India’s mobile fraud surge exposes the limits of banking authentication
A text message can now be the first step in a bank fraud attack that ends within minutes. In India, reported text-message-based scams rose 146% between the second half of 2025 and the first half of 2026. . .
A text message can now be the first step in a bank fraud attack that ends within minutes. In India, reported text-message-based scams rose 146% between the second half of 2025 and the first half of 2026 compared with the same period a year earlier. The figures show a broader shift in criminal tactics. Fraudsters are moving away from desktop browsers and targeting the smartphone, where customers read bank alerts, receive one-time passcodes, and authorize payments. According toBioCatchdata from its banking customers in India, mobile fraud sessions increased 67%. Fraud sessions rose 86% on iOS devices and 35% on Android, while browser-based fraud sessions declined 10%. The customer has become part of the attack pathMany mobile scams do not begin with attackers breaking encryption or exploiting a software flaw. They begin by persuading a customer to act. A fraudulent message may imitate a bank warning, payment notification, or account verification request. The message creates urgency and pushes the victim to click a link, share information, or approve a transaction before checking whether the request is genuine. This is what makes social engineering difficult to stop. A bank may correctly authenticate the account holder, but the system may not know that the person is being pressured or misled. Passwords and one-time passcodes can confirm identity. They cannot always confirm intent. Faster attacks leave less time to respondThe report found that the total value of attempted fraud payments increased 35%. At the same time, average call length fell 31%, and the median fraud session became 32% shorter. That combination suggests a more efficient attack model. Criminals may be using prepared scripts, automated messages, and tighter workflows to move victims from first contact to payment with fewer delays. Shorter sessions also reduce the time available for fraud teams to detect unusual behavior, contact the customer, or stop a transfer. The sharp rise on iOS should not be treated as proof that one operating system is less secure than another. The report does not provide enough evidence for that conclusion. Instead, it shows that device security alone cannot stop a scam when a legitimate user is convinced to authorize the payment. Banks need to assess behavior as well as identityBioCatch argues that banks should monitor behavior throughout a digital banking session rather than rely only on checks performed at login. Behavioral signals can include typing rhythm, touchscreen use, device condition, and changes in normal account activity. These indicators may help identify account takeover, remote guidance, coercion, or suspicious mule-account behavior. Such monitoring requires care. False alerts can block legitimate payments, while weak detection can allow fraud to continue. Banks must also explain how behavioral data is collected, used, and protected. The report says BioCatch customers recorded a 12% decline in attempted fraud sessions despite higher attempted payment values. That result applies to the institutions covered by the company’s data and should not be read as a measure of fraud across India’s entire banking system. The central security lesson is clear: modern fraud prevention must examine who is making a payment, how they are behaving, and whether they appear to be acting freely. More For YouAI Is Accelerating Cybersecurity's Endless Arms RaceBrowser ransomware turns Chrome folder access into an Android photo trapA password wasn’t enough, 2FA wasn’t enough, then AI entered the attackCopy-Paste This Command and You’re Hacked: New Windows Terminal Attack Spreads Lumma Stealer