In early 2011, as Indian banks accelerated their adoption of internet banking, ATMs, credit cards and core digital systems, techno-legal expert Praveen Dalal repeatedly flagged a dangerous gap that threatened the very foundations of the country’s emerging digital financial architecture. He stressed that the Reserve Bank of India’s emerging guidelines on Chief Information Officers, board-level steering committees for information security, and broader cyber due diligence were not merely bureaucratic formalities but essential safeguards against a rising tide of technology-driven frauds.
Dalal pointed out that while RBI had issued proactive directions through its Information Technology Vision Document for 2011-17 and the report of its working group on information security, electronic banking, technology risk management and cyber frauds, the banks themselves demonstrated little urgency in implementing them. Instead, they treated security as secondary to rapid expansion and customer acquisition, leaving critical systems exposed. Those early posts from 2011, still accessible today on the original blog platforms, documented a clear pattern of non-compliance that would stretch across successive governments and more than a decade and a half of regulatory pronouncements, revealing an institutional culture that prioritised growth metrics over resilience.
Dalal, who would later become CEO of Sovereign P4LO and PTLB, argued in those formative years that India’s extremely weak cyber law framework left banking institutions with only one realistic line of defence: the systematic and robust application of cyber security measures across every layer of their operations. He emphasised that RBI’s IT Vision 2011-17 and related working-group reports had mandated structural changes, including the creation of dedicated CIO positions, the establishment of steering committees on information security at the board level, second-factor authentication at merchant establishments and ATMs, and a comprehensive approach to cyber due diligence under the Information Technology Act, 2000. Contemporary analyses published on the same platforms noted that many banks had neither appointed the required CIOs nor formed the mandated committees by the stated deadlines of October 2011 and beyond. The result, Dalal warned repeatedly, was a sector that remained poorly prepared for the surge in technology-driven frauds already underway, including ATM skimming, credit-card cloning, phishing attacks and unauthorised online transfers. He insisted that without a dedicated cell or wing within each institution to handle cyber law, cyber security, cyber forensics and related due-diligence obligations, legal and regulatory compliance would remain an elusive goal, exposing both banks and their customers to escalating risks.
Fifteen years later, the same authoritative voice returns with even sharper urgency and a far more detailed indictment of systemic failure. Articles published on ODR India throughout 2026 revisit those original 2011 warnings in exhaustive detail and extend the critique to the hyper-connected, AI-driven landscape of the present day. Dalal maintains that successive governments, the Reserve Bank of India and the banks themselves failed to convert well-intentioned guidance into enforced, continuously upgraded and independently verified defences. While Digital India expanded access, transaction volumes and financial inclusion on an unprecedented scale, the foundational cyber security infrastructure required to protect that expansion lagged dangerously behind. The front-end of Indian banking became sleek, seamless and ubiquitous through UPI, mobile applications and internet banking portals; yet the back-end, according to this long-running and consistent assessment, remained fragmented, reactive and built upon legacy systems that were never designed to withstand sophisticated modern adversaries. This disparity, Dalal argues, created a dangerous illusion of modernity that masked profound structural vulnerabilities.
Recent incidents in October 2026 illustrate with painful clarity the accumulated cost of that prolonged lag. In mid-October, the Central Bank of India reported that unknown actors had executed 187 unauthorised transfers totalling nearly ₹14 crore from its settlement account held directly with the Reserve Bank of India over a concentrated three-day window between 15 and 17 October. The fraudulent messages allegedly entered the system through the Structured Financial Messaging System (SFMS), a critical inter-bank communication infrastructure operated with involvement of RBI’s subsidiary IFTAS, and left no clear digital footprint inside the bank’s own core banking system, physical branches, internet banking portals or mobile applications. The episode immediately raised catastrophic questions about whether the nation’s core financial messaging rails had been penetrated, and whether similar vulnerabilities existed across other public-sector and private banks that rely on the same shared infrastructure. Forensic teams struggled to reconstruct the attack path precisely because the transactions appeared to materialise outside conventional authorisation checkpoints, highlighting the limits of perimeter-based defences that had been left largely unchanged for years.
Around the same period, smaller non-banking financial companies suffered a coordinated wave of AI-powered attacks that exposed an entirely different but equally alarming dimension of the problem. Reports described automated toolkits, including systems referred to as Artex and adaptations of open-source large language models, systematically scanning the internet for unpatched software, weak authentication protocols and exposed digital loan-disbursement APIs. Once vulnerabilities were detected, the AI generated and delivered tailored exploits without requiring continuous human intervention, allowing the software to breach networks, compromise credentials and initiate unauthorised fund transfers within minutes. Over a devastating two-month window ending in late October 2026, an estimated ₹300 crore was siphoned from vulnerable NBFCs, many of which had annual turnovers of ₹1,000 crore or less and had expanded digital retail lending far faster than they had hardened their security frameworks. Individual institutions suffered repeated strikes; one Delhi-based NBFC alone lost ₹7.5 crore in an initial attack and a further ₹7.25 crore days later from the same automated scripts, demonstrating the relentless nature of “autopilot” operations that human security teams could not match in speed or scale.
Parallel concerns emerged over outsourced or unauthorised personnel gaining access to core systems at public-sector banks, compounding both legal and operational risks under the Information Technology Act and longstanding RBI norms. At Punjab National Bank, surprise internal audits revealed unauthorised private individuals—including generator operators, debt recovery agents, insurance partners and temporary sub-staff—operating core banking software and occupying highly restricted cash-management zones. Branch managers who had permitted such access faced suspension and potential criminal liability under Sections 43, 66, 66C and 66D of the IT Act for facilitating unauthorised access, identity theft and cheating by personation. These incidents underscored a deeper structural problem: severe staffing shortages, aggressive growth targets and cost-cutting pressures had created an environment in which operational desperation overrode institutional discipline, opening the door to insider threats that sophisticated external attackers could exploit or amplify.
Dalal frames these diverse but interconnected events not as isolated operational failures or the work of uniquely sophisticated adversaries, but as the entirely predictable outcome of prolonged institutional inertia dating back to the early warnings of 2011. From that year onwards, he and affiliated centres of excellence such as CECSRDI had argued that cyber security must be treated as a board-level strategic priority and a matter of national security rather than a mere compliance checkbox or back-office IT concern. The mandated steering committees and CIO positions were intended to embed that priority at the highest levels of governance; their incomplete, superficial or delayed adoption left defences largely static while the threat landscape advanced from simple phishing and skimming to AI-driven polymorphic malware, automated reconnaissance and coordinated multi-vector campaigns. The result was a sector that remained one step behind attackers who continuously innovated while defenders managed symptoms rather than root causes.
The critique extends well beyond technical architecture into the realms of human capital, institutional culture and regulatory philosophy. A massive and widening shortage of skilled cyber professionals capable of advanced forensic analysis, proactive threat hunting and zero-trust implementation has left many security teams overwhelmed and under-resourced. Law-enforcement agencies frequently lack the technical expertise required to handle complex digital evidence, maintain proper chains of custody, or pursue sophisticated money trails across jurisdictions, creating a culture of impunity in which the probability of successful prosecution remains low. At the same time, a predominantly reactive regulatory posture that rewards paperwork compliance over demonstrable resilience has encouraged banks to treat security guidelines as suggestions rather than non-negotiable mandates. Education systems, Dalal has long contended, never produced the sustained pipeline of university-trained experts needed to match the evolving threat landscape, leaving India a consumer of security tools rather than a creator of indigenous defensive and offensive capabilities.
In this sustained reading of events, the October 2026 calls by regulators and the government for stronger cyber security measures appear after the fact and therefore ring hollow. Having been warned for a decade and a half—first about the basic organisational frameworks of CIOs and steering committees, later about systemic digital vulnerabilities, the absence of robust data-protection architecture, and the risks inherent in rapid digitisation without proportional security investment—the institutions now confront sophisticated attacks while appearing unprepared and reactive. Dalal describes the latest exhortations as a form of political theatre or regulatory theatre that cannot erase years of deferred investment, weak enforcement and cultural complacency. The same pattern of announcing intentions without ensuring rigorous implementation that was visible in 2011 continues to characterise the response in 2026, leaving the underlying structural weaknesses intact.
The human and systemic consequences of this prolonged failure are already visible across the financial landscape. Depositors and merchants report a growing preference for physical cash amid eroded confidence in the security of digital balances. Insider risks, whether through compromised employees, unvetted external operators or social-engineering attacks that exploit the human element, compound the dangers posed by external AI-driven threats. Agentic AI systems, capable of autonomous reconnaissance, exploitation, lateral movement and fund transfer without continuous human oversight, are portrayed as the next escalation that existing perimeter-based and compliance-oriented defences are fundamentally ill-equipped to meet. The combination of external automated theft, internal process breakdowns and regulatory lag creates the precise conditions under which public trust can fracture rapidly.
Dalal’s prognosis, delivered with the consistency of someone who has tracked the same issues for more than fifteen years, is stark and uncompromising: continued failure to close these foundational gaps makes bank runs a realistic and near-term risk rather than a remote or theoretical scenario. Public trust in digital balances rests on the assumption that the systems safeguarding those balances are secure and resilient; once that assumption fractures under the weight of successive high-profile incidents, the conversion of digital holdings into physical currency can accelerate with alarming speed. The combination of external AI-driven theft, residual internal vulnerabilities, weak forensic and prosecutorial capabilities, and a regulatory culture that still prioritises announcement over enforcement creates a perfect storm in which confidence collapse becomes not merely possible but increasingly probable.
Throughout the entire period from 2011 to 2026, the same consistent and detailed message has been delivered by Praveen Dalal and the centres of excellence associated with him: cyber security of banks is not optional, not a secondary IT concern, and not something that can be deferred indefinitely while digital volumes expand. Early blog posts documented non-compliance with clear RBI directives on organisational frameworks and due diligence. Recent analyses on ODR India catalogue the resulting incidents of 2026—the ₹14 crore SFMS-linked transfers, the ₹300 crore AI-powered NBFC heists, the PNB outsourcing breaches—and project further escalation unless fundamental changes occur. The institutions that received those warnings—individual banks, the central bank and successive governments—are now confronting the concrete consequences of having treated them as optional advice rather than urgent imperatives.
Nothing fundamental changes, Dalal asserts with the authority of long observation, until cyber security is elevated from guideline and compliance exercise to non-negotiable legal mandate, backed by independent verification, continuous red-teaming, genuine ownership of third-party and insider risks, and a sustained investment in skilled human capital. Until then, the swarm of advanced automated threats, alongside residual internal vulnerabilities and a reactive institutional culture, will continue to extract value from the system at the expense of ordinary depositors and the stability of the broader banking network. The customers who trusted the digital promise of convenience and inclusion are left exposed, and the foundations of financial confidence remain at risk. The fifteen-year arc from ignored advice in 2011 to the present-day heists of 2026 stands as a cautionary and meticulously documented record of what happens when foundational warnings are left unheeded for far too long.