The State Bank of India (SBI) has said it has individually informed customers whose data was identified as being involved in a suspected data leak, while reiterating that their account balances and funds are safe.But the incident raises a wider question for bank customers: can exposed personal information be used to impersonate them, apply for loans or damage their credit scores?The concern comes after SBI disclosed that its preliminary examination of around 3.75 lakh records found on the dark web identified 3,897 records containing personally identifiable information.The information reportedly included customers' names, registered mobile numbers, dates of birth, email IDs and residential addresses, along with branch and customer identification details and metadata linked to loan and lead records. SBI said it received alerts about the suspected exposure on October 16 from its threat-intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In).The bank activated its cyber incident response and containment protocols and appointed an independent cybersecurity agency empanelled with CERT-In to investigate the incident.
The bank has said the incident has had no material impact on its core business operations, financial performance or business continuity. The investigation is expected to establish the authenticity and extent of the exposed information, its possible source and the risks involved.However, the incident highlights why consumers should take data security seriously, even when there is no evidence that their information has been used for financial fraud.CAN STOLEN DATA BE USED TO TAKE A LOAN?A data leak does not automatically allow a fraudster to obtain a loan in someone else's name.
Lenders typically have identity-verification procedures, but exposed personal information could help criminals attempt impersonation or exploit weaknesses in digital verification processes.Vibhore Goyal, founder and CEO of OneBanc, said fraudsters may need additional information to get past these checks."A leak alone rarely suffices; fraudsters need the OTP. Lenders verify PAN, Aadhaar, CKYC and video KYC, yet most journeys or payments still end in an SMS code — on phones that ship with secure chips and biometrics.
RBI's April 2026 rules push beyond SMS. Why are lenders still authenticating like it's 2010?" Goyal said.The risk is not limited to information disclosed in a single incident.
If criminals can combine personal details from different sources, they may be able to build a more complete profile of a potential victim.Goyal said the vulnerability could also lie in the technology used by financial institutions."Yes — and the weak link is often the bank's own app, not the customer. Fraudsters now deploy AI at scale while too many banking apps run outdated SDKs because that's industry practice.
India tops global mobile-malware attacks. When handsets evolve annually, 'legacy architecture' isn't an excuse — it's a liability," he said.His comments point to the importance of security checks by lenders and financial institutions, rather than placing the entire burden of preventing fraud on customers.HOW CAN YOU CHECK IF SOMEONE HAS TAKEN A LOAN IN YOUR NAME?One of the most practical precautions after a suspected data exposure is to check your credit report for unfamiliar activity.
Consumers should look for loans or credit cards they did not apply for, as well as credit enquiries they do not recognise.An unfamiliar loan account or enquiry does not, by itself, establish that fraud has occurred. However, it is a reason to contact the lender and investigate promptly.If a fraudulent loan appears on a credit report, Goyal advised consumers to report the suspected fraud to the authorities and dispute the entry with both the lender and the credit bureau."Report it on cybercrime.gov.in or 1930, then dispute with bureau and lender.
RBI mandates correction within 30 days, or 100 a day. But detection is the real gap: firms without AI defences take 236 days to spot a breach.
AI-led, connected bureau alerts could flag a loan before the first EMI bounces," he said.Consumers who suspect financial cyber fraud can report it through the National Cyber Crime Reporting Portal or call the national cybercrime helpline on 1930. They should also inform the lender concerned, raise a formal dispute with the relevant credit bureau and retain complaint numbers and supporting documents.The specific timelines and compensation provisions applicable to a complaint should be confirmed with the relevant lender, credit bureau or regulator.WHY YOUR SALARY AND EMPLOYMENT DETAILS ALSO MATTERBank records are not the only source of information that could be misused.
Salary slips, tax documents and employment records can contain personal and financial details that may help criminals build a profile of a potential victim.Goyal said companies and payroll platforms also need to pay attention to how employee information is stored and shared."Payroll, not the bank, holds the fullest identity file on a salaried Indian, yet the bigger leak is routine: payslips on WhatsApp, Form 16s over email. Firms using security AI extensively average 21.3Cr per breach versus 31.6Cr without.
Data should move system-to-system, never inbox-to-inbox — encrypted, masked and access-audited," he said.For employees, this means being careful about where they send salary slips, tax documents and identity proofs. They should use authorised company systems wherever possible and avoid sharing sensitive documents through informal channels without checking whether the recipient and purpose are legitimate.Employers, meanwhile, need to restrict access to sensitive records and ensure that personal information is shared only through secure, authorised channels.WHAT SHOULD CUSTOMERS NEVER SHARE?The risk of impersonation can increase when different pieces of personal information are brought together.
Goyal said details such as PAN, Aadhaar, mobile numbers and salary information could collectively make it easier for fraudsters to attempt to impersonate someone."No single detail is dangerous; combinations are. PAN, Aadhaar and mobile enable digital KYC; add salary data and fraud looks creditworthy.
AI is outpacing defences: 26% of malicious Indian breaches are AI-generated. Never share OTPs, UPI PINs or CVVs.
If a caller needs your OTP, they're becoming you," he said.Customers should never disclose their OTPs, UPI PINs, card CVVs or banking passwords to callers claiming to represent a bank or government agency. They should also avoid clicking on suspicious links or installing applications at the request of unknown callers.SBI has reiterated that customers' account balances and funds are safe with the bank.
Its investigation will help establish the extent and possible source of the suspected exposure.For customers, the immediate priority is to remain alert, review credit activity for anything unfamiliar and report suspected fraud quickly. A data leak does not mean a loan has been taken in their name, but checking for unauthorised credit activity can help them identify a problem before it causes further financial damage.(Disclaimer: The views, opinions, recommendations, and suggestions expressed by experts/brokerages in this article are their own and do not reflect the views of the India Today Group.
It is advisable to consult a qualified broker or financial advisor before making any actual investment or trading choices.)- Ends