Identity Theft, Not Transaction Systems, Now Drives the Biggest Banking Fraud Risks
In a startling revelation this week, a major banking institution from India, Bank of Baroda, announced that its core banking infrastructure and customer transaction systems remain secure, despite a recent cyberattack. This statement reflects a common narrative that many financial institutions follow whenever a breach occurs: an employee account was compromised, the core systems are intact, investigations are underway, and customers can continue their transactions as usual.
However, the situation is more complex than it appears. The breach involving the Bank of Baroda exposed a treasure trove of sensitive data, including know-your-customer (KYC) forms, copies of Aadhaar cards, permanent account numbers, loan files, internal audit documents, and around 300,000 customer files—all of which were found on the dark web. Crucially, this data did not originate from the bank’s core ledger, but it contained enough information for cybercriminals to create mule accounts, deceive verification processes, or impersonate legitimate customers during interactions with customer service representatives. Indeed, for hackers, the end goal was never simply to disrupt transaction systems. Instead, the genuine target was the identity ecosystem that underpins these transactions. Current breaches are evolving; they focus more on seizing control of customer identities than on directly stealing funds.
The Indian Cyber Crime Coordination Centre has flagged an alarming 2.73 million Layer-1 mule accounts as of January 2026. Moreover, in just the month of March alone, cyber intelligence analysts identified an additional 524,000 suspected accounts and digital identities. The creation of each mule account typically requires a name, photograph, and identification number that can pass the rigorous verification protocols of banking institutions. This makes leaked KYC records significantly more valuable than mere impersonation tools. In response to the burgeoning crisis, the Reserve Bank of India has launched MuleHunter.AI, a state-of-the-art AI tool dedicated to detecting mule accounts. This initiative is operational across 26 banks, highlighting the vast scale of the challenge at hand.
Compounding the issue is the rise of synthetic identity fraud. The National Association of Software and Service Companies (Nasscom), in collaboration with the Data Security Council of India (DSCI), has recorded a staggering 450% increase in cases involving fabricated identities. Genuine Aadhaar and PAN documents lend credibility to these synthetic identities, often rendering them harder to detect than identities obtained through outright theft.
This incident in India is not an isolated phenomenon. It mirrors patterns observed globally in the banking sector. For instance, in 2020, New Zealand’s Reserve Bank assured that its "core functions remained sound and operational" following a breach of its file-sharing service. Similarly, the Desjardins Group, a prominent financial cooperative in North America, declared its "computer systems were not breached" despite an employee’s actions that led to the unauthorized export of 4.2 million member records over a period of 26 months.
Such reassurances, while intended to convey stability, could mislead. The phrase "core systems unaffected" is often board-approved, legally safe language aimed at addressing the concerns of regulators and rating agencies who primarily care about the uninterrupted movement of money. However, for customers, the risk lies beyond mere financial transactions—their identities are at stake.
Today’s banking fraud, including mule account recruitment, SIM-swapping attacks, synthetic identity fraud, and socially engineered account takeovers, often does not require direct access to core banking systems. Instead, these fraudulent schemes primarily need a customer’s name, document number, and photograph—all information typically gathered during the KYC verification process.
In light of these evolving threats, banks must reassess their understanding of critical assets. KYC repositories, document vaults, and identity databases deserve the same level of protection and urgency in incident responses as traditional transaction systems.
While banks may assure customers that their money remains safe, the messaging does little to alleviate customer concerns regarding the safety of their personal identities. The prevalent post-breach reassurances—focusing solely on the integrity of core systems—may gratify regulatory bodies but disregard the real and immediate risks faced by customers. The very essence of effective cyber defense must extend beyond safeguarding transactions; it must encompass robust protections for customer identities, addressing the multifaceted nature of modern banking fraud.
This complex landscape demands a paradigm shift in how financial institutions view and safeguard the identities of their customers. Only by prioritizing this aspect of security can banks truly protect their clients from the rising tide of cyber threats that complicate the digital banking environment.