When the RBI asked major banks and NBFCs to name their biggest cyber risk for the coming year, the answer was not ransomware or insider threat. It was AI-enabled attacks. That finding, recorded in the Financial Stability Report, is worth taking seriously — these are institutions with mature security functions describing what worries them most.
Why AI Changes the Attack Side
Most attack techniques are not new. What changed is cost, scale and skill requirement — the three things that historically limited how much damage a given attacker could do.
| Attack | Previously | Now |
|---|---|---|
| Phishing | Generic, often poorly written | Fluent, personalised, in any Indian language |
| Voice impersonation | Required skill or was implausible | Cloned from seconds of public audio |
| Identity fraud | Forged documents | Synthetic identities and deepfake video |
| Vulnerability discovery | Manual research | Partially automated |
| Malware variation | Manual modification | Automated variants defeating signature detection |
| Target research | Time-consuming per target | Automated across many targets |
The change that matters most for Indian banks is the second row of the phishing line. Regional-language phishing was historically limited by the attacker’s fluency. Generated text removed that constraint entirely, opening a much larger population to convincing attacks.
The Attack Surface
Against customers
The highest-volume category. Voice cloning and deepfakes targeting individuals, personalised phishing, and social engineering that references genuine details harvested from public sources.
Banks carry the consequences of these even though the attack targets the customer — through liability rules, reputational damage and complaint volume.
Against staff
The executive instruction attack — a convincing call or video call from a senior figure authorising an urgent transfer, with normal approvals bypassed. This exploits hierarchy rather than technology, which is why technical controls do not stop it.
Against systems
Automated reconnaissance, faster vulnerability discovery, and malware that varies itself to defeat signature-based detection.
Against AI models themselves
This category is newer and less understood:
| Attack | What it does |
|---|---|
| Adversarial input | Crafted inputs that cause a model to misclassify |
| Model evasion | Probing a fraud model’s boundaries, then operating just inside them |
| Data poisoning | Corrupting training data so the model learns the wrong thing |
| Prompt injection | Instructions hidden in content that redirect an AI assistant’s behaviour |
| Model extraction | Repeated queries to reconstruct proprietary model logic |
Prompt injection deserves attention as institutions deploy AI assistants. If an assistant reads customer emails or uploaded documents, instructions embedded in that content can attempt to redirect it. The assistant cannot reliably distinguish instructions from the institution from instructions in the material it was asked to read.
Why Defence Is Structurally Harder
Three asymmetries work against defenders.
Attackers need one success; defenders need to stop all attempts. This is not new, but automation multiplies the number of attempts.
Detection lags generation. Models trained to spot synthetic media learn today’s artefacts. Generation methods change, and detection degrades against techniques that did not exist when it was trained — the same drift problem, but adversarial rather than passive.
The traditional signals disappeared. Bad grammar, generic wording, implausible voice — a generation of user training relied on indicators that no longer work.
What Actually Helps
The most effective controls share one property: they do not require telling real from fake.
| Control | Why it survives |
|---|---|
| Callback verification on a known number | The attacker does not control your stored contacts |
| Out-of-band confirmation for high-value instructions | Requires compromising two independent channels |
| Mandatory approval regardless of seniority | Removes the hierarchy exploit entirely |
| Hardware security keys | Cannot be phished or socially engineered |
| Transaction limits and delays on new payees | Creates time for detection regardless of how convincing the request was |
| Behavioural and device signals | Corroborates identity beyond voice or appearance |
The first three are procedural rather than technical, and that is the point. A policy stating that transfers above a threshold require a callback on a stored number defeats voice cloning entirely — not by detecting the clone, but by making detection unnecessary.
The Regulatory Direction
The FREE-AI framework proposes expanding several existing RBI master directions to cover AI, and cybersecurity is among them. The framework’s scope extends beyond regulated entities to their technology vendors and cloud providers, which matters here because much of the AI stack is outsourced.
Institutions are expected to consider AI risk across the full lifecycle — including risks to the models they deploy, not only risks from external attackers.
Key Takeaways
- Banks and NBFCs named AI-enabled cyber threats their biggest cyber risk in RBI’s FSR
- What changed is cost, scale and skill requirement, not the techniques themselves
- Regional-language phishing is now as fluent as English — a major change for India
- Four surfaces: customers, staff, systems, and the AI models themselves
- Prompt injection is an emerging risk as institutions deploy AI assistants
- Detection lags generation and degrades adversarially
- Procedural controls beat detection — callbacks and out-of-band confirmation do not require spotting a fake
- Cybersecurity is among the master directions proposed for AI expansion
Frequently Asked Questions (FAQ)
Q: What are AI-enabled cyber threats?
Attacks that use AI to increase their scale, sophistication or credibility — generated phishing in fluent regional languages, cloned voices, deepfake video defeating identity checks, automated vulnerability discovery, and attacks against AI models themselves.
Q: Why do banks consider AI their biggest cyber risk?
Because AI removed the constraints that previously limited attackers — fluency, cost and skill. Techniques that once required expertise are now widely accessible, and the traditional warning signs that staff and customers were trained to spot no longer apply.
Q: What is prompt injection?
Hiding instructions inside content that an AI assistant reads, attempting to redirect its behaviour. If an assistant processes customer emails or uploaded documents, it cannot reliably distinguish legitimate instructions from those embedded in the material it was asked to read.
Q: Can AI detect AI-generated attacks?
Partially, but detection consistently lags generation. Detection models learn the artefacts of current techniques and degrade against methods developed afterwards. This is why procedural controls that do not depend on detection are more reliable.
Q: What is the most effective defence against voice cloning?
Callback verification on a number you already have stored. The attacker controls the call they make but not your contact list, so calling back defeats the attack without needing to judge whether the voice was genuine.
Q: How can staff be protected from executive impersonation?
Mandatory approval procedures that apply regardless of who appears to be asking, combined with out-of-band confirmation for high-value instructions. The attack exploits reluctance to challenge seniority, so the control must remove that discretion entirely.
Q: Does RBI address AI cyber risk?
The FREE-AI framework proposes expanding existing master directions to cover AI, and cybersecurity is among them. Scope extends to technology vendors and cloud providers, and institutions are expected to consider risks to their own deployed models as well as external attacks.
Related Reading: