SBI Data Breach Raises Cybersecurity Concerns: 8 Steps To Protect Your Bank Account

State Bank of India has confirmed that personal details of 3,897 customers were found on the dark web after a suspected cyberattack, intensifying concerns about identity theft, targeted fraud and the security of India’s banking ecosystem. The exposed records reportedly included names, mobile numbers, email and residential addresses, dates of birth, gender, branch and CIF identifiers, and loan-related metadata.

Leaked names, phone numbers, addresses, dates of birth and loan-related details can be highly valuable to fraudsters. They can be used to make scam calls appear credible, impersonate bank officials, send targeted phishing messages, attempt SIM-swap fraud, or apply for fraudulent loans using stolen identities.

1. Use a strong, unique password

A banking password should be long, difficult to guess and different from passwords used for email, shopping or social media. The accompanying infographic places a strong, unique password first among its account-protection measures.

Treat that password as confidential, regardless of who asks for it. SBI’s anti-phishing guidance says passwords and PINs are not known even to the bank’s employees or service personnel. A caller’s knowledge of personal details is therefore no reason to disclose them.

2. Use two-factor authentication and never share the code

Use the additional authentication protections offered by your bank, rather than relying on a password alone. As the infographic explains, a second verification step adds a barrier against unauthorised access.

But that barrier depends on keeping authentication secrets private. Never read out an OTP or share a password with someone claiming to verify, secure or unblock an account. SBI’s guidance treats such credentials as strictly confidential.

3. Watch for phishing calls, messages, and links

A message that mentions your bank or includes accurate personal information is not automatically genuine. Following the SBI disclosure, cybersecurity reporting has warned that exposed information could make targeted scams more convincing.

Be cautious of unexpected messages asking you to click a link, update account details or disclose credentials. The infographic specifically warns against suspicious emails, texts and links seeking banking information, while SBI advises customers to report phishing attempts through its official channels.

4. Use trusted Internet connections

The infographic recommends accessing banking services through trusted, private networks and avoiding public Wi-Fi. Make that a routine precaution rather than something reserved for the aftermath of a breach.

The connection is only one part of the safety check: the bank’s website, app or payment request must also be genuine. SBI’s anti-phishing guidance warns customers against attempts to obtain confidential banking information through fraudulent communications.

5. Keep your phone and other devices secure

Keep your phone, tablet and computer updated, along with the security software you use. Device security is one of the infographic’s central recommendations because banking protection extends beyond the password-entry screen.

The same caution applies when using payment apps: enter a UPI PIN only on the app’s designated UPI PIN page, not into a form or message sent by someone else. The National Payments Corporation of India explicitly advises users to keep their UPI PIN confidential.

6. Check your account regularly and report fraud immediately

Review account activity frequently and flag transactions you do not recognise. The infographic recommends regular transaction checks and immediate reporting of unfamiliar activity.

If you spot an unauthorised debit, notify your bank immediately through an official channel. Also report financial cyber fraud by calling 1930 or visiting cybercrime.gov.in; the Reserve Bank of India advises immediate reporting through these channels. Preserve transaction details and relevant messages for the complaint.

7. Protect your UPI PIN, OTPs and sensitive information

Never share your UPI PIN, card PIN, banking password or OTP with anyone claiming to be from the bank. NPCI says a bank’s customer-support team will never ask for a UPI PIN.

A particularly important rule is that receiving money does not require entering a UPI PIN. NPCI’s safety guidance says the PIN is used to authorise money being deducted from an account, not to receive a payment. A request to enter it to collect a refund or receive money should therefore raise an immediate warning.

Also keep personal information separate from authentication secrets: a name or account identifier may help identify a customer, but it is not a substitute for a PIN or password. The SBI incident concerns reported exposure of identifying information; it should not be described as confirmed exposure of customers’ banking credentials.

8. Set up transaction and acount alerts

Enable SMS, email or app notifications for transactions and other account activity wherever the bank offers them. The infographic recommends alerts for logins, transactions and important changes so customers can notice unfamiliar activity promptly.

Alerts complement, not replace, regular account checks. If a notification reveals a transaction you did not authorise, report it rather than waiting for the next statement. RBI’s guidance emphasises immediate reporting of financial fraud