There was a time when stealing a family’s savings meant getting past its front door. 

A thief had to enter the house, find where the money was hidden, take it and escape without waking anyone. 

The arrival of banks changed that arrangement. 

Families deposited their savings in accounts, rented lockers for jewellery and important papers, and trusted financial institutions to protect what they had accumulated over years.

Digital banking has made money easier to access, but it has also created new ways for criminals to reach it. 

Today, someone can attempt to empty a bank account without entering a branch, meeting the depositor or even touching his phone.

A Kashmiri proverb captures the danger of putting a good thing to bad use: “hoonis chou nae gaive shropaan”. It means a dog cannot digest ghee. 

Internet banking has given the saying a modern setting. 

The same technology that allows a shopkeeper to pay a supplier after closing time can help criminals move money before a bank recognises an intrusion.

Recent incidents in different countries have exposed how vulnerable financial institutions can become when attackers gain access to their digital systems.

On November 5, Reuters reported that hackers had stolen around €100 million from Crédit Mutuel Arkéa, a French cooperative bank. 

The attackers used an account belonging to the bank to execute unauthorised transfers. The institution temporarily suspended some transactions and said its customers’ funds remained unaffected.

The detail that needs particular attention is where the money moved. 

The attackers used the bank’s own payment system, turning an arrangement designed to facilitate financial transactions into a channel for theft.

Two days later, another incident highlighted the vulnerabilities surrounding online banking infrastructure. 

On November 7, Malaysia’s communications minister acknowledged a hacking incident involving Bank Rakyat’s website. 

The bank attributed the continuing disruption to a problem with a third-party service provider and assured customers that their deposits and personal data remained safe.

Such explanations may provide little immediate comfort for someone trying to access an account through the website. 

Is the website temporarily unavailable, or has someone gained access to the money? 

The customer has no independent way of establishing what happened. Only the bank can provide a reliable answer.

India has already seen money transferred from financial institutions without authorisation. 

On November 2, microfinance lender Spandana Sphoorty Financial disclosed that approximately ₹7.8 crore had been transferred from one of its bank accounts into several beneficiary accounts.

Two days later, India’s Computer Emergency Response Team, CERT-In, issued an alert about an ongoing campaign in which attackers use artificial intelligence tools to penetrate financial institutions and exploit the software used to process payments.

CERT-In did not identify the Spandana incident as part of this campaign. The alert nevertheless raises an important question for Indian banks: how quickly can they identify unusual transactions and stop money from moving through their systems?

The challenge goes well beyond the technical teams responsible for protecting banking infrastructure. It concerns the relationship between a financial institution and the people who entrust it with their savings.

Another Kashmiri saying speaks of a blind man entrusting his wife to God. 

Its meaning lies in the dependence one places on someone else when personal oversight is impossible. 

A depositor can check his account balance, examine a transaction and verify the recipient’s name. He cannot inspect the bank’s internal systems, know which employees or contractors have access to them, or establish whether the institution has detected suspicious activity.

His pension, monthly wages and savings accumulated over a lifetime depend on safeguards he cannot personally examine.

A cyberattack can also disrupt the lives of customers whose accounts remain untouched. 

A pensioner may need money for medicines while the bank suspends transfers. A small business owner may have employees waiting for their wages. Families may have school fees, electricity bills or medical expenses due while the institution investigates the breach.

The bank may eventually establish that customer deposits remain safe. Until then, delays and unclear explanations can leave people uncertain about their money and their ability to use it. 

Such experiences can weaken public confidence in banking, even when the actual financial loss falls on the institution.

India’s banking regulations already recognise that customers need protection against unauthorised electronic transactions. 

The Reserve Bank of India provides for zero or limited customer liability in specified circumstances. The extent of protection depends on factors such as how the transaction occurred and how promptly the customer reported the unauthorised debit.

The difficulty lies in how familiar ordinary depositors are with these provisions. Many people open online banking facilities without fully understanding the circumstances in which a bank will compensate them after a cyber theft.

Banks should explain these protections in plain language when customers register for digital services. The information should remain easily accessible when someone discovers an unauthorised transaction.

The basic assurance should be straightforward. 

When an unauthorised transaction causes a financial loss through no fault of the customer, the bank should restore the money promptly. 

The depositor should deal directly with the institution holding the account while the bank establishes responsibility among its technology vendors, contractors and payment partners.

Any circumstances in which a careful customer may still have to bear a loss under applicable rules should also be disclosed clearly before the customer begins using the service.

A third Kashmiri saying provides an apt conclusion: “gour karun hawale gulwaansie”. It describes leaving a horse in the care of a galwaan, a horse thief. 

The humour lies in the arrangement. If the horse disappears, its owner knows precisely whose door to knock on.

A bank depositor also knows which door to knock on when money disappears. The larger question is what happens when he reaches it.

Digital banking rests on trust between institutions and their customers. Banks ask people to place their savings in systems they cannot see and protections they cannot independently verify. 

That trust must come with a clear promise: when criminals exploit the system through no fault of the depositor, the institution entrusted with the money must take responsibility for making the customer whole.