#FactCheck-AI-Altered Video Falsely Claims Indian Army Air Defence Officer Resigned Over ‘Operation Sindoor’

Introduction

The war over children and social media, once mostly waged in headlines, committee hearings, and video clips of executives begging apologies from distraught families, has officially reached to courts. This past Monday, August 26, 2026, Meta reportedly agreed to settle for an estimated $18 billion for the sprawling, multi-state class action suit that accused the social media titan of intentionally designing Instagram and Facebook to be addictive for children and of actively failing to shield them from child abuse imagery, disordered eating websites and much more. This record $18 billion, one of the largest ever obtained against a consumer-facing business, occurred just over a week into a high-profile trial in Oakland, in which four states pursued nearly $1.4 trillion in damages against Meta. Even more important than the headline figure, though, is what actually lies in the fine print (or what the settlement leaves distinctly out): the future of teen safety law.

What Meta agreed to pay  and to whom

The settlement resolves claims brought jointly by 29 states in 2023, which eventually grew into a coalition of 47 states, the District of Columbia, and several U.S. territories. Just over $17 billion goes toward that multistate case, with the remainder settling claims from other states. Notably, three states, Texas, New Mexico, and Florida, settled separately. Texas alone secured over $1 billion, on top of the $1.4 billion Meta paid the state in 2024 over biometric data misuse. New Mexico had already won its own jury trial in March 2026, when jurors found Meta violated the state's consumer protection law and ordered a $375 million penalty; a judge later added further penalties, pushing that case's total past $560 million.

Under the multistate deal, there's a revealing structural detail: Meta will hand over only 70% of the total (about $12.7 billion) unless TikTok and YouTube also agree to adopt matching safety measures, daily time limits, night mode, and age assurance tools. The remaining 30% ($5.3 billion) is contingent on rivals falling in line and paying comparable sums. In other words, Meta is using its own settlement as leverage to drag competitors into the same regulatory box, a move Meta's chief legal officer, C.J. Mahoney, framed as setting "the right path forward for our whole industry".

Changes made by the Platform

Beyond the check, Meta has committed to a list of design changes for teen accounts:

• A default two-hour daily screen-time limit, with prompts every 15 minutes encouraging "intentional use"
• Accounts that Meta flags belonging to minors will be blocked from the apps overnight (midnight–6 a.m.)
• Notifications muted during school hours (8 a.m.–3 p.m.)
• Teens will no longer see "like" counts on their own or others' posts by default
• Continued investment in AI-driven age-detection technology — the "adult classifier" system Meta has been building since 2021, which scans behavioral signals (who you follow, what you engage with, even "happy birthday" posts) to guess whether an account belongs to a minor, regardless of the birthday entered at signup

Meta has also publicly called on app stores to shoulder more of the age-verification burden themselves, a signal that the next legal battleground may shift from the apps themselves to the operating systems and stores that distribute them.

Why critics say the "money machine" walks away largely intact

Here is the uncomfortable arithmetic several legal analysts have pointed out: Meta's $18 billion is being paid out over 10 years, against a company whose 2025 revenue exceeded $200 billion. As one technology litigator told TechCrunch, spreading the payment over a decade "really does blunt the financial impact of the large number". Meta did not admit wrongdoing. No executive faces personal liability. And crucially, the design changes Meta agreed to are largely features it had already begun rolling out voluntarily: teen accounts, PG-13 content defaults, and AI age detection, meaning the settlement in some ways ratifies Meta's existing roadmap rather than forcing a fundamentally different business model. Child-safety advocates have voiced similar scepticism. As one advocacy group leader put it around Meta's earlier safety announcements, such moves are as much about managing the narrative as they are about substantive protection.

Work in Progress

Perhaps the most important vulnerability in the settlement is this: nearly every protection Meta's promise depends on accurately knowing who is a teenager. Age-verification and age-prediction technology remains genuinely unreliable. Meta itself has never disclosed hard accuracy figures for its AI "adult classifier", and outside researchers have long warned that both self-declared birthdates and AI inference are trivially gamed by tech-savvy teens — and prone to misclassifying adults. If the underlying age-detection layer is porous, the two-hour limits, overnight blackouts, and muted like counts are protections that exist only for the users who show up to be counted.

Why this case is really about digital ID

This is where the story stops being just a corporate-liability story and becomes a civil-liberties one. The original complaint from California, Colorado, Kentucky, and New Jersey explicitly asked the court to compel Meta to implement "multi-layered age verification at account sign-up" going beyond birthdates to methods like submitting student IDs. As digital-rights outlet Reclaim The Net has argued, verifying that some users are minors necessarily means putting every user through an identity check because the system can't know who's underage without checking everyone. That's the quiet trade-off sitting inside nearly every child-safety proposal now moving through state legislatures and courts: protecting kids online, as currently conceived by regulators, increasingly means asking adults to prove who they are just to open an app.

Judge Yvonne Gonzalez Rogers, who is overseeing the underlying federal case, took the unusual step of empanelling an advisory jury to weigh in on specific factual questions even as settlement talks proceeded, which is a sign that courts are trying to build a durable evidentiary record regardless of how individual cases resolve. That record, which is an unsealed internal research, executive testimony, and coroners' findings cited in court filings  is exactly the kind of material state and federal lawmakers will cite for years as they draft the next generation of age-verification and social media laws.

Conclusion

The Meta settlement is unlikely to be the last of its kind. Thousands of similar lawsuits from families, school districts, and other states remain active, and the California bellwether trial's findings will likely shape settlement math for TikTok, YouTube, and Snap. Expect three parallel tracks to accelerate: state legislatures pushing app-store-level age verification; plaintiffs' lawyers using unsealed Meta documents as templates for the next wave of suits; and Meta itself continuing to invest in AI-based age detection partly to protect teens and partly to insulate itself from the next $18 billion bill. Whether that technology can be built without turning every internet user into someone who has to prove their age at the door is the legal and technological question that will define this fight for the next decade.

Sources

• Meta settles landmark state child harm claims for $18 billion – CNN Business
• Meta's $18B child-safety deal hinges on age-verification tech that doesn't work well – TechCrunch
• Meta to pay 47 states up to $17.1B in landmark child safety settlement – Stateline
• Meta's $18bn settlement: How social platforms will change for child users – Al Jazeera
• Meta to pay Texas $1 billion in child safety case – The Texas Tribune
• Meta Trial Opens as States Demand Age Verification – Reclaim The Net
• States' complaint against Meta (PDF) – Reclaim The Net document archive
• Jury finds Meta's platforms harmful to children in first wave of lawsuits – PBS NewsHour / AP
• Instagram's AI-based teen account detection – TechCrunch

‍

Executive Summary:

Given that AI technologies are evolving at a fast pace in 2024, an AI-oriented phishing attack on a large Indian financial institution illustrated the threats. The documentation of the attack specifics involves the identification of attack techniques, ramifications to the institution, intervention conducted, and resultant effects. The case study also turns to the challenges connected with the development of better protection and sensibilisation of automatized threats. 

Introduction

Due to the advancement in AI technology, its uses in cybercrimes across the world have emerged significant in financial institutions. In this report a serious incident that happened in early 2024 is analysed, according to which a leading Indian bank was hit by a highly complex, highly intelligent AI-supported phishing operation. Attack made use of AI’s innate characteristic of data analysis and data persuasion which led into a severe compromise of the bank’s internal structures.

Background

The chosen financial institution, one of the largest banks in India, had a good background regarding the extremity of its cybersecurity policies. However, these global cyberattacks opened up new threats that AI-based methods posed that earlier forms of security could not entirely counter efficiently. The attackers concentrated on the top managers of the bank because it is evident that controlling such persons gives the option of entering the inner systems as well as financial information. 

Attack Execution

The attackers utilised AI in sending the messages that were an exact look alike of internal messages sent between employees. From Facebook and Twitter content, blog entries, and lastly, LinkedIn connection history and email tenor of the bank’s executives, the AI used to create these emails was highly specific. Some of these emails possessed official formatting, specific internal language, and the CEO’s writing; this made them very realistic. 

 It also used that link in phishing emails that led the users to a pseudo internal portal in an attempt to obtain the login credentials. Due to sophistication, the targeted individuals thought the received emails were genuine, and entered their log in details easily to the bank’s network, thus allowing the attackers access. 

Impact

It caused quite an impact to the bank in every aspect. Numerous executives of the company lost their passwords to the fake emails and compromised several financial databases with information from customer accounts and transactions. The break-in permitted the criminals to cease a number of the financial’s internet services hence disrupting its functions and those of its customers for a number of days. 

 They also suffered a devastating blow to their customer trust because the breach revealed the bank’s weakness against contemporary cyber threats. Apart from managing the immediate operations which dealt with mitigating the breach, the financial institution was also toppling a long-term reputational hit. 

Technical Analysis and Findings

1. The AI techniques that are used in generation of the phishing emails are as follows: 

•  The attack used powerful NLP technology, which was most probably developed using the large-scaled transformer, such as GPT (Generative Pre-trained Transformer). Since these models are learned from large data samples they used the examples of the conversation pieces from social networks, emails and PC language to create quite credible emails. 

 Key Technical Features: 

•  Contextual Understanding: The AI was able to take into account the nature of prior interactions and thus write follow up emails that were perfectly in line with prior discourse. 
•  Style Mimicry: The AI replicated the writing of the CEO given the emails of the CEO and then extrapolated from the data given such elements as the tone, the language, and the format of the signature line. 
•  Adaptive Learning: The AI actively adapted from the mistakes, and feedback to tweak the generated emails for other tries and this made it difficult to detect. 

2. Sophisticated Spear-Phishing Techniques

Unlike ordinary phishing scams, this attack was phishing using spear-phishing where the attackers would directly target specific people using emails. The AI used social engineering techniques that significantly increased the chances of certain individuals replying to certain emails based on algorithms which machine learning furnished. 

 Key Technical Features: 

•  Targeted Data Harvesting: Cyborgs found out the employees of the organisation and targeted messages via the public profiles and messengers were scraped. 
•  Behavioural Analysis: The latest behaviour pattern concerning the users of the social networking sites and other online platforms were used by the AI to forecast the courses of action expected to be taken by the end users such as clicking on the links or opening of the attachments. 
•  Real-Time Adjustments: These are times when it was determined that the response to the phishing email was necessary and the use of AI adjusted the consequent emails’ timing and content. 

3. Advanced Evasion Techniques

The attackers were able to pull off this attack by leveraging AI in their evasion from the normal filters placed in emails. These techniques therefore entailed a modification of the contents of the emails in a manner that would not be easily detected by the spam filters while at the same time preserving the content of the message. 

Key Technical Features: 

•  Dynamic Content Alteration: The AI merely changed the different aspects of the email message slightly to develop several versions of the phishing email that would compromise different algorithms. 
•  Polymorphic Attacks: In this case, polymorphic code was used in the phishing attack which implies that the actual payloads of the links changed frequently, which means that it was difficult for the AV tools to block them as they were perceived as threats. 
•  Phantom Domains: Another tactic employed was that of using AI in generating and disseminating phantom domains, that are actual web sites that appear to be legitimate but are in fact short lived specially created for this phishing attack, adding to the difficulty of detection. 

4. Exploitation of Human Vulnerabilities

This kind of attack’s success was not only in AI but also in the vulnerability of people, trust in familiar language and the tendency to obey authorities. 

Key Technical Features: 

•  Social Engineering: As for the second factor, AI determined specific psychological principles that should be used in order to maximise the chance of the targeted recipients opening the phishing emails, namely the principles of urgency and familiarity. 
•  Multi-Layered Deception: The AI was successfully able to have a two tiered approach of the emails being sent as once the targeted individuals opened the first mail, later the second one by pretext of being a follow up by a genuine company/personality. 

Response

On sighting the breach, the bank’s cybersecurity personnel spring into action to try and limit the fallout. They reported the matter to the Indian Computer Emergency Response Team (CERT-In) to find who originated the attack and how to block any other intrusion. The bank also immediately started taking measures to strengthen its security a bit further, for instance, in filtering emails, and increasing the authentication procedures. 

 Knowing the risks, the bank realised that actions should be taken in order to enhance the cybersecurity level and implement a new wide-scale cybersecurity awareness program. This programme consisted of increasing the awareness of employees about possible AI-phishing in the organisation’s info space and the necessity of checking the sender’s identity beforehand.

Outcome

Despite the fact and evidence that this bank was able to regain its functionality after the attack without critical impacts with regards to its operations, the following issues were raised. Some of the losses that the financial institution reported include losses in form of compensation of the affected customers and costs of implementing measures to enhance the financial institution’s cybersecurity. However, the principle of the incident was significantly critical of the bank as customers and shareholders began to doubt the organisation’s capacity to safeguard information in the modern digital era of advanced artificial intelligence cyber threats. 

 This case depicts the importance for the financial firms to align their security plan in a way that fights the new security threats. The attack is also a message to other organisations in that they are not immune from such analysis attacks with AI and should take proper measures against such threats.

Conclusion

The recent AI-phishing attack on an Indian bank in 2024 is one of the indicators of potential modern attackers’ capabilities. Since the AI technology is still progressing, so are the advances of the cyberattacks. Financial institutions and several other organisations can only go as far as adopting adequate AI-aware cybersecurity solutions for their systems and data. 

 Moreover, this case raises awareness of how important it is to train the employees to be properly prepared to avoid the successful cyberattacks. The organisation’s cybersecurity awareness and secure employee behaviours, as well as practices that enable them to understand and report any likely artificial intelligence offences, helps the organisation to minimise risks from any AI attack.

Recommendations

1. Enhanced AI-Based Defences: Financial institutions should employ AI-driven detection and response products that are capable of mitigating AI-operation-based cyber threats in real-time. 
2.  Employee Training Programs: CYBER SECURITY: All employees should undergo frequent cybersecurity awareness training; here they should be trained on how to identify AI-populated phishing. 
3.  Stricter Authentication Protocols: For more specific accounts, ID and other security procedures should be tight in order to get into sensitive ones. 
4.  Collaboration with CERT-In: Continued engagement and coordination with authorities such as the Indian Computer Emergency Response Team (CERT-In) and other equivalents to constantly monitor new threats and valid recommendations. 
5.  Public Communication Strategies: It is also important to establish effective communication plans to address the customers of the organisations and ensure that they remain trusted even when an organisation is facing a cyber threat. 

Through implementing these, financial institutions have an opportunity for being ready with new threats that come with AI and cyber terrorism on essential financial assets in today’s complex IT environments.

‍

‍

Introduction

Union Minister of State for Electronics and IT, Rajeev Chandrasekhar, announced that rules for the Digital Personal Data Protection (DPDP) Act are expected to be released by the end of January. The rules will be subject to a month-long consultation process, but their notification may be delayed until after the general elections in April-May 2024. Chandrasekhar mentioned changes to the current IT regulations would be made in the next few days to address the problem of deepfakes on social networking sites.

The government has observed a varied response from platforms regarding advisory measures on deepfakes, leading to the decision to enforce more specific rules. During the Digital India Dialogue, platforms were made aware of existing provisions and the consequences of non-compliance. An advisory was issued, and new amended IT rules will be released if satisfaction with compliance is not achieved.

When Sachin Tendulkar reported a deepfake on a site where he was seen endorsing a gaming application, it raised concerns about the exploitation of deepfakes. Tendulkar urged the reporting of such incidents and underlined the need for social media companies to be watchful, receptive to grievances, and quick to address disinformation and deepfakes.

The DPDP Act, 2023

The Digital Personal Data Protection Act (DPDP) 2023 is a brand-new framework for digital personal data protection that aims to protect individuals' digital personal data. The act ensures compliance by the platforms collecting personal data. The act aims to provide consent-based data collection techniques. DPDP Act 2023 is an important step toward protecting individual privacy. The Act, which requires express consent for the acquisition, administration, and processing of personal data, seeks to guarantee that organisations follow the stated objective for which user consent was granted. This proactive strategy coincides with global data protection trends and demonstrates India's commitment to safeguarding user information in the digital era.

Amendments to IT rules

Minister Chandrasekhar declared that existing IT regulations would be amended in order to combat the rising problem of deepfakes and disinformation on social media platforms. These adjustments, which will be published over the next few days, are primarily aimed at countering widespread of false information and deepfake. The decision follows a range of responses from platforms to deepfake recommendations made during Digital India Dialogues.

The government's stance: blocking non-compliant platforms

Minister Chandrasekhar reaffirmed the government's commitment to enforcing the updated guidelines. If platforms fail to follow compliance, the government may consider banning them. This severe position demonstrates the government's commitment to safeguarding Indian residents from the possible harm caused by false information.

Empowering Users with Education and Awareness

In addition to the upcoming DPDP Act Rules/recommendations and IT regulation changes, the government recognises the critical role that user education plays in establishing a robust digital environment. Minister Rajeev Chandrasekhar emphasised the necessity for comprehensive awareness programs to educate individuals about their digital rights and the need to protect personal information.

These instructional programs seek to equip users to make informed decisions about giving consent to their data. By developing a culture of digital literacy, the government hopes to guarantee that citizens have the information to safeguard themselves in an increasingly linked digital environment.

Balancing Innovation with User Protection

As India continues to explore its digital frontier, the junction of technology innovation and user safety remains a difficult balance. The upcoming Rules on the DPDP Act and modifications to existing IT rules represent the government's proactive efforts to build a strong framework that supports innovation while protecting user privacy and combating disinformation. Recognising the changing nature of the digital world, the government is actively participating in continuing discussions with stakeholders such as industry professionals, academia, and civil society. These conversations promote a collaborative approach to policy creation, ensuring that legislation is adaptable to the changing nature of cyber risks and technology breakthroughs. Such inclusive talks demonstrate the government's dedication to transparent and participatory governance, in which many viewpoints contribute to the creation of effective and nuanced policy. These advances reflect an important milestone in India's digital journey, as the country prepares to set a good example by creating responsible and safe digital ecosystems for its residents.

Reference : 

• https://economictimes.indiatimes.com/tech/technology/govt-may-release-personal-data-bill-rules-in-a-fortnight/articleshow/106162669.cms?from=mdr
• https://www.business-standard.com/india-news/dpdp-rules-expected-to-be-released-by-end-of-the-month-mos-chandrasekhar-124011600679_1.html 

‍