Digital payment fraud cases in India have risen from 2.6 lakh in 2021 to 28 lakh in 2025, says latest data from the National Cyber Crime Reporting Portal (NCRP). In value terms, this means an increase from ₹551 crore to ₹22,931 crore.

As artificial intelligence (AI) becomes adept at replicating familiar voices, experts say cybersecurity needs to be treated as a governance problem - not just a technology one.  

K.K. Singh, Joint Secretary at the Ministry of Electronics and Information Technology (MeitY), says, "Cyber security is not fundamentally a technology problem. What we see normally… it is a governance and risk management problem for which technology provides the tools."

The threat to Indian businesses is not from phishing and the theft of passwords alone. The bigger question is whether the existing internal controls are resilient against an apparent lawful instruction that hasn't been independently checked.

With synthetic impersonation, there are vulnerabilities that technology cannot overcome.

Sachhin Gajjaer, Founder, CEO and Managing Director of Sattrix, a cybersecurity services company, says AI is making cyberattacks more convincing and easier to scale.

"Executive impersonation is a growing concern. The cloned voice of a CEO asking for an urgent fund transfer, or a deepfake video call with 'senior leaders', can get past traditional checks," he told The Secretariat.

Prime Minister Narendra Modi highlighted the growing importance of cybersecurity while inaugurating the Reserve Bank of India's Data Centre and Cybersecurity Training Institute in Bhubaneswar last month. "A country can also be weakened by attacking its economy," he said, stressing the need to protect India's banking system against evolving cyber threats.

A Case That Exposes The Risk

In the Mumbai company’s case, cloning technology was used to direct a deputy general manager to transfer funds to a number of bank accounts, police said. It was claimed that the money went through 63 accounts. The case was uncovered after one of the suspects went to a bank to encash a cheque, raising the suspicion of a bank manager.

If a call comes in and it looks like it's from the managing director (MD), the instructions might be urgent: ‘send money now’. Staff who are used to receiving orders from senior staff may have issues with challenging senior’s orders.

Can a seemingly valid directive go without being checked and lead to a loss of money?

Suchit Karnik, COO, RAH Infotech, a cybersecurity solutions provider, says organisations need to account for the possibility that familiar identities can be faked. "The organisations that fare best assume a voice or face can be faked, and design approvals so that it doesn't matter," he told The Secretariat.

Beyond Detection: Where Controls Matter

Synthetic impersonation doesn't just involve replacing voices and videos with fakes, it's about replacing anything and everything with a fake version. Ransomware attacks and hacked WhatsApp accounts can also assist fraudsters in spoofing top-level executives, and targeting a company's finance teams.

While these attacks don't involve deepfakes, they still exploit the same weakness, that is, employees reacting to a message they think is from a trusted individual.

Avinash Garg, President and CBO of Df-OS, which makes factories AI-enabled, says investigations must examine both the authenticity of a communication and the business processes that allowed it to influence a decision.

"A deepfake investigation should therefore answer two questions: Was the communication synthetic or manipulated? And, equally importantly, why was a single communication able to influence a high-risk business decision?"

This involves analysing email history, financial software, access logs and approval procedures. The aim is to determine the location and cause of the failure of controls and the reasons why the instruction was allowed to continue.

Dhrubabrata Ghosh Dastidar, Managing Director, Protiviti Member Firm for India, identifies organisational culture as a significant vulnerability. "One of the biggest vulnerabilities is still cultural in organisations; the deepfakes exploit the trust on which a lot of the approval processes still run."

He says there may be some weaknesses in single-channel verification, executive override of rights, and the lack of change in management processes.

He says synthetic impersonation should not be just the cybersecurity team's problem, but one for finance, risk management, and internal audit as well.

Who Is Accountable?

Indian laws cover cybercrime, identity theft, and impersonation. In February 2026, the Information Technology Rules were updated to reinforce the rules of AI-generated content.

But placing the burden on cybersecurity platforms alone is not sufficient to shield businesses from fraudulent transactions.

Probir Roy Chowdhury, Partner, JSA, a full-service law firm, cautions against treating the loss of intermediary safe-harbour protection as automatic liability for the underlying fraud.

"The loss of safe harbour protection means the intermediary can no longer rely on exemption from liability under Section 79 of the IT Act and may face legal proceedings for content hosted on its platform. However, this does not automatically make the intermediary liable for the fraud itself."

Therefore, businesses also need to be prepared and assign responsibility for verification, incident reporting, and financial losses.

From Detection To Prevention

“Deepfake” detection tools are available, but there are no guarantees that any detection system will protect from manipulated audio and video. Companies should have protections in place that do not require employees to know if a communication is authentic or not.

Gajjaer said call-back verification with known numbers, multi-person approval for payments, and code words for sensitive requests and frequent training for finance and leadership teams should be part of the plan.

Further steps include a zero-trust approach, phishing-resistant multi-factor authentication, and continuous system monitoring, he said.

Ghosh Dastidar believes organisations need to rethink how they verify requests, regardless of who they appear to come from. “Organisations should shift from ‘trust first and verify later’ to ‘verify, irrespective of who is asking’,” he said.

He also stressed the need to include every process through which a voice, video, email, or digital identity can trigger a payment, the release of data, or change-in system access in fraud-risk assessments.

Payment authorisations, change of beneficiary, and executive override logs need to be tested by an internal audit team. Usually, simulated attacks, like a call to the finance team using a cloned voice, can help bring out some of the weaknesses before a real attack happens.

As Garg puts it, "AI can make impersonation more convincing, but a well-designed operating layer ensures that conviction alone cannot become authorisation."

This layer will ensure that verification procedures are carried out; payment approvals are properly authorised; employees are able to challenge suspicious instructions; and controls are tested regularly by auditing teams.