not confuse suspicion with final proof or disregard legally required opportunity to respond.
Detailed credit-account fraud, recovery and wilful default are covered in Modules 07 and 14.
18. Consumer financial cybercrime reporting
In India, a person who suspects financial cyber fraud should act immediately:
- Report to the bank/card issuer/payment provider through its official fraud-reporting channel; request blocking and a complaint/reference number.
- Report cyber financial fraud to 1930 and/or the official National Cyber Crime Reporting Portal:
https://cybercrime.gov.in/. - Preserve transaction reference numbers, dates, screenshots and communication records.
- Secure devices/accounts through trusted channels and follow official follow-up directions.
Early reporting can improve the chances of tracing/freezing funds. Recovery is not guaranteed. The helpline/portal is a law-enforcement coordination channel, not a replacement for the bank's direct notification process or RBI Ombudsman procedure.
19. Beware of recovery scams
Fraud victims may later receive fake calls offering guaranteed recovery for an advance fee, OTP or access to their account. Use only official institution/portal contacts. Do not disclose PINs, passwords or OTPs even to a person claiming to be an investigator.
20. Cyber fraud vs banking liability
A criminal complaint asks authorities to investigate suspected wrongdoing. A bank complaint seeks action on the account/transaction and a liability determination where applicable. An RBI service grievance asks whether the regulated entity failed to provide required service.
These are related but different questions and can have different evidentiary and timing requirements.
21. Privacy and data breach response
An identity-data breach and an unauthorised debit are different incidents. Organisations may have applicable security, notification and privacy obligations under RBI and data-protection rules. India's DPDP Rules, 2025 provide phased commencement, so check which obligations are operational for the entity and event.
22. Case study — fake KYC update
Scenario: A caller claims an account will be frozen in ten minutes unless the customer opens a link and enters a password and OTP.
Warning signs: urgency, unsolicited link, request for secret credentials, unverifiable caller identity.
Safer response: stop the interaction, use the bank's known app/website/branch to confirm, secure the account if details were shared, and report quickly if money was transferred or account access compromised.
BA-12-03 — Quick check
- What does CIA stand for in information security?
- What is the difference between authentication and authorisation?
- What distinguishes vishing from phishing?
- Does entering a UPI PIN normally receive money?
- Is EWS an automatic finding of fraud?
- What two channels should a fraud victim contact immediately?
Answers: (1) Confidentiality, Integrity, Availability. (2) Identity verification vs permitted actions. (3) Voice social engineering vs mainly e-mail/site deception. (4) No. (5) No. (6) The bank/payment provider and national cybercrime reporting (1930/portal).