Data leaks to cyber frauds: How safe is your money and personal information with banks?

For decades, bank deposits have been a natural choice for people looking to keep their savings safe. When gold, real estate and stock markets turn volatile, bank deposits offer a sense of stability, giving people a place to park their money without worrying about market ups and downs.For most savers, it is not so much about earning the highest returns as it is about the comfort of knowing that your hard-earned money is safe.But that sense of trust is now beginning to show cracks.As banking shifts increasingly towards digital platforms, the nature of threats is changing too. Bank thefts are no longer limited to physical break-ins or robberies. Today, money can disappear with just a few clicks, sometimes before customers even realise that something has gone wrong.The risks also go beyond stolen cards and suspicious phone calls. Customer information surfacing on the dark web, data leaks and alleged involvement of bank employees in frauds involving transactions worth crores have brought newer concerns to the fore.(function(){function e(){window.addEventListener(`message`,function(e){if(e.data[`datawrapper-height`]!==void 0){var t=document.querySelectorAll(`iframe`);for(var n in e.data[`datawrapper-height`])for(var r=0,i;i=t[r];r++)if(i.contentWindow===e.source){var a=e.data[`datawrapper-height`][n]+`px`;i.style.height=a}}})}e()})();Recent incidents suggest that the trouble is coming from more than one corner. SBI recently flagged 3,897 customer records suspected to have surfaced on the dark web, raising concerns about just how safely banks are guarding customer information. In another case, the Enforcement Directorate searched 19 locations across Haryana and Chandigarh over the alleged embezzlement of Rs 590 crore from Haryana government accounts held with IDFC First Bank.And the list doesn't end there.The CBI arrested a PNB office assistant in Greater Noida and a Pune-based individual over an alleged Rs 10.24 crore fraud at the bank's Pi Sector branch.Clearly, keeping money in a bank may still feel like a safe bet, but keeping it safe is becoming a bigger question.Rs 48,021 crore lost, yet customer trust remains intactAccording to the Reserve Bank of India's Annual Report 2025-26, the amount involved in bank frauds jumped to Rs 48,021 crore in FY26, from Rs 32,803 crore in FY25. Interestingly, the number of reported fraud cases involving Rs 1 lakh and above actually fell to 10,114 in FY26, compared with 23,722 in FY25 and 35,800 in FY24, as per an ET report.But fewer reported cases have not translated into smaller losses. Loan-related frauds accounted for nearly 85% of the total amount involved in FY26, with advances and lending operations emerging as the biggest contributors to both the number of cases and the amount involved.This is a shift from FY24 and FY25, when card, internet and digital payment frauds accounted for the highest number of cases.And the worrying trend goes beyond bank accounts. Data from the Union home ministry's national cybercrime reporting portal and the Citizen Financial Cyber Fraud Reporting and Management System show that more than 53.87 lakh cyber fraud complaints were registered between FY24 and FY26, involving over Rs 56,087 crore.Of this amount, more than Rs 9,079 crore was marked as lien, while just over Rs 206 crore was refunded. The gap between the amount reported as lost and the money refunded shows how difficult it can be for victims to recover their savings.(function(){function e(){window.addEventListener(`message`,function(e){if(e.data[`datawrapper-height`]!==void 0){var t=document.querySelectorAll(`iframe`);for(var n in e.data[`datawrapper-height`])for(var r=0,i;i=t[r];r++)if(i.contentWindow===e.source){var a=e.data[`datawrapper-height`][n]+`px`;i.style.height=a}}})}e()})();Despite these concerns, customers have not stopped trusting banks with their money and personal information.An EY report based on a survey of 2,030 banking customers found that 82% trust banks with their data. However, confidence appears less reassuring when it comes to dealing with fraud: only 73% believe banks resolve such cases effectively.Data leaks: How hackers get into your profilesA data leak may not give criminals direct access to bank accounts, but it can provide enough personal information to make targeted fraud more convincing. Banking data can be exposed through cyberattacks on banks or their vendors, phishing, malware, insider misuse and misconfigured systems, Adam Marrè, chief information security officer at Arctic Wolf, a global security operations firm, told TOI.The compromised information can include personal details, account numbers, login credentials, transaction histories and KYC records. Banks' growing dependence on external technology partners creates additional vulnerabilities, says Paramdeep Singh, founder of Long Tail Ventures.“Banking data is compromised through cyberattacks, phishing, insider misuse and vulnerabilities at third-party service providers. The last is particularly concerning given banks’ growing dependence on external technology partners. Leaks typically expose personal details, account information, transaction histories and KYC records. These may not enable direct account access, but can make targeted fraud considerably more convincing.”Criminals can use these details to impersonate bank officials and trick customers into sharing OTPs or approving fraudulent payments.“The data leak creates the opportunity. The fraud often happens through the conversation that follows,” Singh added.The threat also extends to banks, NBFCs and fintech companies. The Indian Cyber Crime Coordination Centre (I4C) and CERT-In have flagged financially motivated cyberattacks involving AI agents, which exploit unpatched software and misconfigured servers to target fund disbursement systems and payment APIs.“Multi-crore unauthorised transactions through fund disbursement systems and APIs are being found in individual cases,” the advisory said.Criminals may route stolen money through mule accounts across banks and quickly transfer or withdraw it using IMPS and NEFT. They may also delete records to hamper investigations.Financial institutions have been asked to report such incidents to CERT-In and the RBI's DAKSH portal within six hours.Are your bank details at risk? Here's when you should sound alarmOne of the biggest challenges with data breaches is that customers may not realise their information has been compromised until someone tries to misuse it. There may be no immediate warning or suspicious transaction to indicate that their details have fallen into the wrong hands.Singh told TOI, “Customers may discover breaches through bank notifications, security alerts or suspicious transactions. Fraudsters combine stolen information with impersonation, using genuine personal details to gain trust before requesting OTPs, payment approvals or account access.”He added, “The data leak creates the opportunity. The fraud often happens through the conversation that follows.”Marrè advised customers to watch for breach notifications, unexpected password-reset requests, unfamiliar account-access alerts and unrecognised transactions.“When a phishing attempt references recent transactions, account details or personal information, it is often far more effective at convincing a victim to disclose additional information or authorize fraudulent transactions,” Marrè added.Beyond immediate financial fraud, exposed information can also be used for identity theft or account takeovers, meaning the risks may persist even when no money is stolen immediately after a breach.Caught in a data breach? Don't wait, act When it comes to banking fraud, waiting to see what happens can prove costly. Whether your personal information has been exposed or you spot an unauthorised transaction, acting quickly is important. Here are the steps customers should take to protect their money and limit further damage:Contact your bank immediately: Report any suspected data breach or unauthorised activity without delay. If your account has been compromised, ask the bank to block affected cards or payment instruments.Change your passwords: If personal information has been exposed, update passwords for potentially affected accounts. Also enable multi-factor authentication for an additional layer of security.Secure your email account: Criminals may use your email to reset passwords or intercept important banking alerts. Change its password and enable multi-factor authentication.Monitor your accounts: Regularly check transactions, login attempts and account changes. Do not ignore even small unfamiliar charges, as criminals may use them to test an account before attempting larger transfers.Report financial cyber fraud: If money has been stolen, call the cyber fraud helpline at 1930 or report the incident at cybercrime.gov.in.Keep a record of complaints: Singh advises customers to file a written complaint and preserve transaction records and acknowledgements. Keep records of all communications with the bank in case the matter needs to be escalated.Approach the RBI Ombudsman if needed: If the bank rejects the complaint, fails to resolve it adequately or does not respond within 30 days, customers can approach the RBI Ombudsman.Continue monitoring your accounts: Reporting an incident does not mean the risk is over. Stolen information can circulate among criminal groups for months or even years, making it important to keep checking bank accounts and credit reports.How much money can customers get back?When money is stolen from a bank account, getting it back is not always guaranteed. The chances of recovery depend on how quickly the fraud is reported, the payment method used and whether the funds can be frozen before criminals move them through other accounts or overseas. Reporting the fraud at the earliest can improve the chances of stopping the money from moving further.However, recovering stolen funds and getting compensation from the bank are two different matters.Singh says there is no universal recovery percentage, as the outcome depends on the circumstances of the fraud and who was responsible for the loss. Under the RBI's existing framework, customers generally have zero liability if the loss is caused by bank negligence.Qualifying third-party breaches reported within three working days also attract zero liability, while reporting within four to seven working days can result in limited liability. Customer negligence, however, can change the outcome.“Recovering stolen funds and receiving reimbursement under RBI's liability rules are different matters.”The compensation framework is also set to evolve.From January 2027, revised RBI rules will introduce conditional compensation for certain small-value frauds, subject to eligibility requirements.Separately, the Supreme Court has called for financial institutions to compensate victims by at least the amount lost when an investigation establishes that the fraud resulted from a bank's failure of due diligence. According to the court proceedings, the proposed RBI directions are expected to be notified by November 30 and operationalised by December 31.(function(){function e(){window.addEventListener(`message`,function(e){if(e.data[`datawrapper-height`]!==void 0){var t=document.querySelectorAll(`iframe`);for(var n in e.data[`datawrapper-height`])for(var r=0,i;i=t[r];r++)if(i.contentWindow===e.source){var a=e.data[`datawrapper-height`][n]+`px`;i.style.height=a}}})}e()})();What banks do to make things right?A data breach is not merely a technology failure but also a test of how effectively a bank protects customer information.Shilpa Pimple, managing partner – BFSI & fintech, Executive Access India Pvt Ltd, told TOI that data security must be an organisation-wide responsibility, not just that of the chief information security officer (CISO) or technology team.“Clear accountability across functions, regular independent risk reviews, regular external audits and stronger oversight of external partners can make a real difference,” she said.Banks must also monitor technology partners, identify security gaps, act quickly when breaches occur and inform affected customers about exposed information and precautionary steps, says Adam Marrè.Paramdeep Singh stresses the need to examine vulnerabilities in vendors' systems and strengthen internal controls. “Outsourcing technology should never mean outsourcing accountability,” he says.The I4C advisory also calls for tracking payment-related APIs, disabling unused ones and improving coordination between cybersecurity, transaction-monitoring and IT teams.Beyond data security, banks must prevent suspicious transactions. Chief Justice Surya Kant has urged them to act as a “protective umbrella” for vulnerable customers by flagging unusual activity, pausing suspicious payments and verifying high-value transfers.The Supreme Court's call for compensation where banks fail in their due diligence further reinforces their responsibility to protect customers, rather than act only after money is lost.You use AI every day. Now get your AI Quotient. Take the AIQ test.