A couple of days ago, Finance Minister Nirmala Sitharaman met top bank chiefs to discuss risks emerging from artificial intelligence (AI), a challenge the banking sector has long dealt with in the background, mostly on the customer-facing side.
But this meeting carried a different message. The tone was more urgent, and the warning was sharper. For years, the biggest risks confronting banks were bad loans, liquidity stress and market volatility. Those concerns have not disappeared.
Yet a new category of risk is moving quickly up the agenda: AI-powered fraud, cyberattacks and identity manipulation that can move far faster than many traditional controls were built to handle. This is what makes the meeting, and Sitharaman’s warning, worth paying attention to.
The immediate focus came amid global attention around Anthropic’s Mythos, an advanced AI model whose cybersecurity capabilities have triggered debate over whether frontier systems could be misused to detect vulnerabilities, automate attacks or accelerate fraud attempts.
We also explained the Mythos debate and why it caught the government’s attention in a separate report.
Whether Mythos becomes the defining example or not, the broader message is clear: banks are increasingly digital institutions facing increasingly digital threats.
They process millions of transactions, run always-on mobile apps, manage highly sensitive customer data and support payment systems relied on daily by households and businesses. In that environment, cyber risk is no longer a side issue. It is becoming a core business risk.
To understand how serious the threat could become, we dug deeper into the risks banks face from AI and spoke to experts across the cybersecurity and technology sectors.
FRAUD IN THE AI ERA
Beenu Arora, Co-founder and CEO of Cyble, an AI-powered cybersecurity and threat intelligence company, said banks are attractive targets because they are “data-heavy digital platforms”
He added that with the rise of AI, the nature of cyberattacks has changed. Rather than being “manual or sporadic”, attacks are now “automated, scalable and more difficult to detect”.
That has practical consequences. Arora warned that banks face a major evolving risk in AI-based social engineering.
“Deepfakes can replicate the voices and/or video images of senior executives in order to authorise fraudulent transactions or manipulate employee actions,” he said.
He also said generative AI is being used to create “hyper-personalised phishing messages”, increasing the chances of success while blurring the line between legitimate and fraudulent communication.
Another concern is synthetic identity fraud. Arora said AI is helping create digital identities built from a combination of real and fictitious information. Such identities can bypass KYC checks, obtain loans and disappear before detection.
He added that AI tools can also monitor bank systems for vulnerabilities in real time, allowing attackers to exploit weaknesses quickly. In some cases, adversarial AI can manipulate fraud-detection algorithms, weakening internal controls.
The speed of such attacks means fraud losses can mount within minutes, or even seconds, before containment measures are activated.
ARE BANK’S RELYING ON OUTDATED TECH?
Dr. Kanishk Agarwal, Chief Technology Officer at Judge Group, said Sitharaman’s engagement reflects a changing understanding of financial risk.
“A new force multiplier for financial crime is now the artificial intelligence tool,” he said.
According to Agarwal, what sets AI threats apart is not only sophistication, but also “the velocity and scale of these threats”.
He argued that fraud should no longer be seen as a one-off incident, but as something that continually adapts and blends more easily into legitimate business environments.
Agarwal also questioned whether older trust systems remain sufficient. “For alarmingly long, banks have relied heavily on the layered security model,” he said, pointing to one-time PINs, voice authentication and behavioural analytics.
However, he warned that “artificial intelligence is systematically destroying the security value of each of these components”.
As examples, he said deepfake audio has undermined voice authentication, while AI-generated behavioural patterns can impersonate legitimate users. “Identity itself can be replicated,” he said.
That concern extends beyond fraud losses.
Agarwal said AI-enabled fraud could pressure banks’ balance sheets through higher provisioning needs, weaker profitability and strain on capital adequacy metrics. Large deposit outflows following fraud events could also create liquidity stress for some institutions.
He added that regulators are likely to place more emphasis on cyber resilience, with failures potentially leading to penalties, higher compliance costs and stricter capital requirements.
“This means that cybersecurity has become a financial priority for boards instead of just being an issue for IT,” he said.
Both executives pointed to the need for a more proactive defence model.
Arora said traditional approaches to cybersecurity “cannot keep up with today’s ever-changing threat environment”, adding that banks need AI-driven defences, continuous monitoring and stronger collaboration across the financial ecosystem.
Agarwal said lenders need to re-calibrate risk frameworks and defence strategies, integrating AI into security architecture rather than treating it as a standalone application or isolated tool.
He also highlighted the growing importance of real-time anomaly detection, federated intelligence sharing and scenario-based stress testing for cyber events.
For years, AI has been discussed mainly as a growth story, a tool for productivity, automation and innovation. Now it is being discussed in the same room as deposits, payment continuity and systemic trust.
That is the real significance of Sitharaman’s warning. Banks still need to embrace technology to remain competitive. But they now face a second challenge at the same time: protecting themselves from the very technologies reshaping India’s rapidly growing digital economy.
