When India’s top two banks make headlines for the wrong reasons, on the same day, regulators must take note. Although concerns raised at SBI and HDFC Bank are of very different natures, they can shake customer confidence regardless. SBI, India’s biggest bank by assets and number of accounts, has reported a data breach in which records of 3,897 customers have been put on the dark web. This includes not only names and mobile numbers but also loan records. SBI says money in these accounts is safe, but that’s not the point. A con with such detailed information can easily dupe these customers, by impersonating bank staff, for example. The most obvious response would be for the bank to inform and alert each of these customers individually, which is what RBI’s Risk, Resilience and Assurance Framework for commercial banks hints at. It isn’t clear whether SBI has done so.The data leak at HDFC Bank appears to be an internal matter at first. The bank has been embroiled in several controversies over the past two years. One of them – sudden resignation of part-time chair Atanu Chakraborty over alleged governance concerns – resulted in a 5% fall in its stock in March. Now, the bank is investigating suspected leaks of confidential info about these cases to social media, and sharing of confidential business information with outsiders. Although no customer data is involved, to investors and customers the bank still ends up looking like a leaky ship. In customers’ imagination, their bank should be watertight – neither money nor information of any kind should come out of it without proper authorisation. But we keep hearing about leaks and breaches at banks. Just three months ago, Bank of Baroda was in the news for a customer data breach.Looking at these cases in isolation won’t fix the problem at a time the cybersecurity edifice is looking shaky. We just saw how AI exposed vulnerabilities in PHP programming language, which underlies many websites. Hackers were reportedly already exploiting these, and, armed with more powerful AI, they could breach banks’ old cyber defences easily in future. So, rethinking security is important. In Sept, Europe’s biggest fintech, Revolut, inadvertently released personal details of customers to hackers, after getting a request from a compromised Italian govt email account. It’s a reminder that any security chain can fail if even one of its links is weak. That includes not only computers but also the humans who run banks.
- Comment
- Reblog
-
Subscribe
Subscribed
Have a WordPress.com account? Log in now.
