Discuss how emerging AI technologies like deepfakes are being weaponised for financial fraud in India. Evaluate the adequacy of regulatory responses.

SEBI's caution of 17 July 2026 to listed companies and regulated entities against the 'Boss Scam' — impersonation of CEOs/MDs to trigger fraudulent fund transfers [1] — marks a shift from crude phishing to AI-enabled synthetic identity fraud, where regulation is presently one step behind the technology.

Weaponisation of AI for financial fraud

• Executive impersonation: fraudsters pose as senior officials over email, WhatsApp and Microsoft Teams, instructing finance staff to release urgent payments [1].
• Deepfakes and voice cloning: AI-generated video calls and cloned voices defeat trust built on face and voice recognition, the weakest link in verification [1].
• Malware-enabled takeover: malicious executable files and hijacked messaging-session tokens let fraudsters message colleagues from a genuine officer's account [1].
• Layering through mule accounts: proceeds are rapidly routed through mule bank accounts, frustrating recovery [4].
• Systemic spread: the trend was flagged to SEBI by the Indian Cyber Crime Coordination Centre (I4C) under the MHA, indicating a rising pan-sectoral pattern [2].

Regulatory response: strengths

• Advisory and awareness: SEBI mandates independent call-back verification and reporting via helpline 1930/the National Cyber Crime Reporting Portal [1][2]; it has issued a steady stream of such cautions, including on account-handling-service scams [5].
• Content-layer regulation: the IT Amendment Rules, 2026 define synthetically generated information and require labelling, traceable metadata and three-hour takedown [3].
• Detection technology: the Reserve Bank Innovation Hub's AI model for detecting mule accounts attacks the money trail [4].
• Inter-agency coordination: I4C–SEBI information flow links internal-security and financial-market regulators [2].

Gaps

• Advisories persuade but do not bind; no mandatory dual-authorisation protocol for high-value transfers.
• Labelling rules govern public platform content, not the private, encrypted channels where such frauds actually occur [3].
• Response is reactive: funds vanish in minutes, while takedown and reporting operate in hours.
• Detection capacity and cross-border enforcement remain thin.

The response so far is alert and coordinated but advisory-heavy. Making verification protocols and cyber-hygiene audits part of listed companies' internal financial controls, backed by real-time bank–regulator–I4C data sharing and stronger deepfake detection capacity, would convert warnings into resilience — securing market integrity, which is SEBI's core statutory mandate.