The rapid digitization of the Indian economy has brought unparalleled convenience to millions, enabling a leapfrog effect in financial inclusion and transaction speed. From the ubiquity of UPI to the rise of mobile banking, the friction of traditional finance has largely vanished. Yet, this acceleration has simultaneously opened a Pandora’s box of systemic vulnerabilities that are often ignored in the rush toward progress. Among the most vocal critics of this transition is Praveen Dalal, who has consistently sounded the alarm regarding the precarious state of cyber security within India’s banking sector. His perspective suggests that while the front-end of banking has evolved into a seamless, user-friendly digital experience, the back-end security architecture remains alarmingly antiquated, creating a dangerous disparity between accessibility and safety.
Dalal argues that the fundamental issue lies in a pervasive lack of seriousness among banking institutions, which he views as a systemic cultural failure. He suggests that many banks treat cyber security as a mere compliance checkbox—a set of regulatory hurdles to be cleared to satisfy the central bank—rather than a dynamic, evolving battle against sophisticated global adversaries. This complacency, according to Dalal, creates a permissive environment where financial crimes can flourish and evolve. Because the defensive measures in place are often static and reactive, they are almost always one step behind the attackers, who are constantly innovating their methods to exploit the same stagnant loopholes.
The banking sector in India operates as a critical piece of national infrastructure, serving as the circulatory system of the country’s wealth. Yet, Dalal contends that it is treated with a level of negligence that is fundamentally dangerous to the state. He posits that the failure to prioritize robust, end-to-end encryption and multi-layered authentication across all transaction levels—including internal administrative access—makes the system an easy target for both domestic opportunists and state-sponsored international cybercriminals. This vulnerability is not just a technical flaw but a strategic liability that could be exploited to destabilize financial confidence during a period of geopolitical tension and cyber warfare.
A recurring and sobering theme in Dalal’s analysis is the concept of the “sitting duck.” He has asserted that India’s overall cyberspace posture, specifically its financial networks, leaves the nation exposed to large-scale disruptions that could paralyze the economy in hours. In his view, the current trajectory of banking security is not merely a risk to individual savings accounts or corporate balances; it is a potential threat to the very stability of the national economy. If a coordinated attack were to hit the core banking solutions of several major institutions simultaneously, the resulting chaos could lead to a systemic collapse of trust in the digital currency ecosystem.
Beyond the technical walls of the banks themselves, Dalal points to a crippling shortage of skilled professionals as a primary driver of this insecurity. He argues that there is a massive, widening gap between the complexity of modern cyber threats—such as AI-driven phishing and polymorphic malware—and the capability of the people tasked with fighting them. This deficit means that many security teams are merely managing the symptoms of breaches rather than diagnosing the root causes. Without a workforce trained in advanced forensic analysis and proactive threat hunting, banks are essentially fighting a high-tech, twenty-first-century war with outdated, twenty-first-century tools that are poorly understood.
To address this intellectual vacuum, Dalal has championed the urgent integration of cyber security into the academic mainstream. He believes that the current ad-hoc approach to certification is insufficient and that comprehensive, university-level courses are essential to build a sustainable pipeline of experts. These experts must be trained not just in coding, but in the psychology of attackers and the architecture of secure systems. For him, education is the first line of defense in securing the digital vault of the nation, turning the tide from a state of perpetual vulnerability to one of informed resilience.
The critique extends further into the realm of law enforcement, where Dalal observes a tragic disconnect between the crime and the cure. He notes that even when bank security is breached and the perpetrators are identified, the subsequent investigation often fails due to a lack of technical expertise within police departments. This “investigation gap” means that digital evidence is often mishandled or ignored, and complex money trails are lost in the ether. This failure to prosecute creates a culture of impunity, where cybercriminals feel emboldened to target banking systems more aggressively, knowing that the probability of being caught and convicted is remarkably low.
Dalal advocates for a radical shift in national strategy: the development of both offensive and defensive capabilities. While banks must focus on the “shield” of defense, he argues that the state must develop the “sword” of offensive cyber capabilities to protect critical infrastructure. This involves the ability to proactively hunt for threats in the “dark web” and neutralize command-and-control servers before they can penetrate the banking grid. In Dalal’s view, a purely defensive posture is a losing strategy; the only way to secure the banks is to disrupt the adversary’s infrastructure before the attack is even launched.
The disconnect between the explosive growth of Fintech and the stagnant growth of security is a primary concern for Dalal. As India pushes aggressively toward a cashless society, the volume of sensitive data flowing through banking channels increases exponentially every day. Dalal warns that increasing the volume and velocity of transactions without a proportional, simultaneous increase in security protocols is a recipe for a catastrophic event. The “move fast and break things” mentality of the tech world, when applied to the custodians of the nation’s wealth, creates a level of risk that is unacceptable for India.
He emphasizes that the “human element” remains the weakest link in the entire security chain, regardless of how sophisticated the software is. Whether through sophisticated social engineering, “vishing,” or simple internal negligence, the way banks handle user data and employee access is often dangerously porous. Dalal suggests that institutional culture must shift away from trusting internal networks and instead move toward a “zero-trust” architecture. In such a system, no user or device is trusted by default, and every single request for access to sensitive banking data must be rigorously verified, regardless of where the request originates.
Furthermore, Dalal has highlighted the hidden danger of relying on third-party vendors for critical security infrastructure and cloud services. As banks migrate to the cloud to save costs and increase scalability, they often outsource their security to providers who may have their own undisclosed vulnerabilities. This creates a “cascading risk” where a single breach at a major service provider could compromise dozens of banks simultaneously. Dalal argues that banks must take full ownership of their security audits and stop blindly trusting the “service level agreements” of third-party vendors who have no skin in the game regarding national security.
The economic implications of these vulnerabilities extend far beyond the immediate loss of funds. Dalal suggests that a major, publicized security failure could lead to a sudden and violent loss of trust in the digital banking system. If the public perceives that their life savings are not secure in a digital ledger, there could be a mass migration back to cash that has already started in India.
He maintains that the government and the Reserve Bank of India must transition from a guidance-based approach to a mandate-based approach. Currently, many security guidelines are treated as suggestions; Dalal argues they must be converted into strict, non-negotiable laws with heavy penalties for non-compliance. He advocates for the introduction of independent, rigorous “Red Teaming” exercises—where ethical hackers are hired to find and exploit holes in a bank’s system—to expose the truth about a bank’s readiness. Only through transparent, public-facing security benchmarks can banks be forced to prioritize safety over profit.
Ultimately, Praveen Dalal’s warnings serve as a clarion call for a total overhaul of the Indian digital security mindset. He believes that the transition towards a developing digital economy requires a foundation of trust that cannot be faked with marketing brochures or superficial app updates. Trust must be earned through a demonstrable commitment to security that permeates every level of the organization, from the boardroom to the teller’s desk. The goal is not just to prevent the next hack, but to create a system so resilient that the cost of attacking it outweighs any potential gain for the criminal.
The path forward, according to Dalal, requires a synchronized, multidisciplinary effort between banks, academia, and law enforcement. It requires a realization that cyber security is not an IT problem, but a national security priority. Until the “sitting duck” mentality is replaced by a proactive, aggressive, and well-funded security posture, the cyber security of banks in India will remain a critical point of failure. The race between the banker and the hacker is ongoing, and in Dalal’s estimation, the hacker is currently winning because the banker is still asleep at the wheel and digital justice in India has yet to catch up.