Pallab Bhattacharyya
(Pallab Bhattacharyya is a former director-general of police, Special Branch and erstwhile Chairman, APSC. Views expressed by him is personal. He can be reached at pallab1959@hotmail.com)
In one corner of the world, an unsuspecting customer receives a seemingly genuine phone call from a bank executive and unknowingly discloses a one-time password. In another, cybercriminals exploit thousands of mule accounts to syphon away stolen money within minutes, making recovery almost impossible. The famous Bangladesh Bank SWIFT heist, the rise of digital payment frauds in India, clever phishing attacks aimed at online banking users, and AI voice-cloning scams that have fooled even seasoned bankers all highlight a worrying truth: banks are no longer robbed by armed thieves breaking into vaults; instead, they are quietly attacked through keyboards, harmful software, artificial intelligence, and a growing digital world. The rapid rise of mule accounts—bank accounts opened or operated by individuals who knowingly or unknowingly transfer illicit funds on behalf of cybercriminals—has further complicated the challenge by creating an intricate laundering network that conceals the identity of fraudsters while frustrating law enforcement agencies.
The banking industry is undergoing the most profound technological transformation in its history. Traditional brick-and-mortar institutions have evolved into digital enterprises operating through mobile applications, internet banking, UPI, ATMs, APIs, cloud platforms and AI-driven customer services. While this transformation has brought unprecedented convenience, financial inclusion and operational efficiency, it has simultaneously enlarged the attack surface available to cybercriminals. Every connected device, every third-party vendor, every cloud interface and every digital payment channel has become a potential point of entry for malicious actors. Consequently, cybersecurity is no longer merely an information technology concern; it has become a strategic imperative demanding the direct attention of boards of directors, regulators and policymakers.
The basic ideas behind banking security are still based on keeping information private, safe, and available. Now, authenticity, accountability, and non-repudiation join these ideas. Yet the modern digital environment demands that these principles be implemented across highly complex ecosystems involving banks, fintech companies, payment gateways, cloud providers and technology vendors. The increasing diffusion of ownership and custody of financial data has raised difficult questions regarding accountability, data localisation, and regulatory compliance. I
Artificial intelligence has dramatically altered the threat landscape by serving as both an offensive weapon and a defensive shield. Cybercriminals now employ generative AI to produce convincing phishing emails, malware capable of adapting to defensive measures, deepfake videos and cloned voices that can successfully impersonate bank executives or trusted customers. AI-powered social engineering attacks are becoming so sophisticated that traditional verification mechanisms such as passwords, voice recognition and even conventional multi-factor authentication are increasingly vulnerable. Agentic AI—systems that can perform complex tasks on their own with little human help—brings new worries by finding weaknesses, planning attacks, and greatly shortening the time banks have to notice and deal with breaches.
Equally significant is the rise of AI as the most powerful defensive technology available to financial institutions. Machine learning algorithms can analyse millions of transactions in real time, identify behavioural anomalies, detect fraudulent payment patterns and continuously authenticate users through behavioural biometrics. AI-powered security operations centres are enabling banks to automate threat detection, prioritise alerts and reduce incident response time from hours to minutes. Predictive analytics is helping institutions identify emerging fraud patterns before they become widespread. Artificial intelligence is not replacing human expertise; instead, it is helping security professionals by letting them focus on more difficult strategic decisions while machines take care of routine monitoring and analysis.
If artificial intelligence represents the present challenge, quantum computing embodies the strategic threat of the future. Modern banking depends fundamentally upon cryptographic algorithms such as RSA and elliptic curve cryptography to protect digital transactions, online banking sessions and secure communications. Quantum computers possess the theoretical capability to break these encryption methods, rendering today’s security infrastructure obsolete. More worrying is the “harvest now, decrypt later” strategy, whereby adversaries collect encrypted financial data today with the expectation of decrypting it once sufficiently powerful quantum computers become available. Mortgage records, customer identities, transaction histories, and confidential communications that remain valuable for decades are already at risk of future compromise.
Recognising this emerging danger, the United States National Institute of Standards and Technology has finalised the world’s first post-quantum cryptographic standards, encouraging governments and financial institutions to begin migration without delay. Global regulators increasingly view quantum readiness as a matter of financial stability rather than merely technological preparedness. The migration is very complicated, as banks need to find all their cryptographic assets in old systems, payment networks, hardware security modules, and third-party applications before slowly starting to use hybrid and eventually fully quantum-resistant encryption technologies.
Regulatory frameworks worldwide have evolved rapidly in response to these changing realities. The Reserve Bank of India has greatly improved cybersecurity management by requiring board oversight, creating special IT strategy committees, continuously monitoring, having 24/7 security operations centres, enforcing strict vendor risk management, and setting six-hour reporting rules for major cyber incidents. The Digital Personal Data Protection Act has further reinforced obligations relating to data privacy, consent management and information security. Internationally, the European Central Bank now requires large banks to create detailed plans for using AI safely in relation to cybersecurity, while the Basel Committee on Banking Supervision and the Financial Stability Board are encouraging consistent rules for managing cyber risks, reporting incidents, and ensuring operational resilience across different countries.
Among global best practices, Zero Trust Architecture has emerged as perhaps the most influential security philosophy. Unlike traditional perimeter-based models that assume trust within organisational boundaries, Zero Trust requires continuous verification of every user, device and application irrespective of location. Combined with privileged identity management, behavioural analytics, network segmentation and least-privilege access, it significantly reduces the likelihood of attackers moving laterally after breaching an initial defence. Financial institutions are also strengthening resilience through continuous vulnerability assessments, penetration testing, threat intelligence sharing, ransomware recovery planning, cyber insurance, supply-chain audits and regular crisis simulation exercises.
Human behaviour, nevertheless, remains both the greatest vulnerability and the strongest defence. Despite remarkable technological advances, many successful cyberattacks continue to exploit human psychology rather than technical weaknesses. Comprehensive customer awareness campaigns, employee training, phishing simulations and specialised education on recognising AI-generated content are therefore indispensable. Banks must also strengthen collaboration with telecom providers, fintech companies, law enforcement agencies and international intelligence-sharing platforms to rapidly identify mule accounts, disrupt organised fraud networks and recover stolen assets before they disappear through complex financial channels.
Looking ahead, banking security will increasingly become an intelligent, adaptive and collaborative discipline rather than a static technological function. Artificial intelligence will automate defence as rapidly as it empowers attackers. Quantum-safe cryptography will gradually replace today’s encryption standards. The next generation of financial security will be shaped by tools like behavioural biometrics, continuous authentication, explainable AI, privacy-enhancing technologies, and autonomous threat-hunting platforms. At the same time, the increasing overlap of digital finance, open banking, embedded financial services, and cross-border payment systems will need new levels of teamwork between regulators and stronger global protection against cyber threats.
The future of banking security will therefore depend not merely upon stronger firewalls or better encryption but upon a holistic culture that integrates technology, governance, regulation, human awareness and international cooperation. In an era where fraudsters exploit algorithms instead of firearms and artificial intelligence instead of physical force, the strongest bank will not necessarily be the one with the largest vault but the one with the smartest intelligence, the deepest resilience and the fastest capacity to anticipate, withstand and recover from an ever-evolving digital battlefield.