However, reports suggest that the breach included data on customers’ savings and current accounts, loan accounts, net banking users, non-resident Indians (NRIs), and corporate banking services, as well as branch and ATM-related records.

Here’s what customers should do to secure their accounts, monitor for misuse and reduce the risk of fraud:

Does a leak mean money can be stolen immediately?

No, possessing a customer’s personal information alone is usually not enough to carry out banking transactions. Fraudsters typically still need passwords, UPI PINs, debit card PINs, one-time passwords (OTPs) or access to the customer’s registered mobile number or email account.

However, leaked personal information can significantly increase the risk of targeted fraud.

If cyber criminals already know your name, account details, address, Aadhaar number or loan information, they can craft far more convincing phishing messages or impersonate bank officials or your close relatives to trick you into revealing sensitive credentials.

In many cases, the biggest immediate risk is not the breach itself, but the scams that follow it.

First steps customers should take

If you suspect your information may have been exposed, you can follow these steps to secure your money immediately:

Verify reports of the breach through the bank’s official website, mobile app or customer-care channels.

Change your internet banking and mobile banking passwords. If you reuse the same password elsewhere, change those passwords as well.

Review recent account activity and check if there are any unfamiliar transactions. Also check whether any unknown beneficiaries have been added.

Review logged-in devices, where available, and sign out of all devices or unfamiliar sessions.

You can enable SMS and email alerts for all banking transactions. You can also temporarily reduce UPI, online banking, and debit or credit card transaction limits until you get further clarity.

Even if there is no evidence of misuse, these precautions can significantly reduce the risk of fraud.

Secure your email and mobile number: In addition to these steps, you should also change the password of your primary email account and log out of all active sessions.

Your registered email address and mobile number are often the gateway to your banking account. If attackers gain access to either, they may be able to reset passwords, intercept OTPs or take control of banking credentials.

You should also check your email account’s recovery details, review any forwarding rules, and remove any unfamiliar or unauthorised devices that are signed in. As an extra layer of security, enable multi-factor authentication (MFA).

If your mobile phone suddenly loses network connectivity without explanation, contact your telecom operator immediately. Fraudsters sometimes obtain duplicate SIM cards to intercept OTPs and authentication messages.

What to do if Aadhaar or PAN details were leaked

Unlike passwords, identity documents cannot simply be changed. If you suspect that your Aadhaar details have been leaked, follow these steps:

• 
  Lock Aadhaar biometrics through UIDAI.
• 
  Check Aadhaar authentication history for unknown activity.
• 
  Use a Virtual ID (VID) instead of the Aadhaar number wherever possible.
• 
  Share a Masked Aadhaar for future KYC requirements where accepted.

Moreover, make sure you periodically review your credit reports to check for unknown loan applications, credit cards, or enquiries made in your name. If any suspicious credit activity appears, it should be disputed immediately with the lender and the relevant credit bureau.

Identity document exposure often poses a longer-term risk than a leaked password, as criminals may misuse these documents months or even years later.

What to do if an unauthorised transaction appears

If you notice an unauthorised transaction, acting quickly is critical. Contact your bank immediately through its official customer-care number and take the following steps:

• 
  Block the affected debit card, credit card, UPI handle or internet banking access.
• 
  Report the incident to the National Cyber Crime Helpline by dialling 1930.
• 
  File a complaint on the National Cyber Crime Reporting Portal.
• 
  Preserve transaction IDs, SMS messages, screenshots and complaint reference numbers.

Under the Reserve Bank of India’s (RBI’s) customer liability framework, how quickly you report the fraud can determine your financial liability. Customers who notify the bank within three working days of becoming aware of an unauthorised electronic transaction have zero liability. If the fraud is reported within four to seven working days, liability is limited as per RBI norms. Reporting the fraud after seven working days may leave the customer liable for the loss in accordance with the bank’s approved policy.

Scams customers should expect after a breach

Fraudsters often exploit publicised data breaches to launch highly personalised scams. Common tactics include:

• 
  Calls claiming your KYC needs urgent updating.
• 
  Messages warning that your bank account will be blocked.
• 
  Requests to transfer money to a “safe account.”
• 
  Calls seeking OTPs, PINs or CVV numbers.
• 
  Links directing users to fake banking websites or security apps.
• 
  Requests to install screen-sharing or remote-access applications.
• 
  Fraudsters quoting genuine account, loan or personal details to appear authentic.

The use of real customer information often makes these scams far more convincing.

What customers should not do

Customers should also avoid common mistakes after reports of a breach.

Do not:

• 
  Click on links received through unsolicited emails, SMS or WhatsApp messages claiming to verify your account.
• 
  Install unknown applications sent by callers claiming to represent the bank.
• 
  Share OTPs, passwords, PINs or CVV numbers with anyone.
• 
  Transfer money to a so-called “safe account.”
• 
  Upload Aadhaar, PAN or other identity documents to unverified websites.
• 
  Assume that changing only your banking password completely removes the risk if other personal information has been exposed.

How can customers find out whether they were affected?

Customers may not immediately know whether their specific records were included in a data breach. The safest approach is to:

• 
  Watch for official communication from the bank.
• 
  Regularly check the bank’s official website and mobile application for updates.
• 
  Contact the bank’s customer-care helpline or local branch if concerned.

Customers should avoid third-party websites or online tools claiming to check whether their account was affected if those services ask for sensitive information such as account numbers, Aadhaar or PAN details.

Until the forensic investigation is complete, it may not be possible for individual customers to know whether their specific information was accessed. Even so, taking preventive security measures now can significantly reduce the risk of becoming a victim of fraud.