#FactCheck-Four-Year-Old Video of BJP MP Janardan Mishra Cleaning a Toilet Falsely Shared as Recent

Introduction

The traditional logic of workplace security is built on the baseline assumption that an employee would be able to identify a suspicious request by form and/or sound. The rollout of AI-generated voice and video is steadily dismantling this assumption. The authenticated voice of a familiar executive or the face of a colleague in a video meeting is no longer a guarantee of variety. This paper reviews recent survey evidence of deepfake-enabled social engineering, briefly considers the Arup fraud as a case study and reviews Gartner's and United States government agency guidance. It argues that organisations should stop relying on employees to spot fakes and instead build independent verification, limited authority and escalation into the everyday workflows that move money and grant access, long before a convincing fake can do damage.

The Scale of the Threat

Gartner revealed in September 2026 that the survey (of 297 senior cybersecurity leaders, March to May 2026) found 41% had been subject to at least one deepfake social engineering attack during an audio employee call in the last 12 months; 36% of deepfake social engineering attacks happened on a video call with an employee in the last 12 months. Gartner concluded that AI makes social engineering more prolific, personalised and believable, while it makes common detection signals less dependable.

The survey also highlights the continued use of older methods. 79% of respondents reported at least one email phishing, spear-phishing, or business email compromise incident, and 58% vishing or smishing. Deepfakes are not replacing tried-and-true techniques but supplementing them. Craig Porter, a director analyst at Gartner, said, "Attackers can combine phishing, business email compromise, synthetic media and the aggregation of personal context across multiple channels, yet most attacks still rely on compromised credentials, simple account takeover and poor recovery processes."

Why it matters: Ability to receive requests can now be routed through the same communication systems that high-trust messages go through. With information gathered from the web, as well as synthetic voice and video, fraudsters can impersonate executives, vendors, suppliers, colleagues, or customers.

Why Spotting the Fake Is Not Enough

The 2024 attack on Arup is an example of this. A finance staff member in an engineering firm in Hong Kong took part in a video conference in which he thought he was speaking to the firm's CFO and others, but all participants were deepfakes. The employee initially suspected a phishing email, but he put aside his doubts after the video call because the participants looked and sounded like colleagues he recognised. He then approved 15 payments of a total HK$200m (US$25.6m). Arup confirmed the voices and faces were fake, though its internal cybersecurity was not breached, and its global CIO, Rob Greig, said attacks of this kind had increased substantially in recent months. The firm's East Asia chairman said staff were warned of increasing attacks of this kind around the world.

This case is instructive because the control that failed was human judgement with a plausible performance. The employee's first reaction was right; it was a video call that overruled this. Detection by the request recipient was the only control.

Government guidance points the same way. A joint information sheet from the NSA, FBI and CISA warns that the most substantial synthetic media threats include impersonating leaders and financial officers and using fraudulent communications to gain access to networks and sensitive information. It advises organisations to have a response plan and to consider technologies that detect deepfakes and establish the provenance of media. Detection tools have a place, but they are one layer, not a foundation.

Building Verification into Workflows

Achyuth Krishna, Head of IT, Information Security and Procurement at Whatfix, says that the real question is no longer 'Can the employee tell that the message is generated by AI?' But whether your organisation has designed its workflow so that a single deceptive interaction cannot become a security incident. "Trust itself has now become a new attack surface," he says.

Gartner's suggested mitigations echo this sentiment. "Porter recommends that CISOs evaluate AI-led social engineering risks with the same level of scrutiny as identity and access risks," the analyst firm said. Among the suggestions that the firm made to organisations that want to defend against AI-led social engineering attempts include establishing secure verification as standard operating procedure for any important request, by whatever means they are communicated, by email, voice, video, collaboration platform or AI system, and using trusted channels of verification as well as stronger authentication for account recovery, privileged access, and payment approval. In terms of design, this suggests a few principles:

1. Before deciding to authorise payments, change privileged access or disclose information, make sure that you get independent confirmation from a different source.

2. This should apply to everyone, including requests that appear to come from a known senior executive, so that employees never need to challenge authority personally.

3. Clearly outline situations where your team needs to stop, confirm, and escalate.

4. Test these procedures in scenarios that are as close to reality as possible rather than just training on an annual basis.

In this case, a simple video call would not have been enough to trigger the release of the money. Validation would have taken place outside the attacker's communication channel.

Extending Identity to AI Agents

As companies open up apps and business data to software agents, Krishna says those agents need their own identities, limited rights, and audit logs. Gartner has also identified that compromised AI apps, prompt injection, and agents acting outside of their bounds are threats that security teams will need to handle.

The logic is the same as in the human case. An agent, given virtually unlimited power, can be misused in exactly the same way that a human employee can be. Seen as identities to be verified, constrained and observed rather than as trusted, remoting extensions of their original creators, agents preserve the principle of limited authority.

Conclusion

Deepfakes have made impersonation cheap, personal and persuasive, and many organisations have already been hit. Detection will remain useful, but it cannot carry the burden alone. The stronger response is structural: independent verification for consequential requests, narrow permissions for people and agents, and regular testing of escalation procedures. The aim is to ensure that no single call, message or agent holds enough unchecked authority to turn a successful deception into a financial loss or a data breach.

Sources

1. Tech Observer: Deepfakes are turning trust into a new enterprise security risk
2. Gartner: Survey Finds 41% of CISOs Reported At Least One Social Engineering Incident Involving a Deepfake in the Past 12 Months
3. Help Net Security: The latest deepfake numbers give CISOs plenty to worry about
4. NSA: NSA, U.S. Federal Agencies Advise on Deepfake Threats
5. CNN: British engineering giant Arup revealed as $25 million deepfake scam victim (syndicated copy)

‍

Introduction

India's largest lender is dealing with a serious data security scare. On October 21, 2026, the State Bank of India told the stock exchanges that it "has experienced an incident involving the loss of certain data" after customer records linked to the bank surfaced on the dark web, as The Hacker News reported. The bank says its core systems and customer funds are safe. Here is a clear look at what has been confirmed, what remains unknown, and what you can do right now.

How the leak came to light

The first event was on October 16. According to a hacker group called Siriusim, they put out the message on Breach Forums – a hacker group forum that specialises in sharing stolen data – claiming to have 375,000 customer records and 2,722 PDF files stolen from the State Bank of India (SBI). 

On the same day, SBI received alerts from its threat intelligence provider, Defence Cyber Agency, and Cert-In (India's computer emergency response team) as per the Business Standard. This was followed by SBI submitting a disclosure to the BSE (Bombay Stock Exchange) and the NSE (National Stock Exchange) on October 21, under SEBI (Securities and Exchange Board of India) listing obligations, as per Money Life and Business Today.

What data was exposed

After a preliminary review of roughly 375,000 records circulating online, SBI identified 3,897 customer records containing personally identifiable information. The Free Press Journal reports that the exposed details include names, registered mobile numbers, dates of birth, gender, email addresses, residential addresses and branch details. The records also carry banking metadata such as customer information file numbers, lead IDs and information tied to loan applications and related files.

The difference between the two headline numbers matters. The 375,000 figure is the size of the dataset on offer, while 3,897 is the number of records the bank has so far found to hold real customer information. The Hacker News notes that the count is preliminary and that the bank has yet to establish whether the data is authentic or how far the exposure goes. Reports of the filing do not mention the 2,722 PDF documents the seller advertised, so that claim remains unverified.

What SBI has said

SBI says that it implemented its cyber incident response and containment process based on the alerts received. The bank has also engaged an independent cybersecurity agency (empanelled by CERT-In) to assess the extent and the nature of the breach. "From a business point of view, the bank has informed investors that it does not expect any material impact on the financials of the bank or on business continuity.

 Customer funds or core banking transactions have not been impacted," the bank said, as per the Free Press Journal.

The customer notification debate

Banks often argue that data should be verified before customers are alerted, and SBI's investigation is still at a preliminary stage. Still, customers cannot protect themselves against a risk they have not been told about, and the gap between regulatory duty and customer interest is exactly what this episode has exposed.

Why it matters

For the 3,897 people identified so far, the main danger is probably not the loss of money directly from their accounts but targeted fraud. Scammers who know a person's name, phone number, address and loan history can sound very convincing when they pose as bank staff.

SBI has faced scrutiny of this kind before. In 2019, TechCrunch reported that an unprotected server in an SBI data centre in Mumbai had exposed two months of data from SBI Quick, a text message and call-based service, putting account information of millions of customers within reach of anyone who finds it.

What customers can do now

SBI has not issued customer-specific guidance beyond its public notice, so the following are general precautions that apply to any data exposure of this kind.

1. Any suspicious communication, such as a call, SMS or WhatsApp message, claiming to be from SBI, should be treated as suspicious, especially if it talks about a loan, creates an urgency to act or asks you to click on a link. 
2. Do not share your OTP, PIN, CVV or online banking password with anyone, even if you are talking to a bank executive, since the bank staff will not ask for these details.
3. Switch on the transaction alerts and regularly check your bank account statement, and report any unauthorised transactions to the bank and file a complaint through the national cybercrime portal or helpline 1930. 
4. To determine whether a person is impacted, call SBI at the numbers and through the modes listed on its official website or on your bank card or passbook.

Conclusion

This story is still developing, and the numbers may change as the independent investigation progresses. For now, the confirmed facts are narrower than the hacker's claims, and the bank's financial position is not in question. What remains in doubt is where the data came from, how fresh it is, and whether the bank will warn the people it affects. Watch for the independent agency's findings and whether SBI notifies customers directly.

Sources

• The Hacker News: State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web
• Business Standard: From SBI to ICICI, Major Banking Data Breaches and Cyberattacks in India
• Business Today: 3.75 lakh records, 3,897 customers, SBI says address, mobile numbers, email ID leaked
• Moneylife: SBI Data Leak, 3,897 Customer Records Found in Preliminary Analysis, IFF Says Customers Not Informed
• Internet Freedom Foundation: SBI told investors its data breach does not matter. What about the 3,897 customers it affected?
• YourStory: SBI finds 3,897 customer records on dark web after hacker's claim
• Free Press Journal: SBI Data Leak, Names, Phone Numbers, Addresses of Nearly 3,900 Customers Exposed
• TechCrunch: India's largest bank SBI leaked account data on millions of customers

Introduction
‍

Generative AI, particularly deepfake technology, poses significant risks to security in the financial sector. Deepfake technology can convincingly mimic voices, create lip-sync videos, execute face swaps, and carry out other types of impersonation through tools like DALL-E, Midjourney, Respeecher, Murf, etc, which are now widely accessible and have been misused for fraud. For example, in 2024, cybercriminals in Hong Kong used deepfake technology to impersonate the Chief Financial Officer of a company, defrauding it of $25 million. Surveys, including Regula’s Deepfake Trends 2024 and Sumsub reports, highlight financial services as the most targeted sector for deepfake-induced fraud.

Deepfake Technology and Its Risks to Financial Systems

India’s financial ecosystem, including banks, NBFCs, and fintech companies, is leveraging technology to enhance access to credit for households and MSMEs. The country is a leader in global real-time payments and its digital economy comprises 10% of its GDP.  However, it faces unique cybersecurity challenges. According to the RBI’s 2023-24 Currency and Finance report, banks cite cybersecurity threats, legacy systems, and low customer digital literacy as major hurdles in digital adoption. Deepfake technology intensifies risks like:

• Social Engineering Attacks: Information security breaches through phishing, vishing, etc. become more convincing with deepfake imagery and audio.
• Bypassing Authentication Protocols: Deepfake audio or images may circumvent voice and image-based authentication systems, exposing sensitive data.
• Market Manipulation: Misleading deepfake content making false claims and endorsements can harm investor trust and damage stock market performance.
• Business Email Compromise Scams: Deepfake audio can mimic the voice of a real person with authority in the organization to falsely authorize payments.
• Evolving Deception Techniques: The usage of AI will allow cybercriminals to deploy malware that can adapt in real-time to carry out phishing attacks and inundate targets with increased speed and variations. Legacy security frameworks are not suited to countering automated attacks at such a scale.

Existing Frameworks and Gaps

In 2016, the RBI introduced cybersecurity guidelines for banks, neo-banking, lending, and non-banking financial institutions, focusing on resilience measures like Board-level policies, baseline security standards, data leak prevention, running penetration tests, and mandating Cybersecurity Operations Centres (C-SOCs). It also mandated incident reporting to the RBI for cyber events. Similarly, SEBI’s Cybersecurity and Cyber Resilience Framework (CSCRF) applies to regulated entities (REs) like stock brokers, mutual funds, KYC agencies, etc., requiring policies, risk management frameworks, and third-party assessments of cyber resilience measures. While both frameworks are comprehensive, they require updates addressing emerging threats from generative AI-driven cyber fraud.

Cyberpeace Recommendations 

• AI Cybersecurity to Counter AI Cybercrime: AI-generated attacks can be designed to overwhelm with their speed and scale. Cybercriminals increasingly exploit platforms like LinkedIn, Microsoft Teams, and Messenger, to target people.  More and more organizations of all sizes will have to use AI-based cybersecurity for detection and response since generative AI is becoming increasingly essential in combating hackers and breaches.
• Enhancing Multi-factor Authentication (MFA):  With improving image and voice-generation/manipulation technologies, enhanced authentication measures such as token-based authentication or other hardware-based measures, abnormal behaviour detection, multi-device push notifications, geolocation verifications, etc. can be used to improve prevention strategies.  New targeted technological solutions for content-driven authentication can also be implemented.
• Addressing Third-Party Vulnerabilities: Financial institutions often outsource operations to vendors that may not follow the same cybersecurity protocols, which can introduce vulnerabilities. Ensuring all parties follow standardized protocols can address these gaps.
• Protecting Senior Professionals: Senior-level and high-profile individuals at organizations are at a greater risk of being imitated or impersonated since they hold higher authority over decision-making and have greater access  to sensitive information. Protecting their identity metrics through technological interventions is of utmost importance.
• Advanced Employee Training:  To build organizational resilience, employees must be trained to understand how generative and emerging technologies work. A well-trained workforce can significantly lower the likelihood of successful human-focused human-focused cyberattacks like phishing and impersonation.
• Financial Support to Smaller Institutions: Smaller institutions may not have the resources to invest in robust long-term cybersecurity solutions and upgrades. They require financial and technological support from the government to meet requisite standards.

Conclusion

According to The India Cyber Threat Report 2025 by the Data Security Council of India (DSCI) and Seqrite, deepfake-enabled cyberattacks, especially in the finance and healthcare sectors, are set to increase in 2025. This has the potential to disrupt services, steal sensitive data, and exploit geopolitical tensions, presenting a significant risk to the critical infrastructure of India. 

As the threat landscape changes,  institutions will have to continue to embrace AI and Machine Learning (ML) for threat detection and response. The financial sector must prioritize robust cybersecurity strategies, participate in regulation-framing procedures, adopt AI-based solutions, and enhance workforce training, to safeguard against AI-enabled fraud. Collaborative efforts among policymakers, financial institutions, and technology providers will be essential to strengthen defenses.

‍

Sources 

• https://sumsub.com/newsroom/deepfake-cases-surge-in-countries-holding-2024-elections-sumsub-research-shows/ 
• https://www.globenewswire.com/news-release/2024/10/31/2972565/0/en/Deepfake-Fraud-Costs-the-Financial-Sector-an-Average-of-600-000-for-Each-Company-Regula-s-Survey-Shows.html 
• https://www.sipa.columbia.edu/sites/default/files/2023-05/For%20Publication_BOfA_PollardCartier.pdf 
• https://edition.cnn.com/2024/02/04/asia/deepfake-cfo-scam-hong-kong-intl-hnk/index.html 
• https://www.rbi.org.in/Commonman/English/scripts/Notification.aspx?Id=1721 
• https://elplaw.in/leadership/cybersecurity-and-cyber-resilience-framework-for-sebi-regulated-entities/ 
• https://economictimes.indiatimes.com/tech/artificial-intelligence/ai-driven-deepfake-enabled-cyberattacks-to-rise-in-2025-healthcarefinance-sectors-at-risk-report/articleshow/115976846.cms?from=mdr 

‍