MeitY's Digital Threat Report warns India's banks: attackers now target trust, not just transactions

Verified key facts

• MeitY released the second edition of the Digital Threat Report 2025-26 for India's BFSI sector on 13 July 2026, per PIB.
• The report was prepared with CERT-In, CSIRT-Fin and cybersecurity firm SISA.
• Six of seven forward-looking threat predictions from the previous edition have materialised into established risks.
• It identifies trust-chain manipulation, targeting biometric onboarding, APIs, partner apps and AI-driven decisions, as the defining shift.
• An 18-month roadmap urges financial institutions to build continuous monitoring and resilient security architectures.

A government warning shot for the financial sector

The Ministry of Electronics and Information Technology on 13 July released the second edition of the Digital Threat Report 2025-26. The document is the government's flagship assessment of cyber risks facing India's banking, financial services, insurance and digital payments ecosystem. It was produced with the Indian Computer Emergency Response Team, CSIRT-Fin and the cybersecurity firm SISA, according to the Press Information Bureau.

The headline finding is uncomfortable for anyone running a bank. Six of the seven forward-looking threat predictions in the previous edition have already hardened into established risks, the report says. Forecasts of AI-enabled fraud and identity abuse were not alarmism. They were, on the evidence of a year's incident data, understatement.

Timing sharpens the message. The launch lands a week before Parliament's monsoon session opens on 20 July, with digital fraud a recurring public concern. As a second edition, the report also creates a running public record. Institutions can now be measured against last year's warnings, and this year's scorecard is not flattering.

From stealing passwords to bending trust

The report's central concept is what it calls trust-chain manipulation. Attackers are moving away from direct system compromise. They increasingly target the connective tissue of finance instead: biometric onboarding, partner applications, AI-driven decision systems, real-time payments and APIs, Business Standard reported. The password is no longer the front door. The relationship between systems is.

Initial access patterns support that shift. Credential theft and session hijacking have become the dominant entry routes, while social engineering and business email compromise attacks have intensified, according to the report's findings as covered by YourStory. None of these techniques requires breaking encryption. They exploit the human and procedural seams between well-defended systems.

Third-party dependencies get their own warning. Vulnerabilities in vendor software, outsourced operations and partner integrations are now primary targets, the report notes. A bank can harden its own perimeter and still fall through a supplier's carelessness. India's regulators have circled this problem for years; the report elevates it to the top of the threat list.

Why the attack surface keeps growing

The report is candid about the structural cause. India's financial ecosystem is built on interconnected platforms, embedded finance, AI-assisted decisions and real-time payments. Every convenience layer widens the attack surface. UPI's instant settlement, a national achievement, also means stolen money moves at the speed the system was designed to celebrate.

Artificial intelligence cuts both ways in the assessment. Institutions deploy it for fraud detection and customer service. Adversaries deploy it for deepfake-assisted onboarding fraud, tailored phishing and probing of automated decision systems. Dainik Jagran's coverage of the launch flagged AI as the report's fastest-growing risk category. The technology race is symmetrical, and defenders do not automatically win it.

The 18-month homework assignment

The report does not stop at diagnosis. It lays out an 18-month roadmap for financial institutions, pressing them to move beyond strengthening foundational controls, Devdiscourse reported. The prescription centres on continuous monitoring, resilient architectures and the assumption that some compromise is inevitable. Recovery speed, not perimeter perfection, becomes the measure of maturity.

That framing matters for boards as much as for security teams. An architecture-level roadmap with a stated timeline gives the RBI, SEBI and sectoral regulators a reference point for supervision. It also gives chief information security officers a government-endorsed document to take into budget negotiations, which is often the most practical function such reports serve.

The sector's dependence on shared rails compounds the urgency. Payments, identity verification and credit decisions increasingly run through common utilities and interconnected APIs. A weakness in one shared component propagates everywhere at once. Continuous monitoring, the roadmap's central demand, is the only defensive posture that matches that topology.

The national security dimension

Financial infrastructure is critical infrastructure, and the report's provenance signals that the government treats it that way. CERT-In and CSIRT-Fin are incident-response bodies with national mandates, not consultancies. Publishing a joint threat assessment with a private forensics firm reflects a maturing model: the state sets the picture, industry supplies the telemetry, and both share the defence.

The launch drew coverage across business and technology media, including Business Standard and YourStory. That breadth is itself notable. Cyber risk has moved from specialist bulletins into mainstream financial journalism, and the attention is protective. Fraud economics depend on unawareness, and every cycle of public reporting raises the cost of the simplest attacks.

• Released: 13 July 2026, by MeitY with CERT-In, CSIRT-Fin and SISA.
• Key shift: trust-chain manipulation across onboarding, APIs, partners and AI decisions.
• Dominant access routes: credential theft, session hijacking, social engineering.
• Prescription: an 18-month roadmap towards continuous monitoring and resilience.

What happens next

The test of the report is behavioural. If banks treat it as shelfware, the third edition will read like the second, only worse. If institutions work the roadmap, the sector gains a common baseline just as real-time payments, embedded finance and AI agents deepen their reach. The attackers have already updated their methods. The report's blunt message is that the defenders are on the clock.

Sources

• PIB - MeitY releases 2nd edition of the Digital Threat Report 2025-26 for India's BFSI sector in collaboration with SISA (July 2026)
• Business Standard - AI, identity, real-time payments resetting cyber threat landscape: report (14 July 2026)
• Devdiscourse - MeitY, CERT-In and industry partners unveil new cyber threat report (July 2026)
• YourStory - AI, identity, real-time payments creating new cyber threat landscape (July 2026)