Smartphones became digital vaults, but security failed to keep pace: Report

Kaspersky's latest survey shows smartphones are becoming digital vaults for Indians, storing banking details, work data and AI chats, increasing cybersecurity risks

For most people, losing a smartphone no longer means replacing a device. It means losing access to their digital life. From banking applications and identity documents to work emails, artificial intelligence (AI) conversations and personal memories, smartphones have become the centre of everyday life.

 

As India embraces a mobile-first digital economy, the volume of sensitive information stored on smartphones continues to grow. Kaspersky's latest Asia-Pacific (APAC) survey, which includes India, highlights how smartphones are evolving into digital vaults, bringing greater convenience alongside broader cybersecurity risks.

 

"India's pattern stands out even within the region. 60 per cent of Indian respondents rely on their smartphone as their primary device for internet access and are more likely than the APAC average to store work emails, shopping information and AI chat histories on that device. Threat activity mirrors this," said Purshottam Bhatia, head of consumer business for South Asia at Kaspersky.

 

 

He added that region-specific malware families such as Rewardsteal and Thamera target Indian users through fake reward schemes and social media account hijacking rather than generic malware.

 

"Our products blocked more than 47.5 million internet-borne cyberthreats in India in 2025, an average of more than 130,000 incidents a day," he said.

 

Smartphones become digital vaults

 

The way Indians use smartphones is changing rapidly. According to Kaspersky's survey, 60 per cent of Indian respondents now use smartphones as their primary device for accessing the internet, making them central to everyday digital activities.

 

As mobile devices replace traditional computers for browsing, banking, shopping and communication, they are also becoming the preferred place to store information that was previously spread across laptops, paper files and physical wallets.

 

The survey highlights the range of personal information now stored on smartphones:

• 61 per cent store personal documents, making smartphones a repository for identity records.
• 60 per cent store photos and videos.
• 53 per cent save contact details.
• 42 per cent keep notes and reminders.
• 27 per cent store medical records and appointment details.

The findings suggest smartphones have evolved well beyond communication devices. They now function as digital vaults that hold information spanning users' personal, financial and everyday lives. 

 

Digital wallets

 

As smartphones become the preferred platform for banking, digital wallets and online shopping, they increasingly hold the keys to users' financial identities. That also makes them attractive targets for cybercriminals seeking access to financial credentials and other sensitive information.

 

"About 38 per cent of Indian users store banking details and 34 per cent store passwords or login credentials directly on their phones, usually alongside everyday apps rather than in a protected format. The risk is real," Bhatia said.

 

He noted that Android banking Trojan attacks increased sharply in 2025, with installation packages for new banking Trojans rising several-fold from the previous year.

 

In India, Rewardsteal banking Trojans, disguised as giveaway or cashback applications, were among the most concentrated threats detected last year, exploiting users who rarely questioned why such applications requested banking permissions.

 

According to Bhatia, common mistakes include storing sensitive information outside password managers, granting application permissions without scrutiny, and installing applications from unofficial stores in search of better deals.

 

AI chats emerge as a new category of sensitive data

 

One of the survey's newer findings is the growing importance of AI conversations. Nearly 37 per cent of Indian respondents save conversations with AI assistants on their smartphones.

 

Unlike conventional messaging, AI conversations may contain brainstorming sessions, work drafts, software code, financial queries, health discussions or other personal prompts that users may revisit later.

 

The survey identifies AI chat histories as an emerging category of sensitive information, reflecting how smartphones increasingly store not only conventional personal data but also digital interactions that reveal users' behaviour, preferences and professional activities.

 

The finding comes amid growing concerns over AI privacy.

 

"AI conversations are a new kind of risk not because chats get stolen individually, but because they aggregate health, financial and personal detail into one revealing record," Bhatia said.

 

He noted that more than 92,000 malware attacks worldwide between January and May 2026 were disguised as popular AI applications, with fake ChatGPT, Claude and Gemini installers among the most common lures.

 

Separately, he pointed to a misconfigured backend associated with the "Chat and Ask AI" application that exposed about 300 million private conversations belonging to 25 million users, demonstrating that chat data can be exposed even without a direct cyberattack.

 

Smartphones at work

 

The findings also show that smartphones are becoming increasingly important workplace devices. This growing dependence means a compromised smartphone could expose both personal and organisational information.

 

The survey suggests enterprise security can no longer focus only on laptops and desktop computers, as smartphones increasingly serve as employees' primary work devices.

 

"Work is now happening on personal phones as much as on company laptops," Bhatia said.

 

According to the survey, 48 per cent of Indian respondents store work emails on their smartphones and 27 per cent use their devices to access work systems directly, both above the APAC average.

 

Bhatia said a compromised smartphone could expose corporate emails, internal systems and client information alongside personal accounts.

 

He added that organisations should move beyond traditional PC-era security policies by adopting mobile-specific measures, including phishing-resistant authentication for work systems and regular audits of corporate data accessible through mobile applications.

 

Communication and entertainment

 

Beyond financial and workplace information, smartphones remain the primary platform for communication and entertainment.

 

The survey found that:

• 52 per cent of Indian respondents store text messages and chat histories.
• 48 per cent have social media accounts linked to their smartphones.
• 41 per cent store music, films, television shows or e-books.
• 22 per cent keep gaming accounts on their devices.

These findings illustrate how smartphones combine work, communication, finance and entertainment into a single connected device, increasing both their value to users and their attractiveness to attackers.

 

Cybersecurity priorities are changing

 

The findings reflect a broader shift in India's digital landscape. With smartphones serving as the primary internet device for many users, cybersecurity is moving beyond protecting individual applications towards safeguarding a person's complete digital identity.

 

As identity documents, financial credentials, workplace information and AI interactions increasingly converge on one device, the consequences of theft, loss or unauthorised access become significantly greater.

 

The survey suggests smartphones should now be regarded as critical digital assets rather than simply communication devices. 

 

Outlook

 

India's growing dependence on smartphones reflects an increasingly mobile-first digital lifestyle. As users continue storing financial records, work credentials, identity documents and AI conversations on a single device, smartphones are becoming comprehensive repositories of personal and professional information.

 

The findings suggest mobile cybersecurity is no longer limited to protecting applications or preventing malware. It increasingly centres on protecting the broader digital identities users carry with them every day.

 

In response to these changing patterns, Kaspersky recommends treating smartphones with the same level of security traditionally applied to computers.

 

The company advises users to maintain secure backups so important information is not stored solely on the device, use dedicated security solutions to protect passwords and other sensitive data, and prepare for device loss by enabling location tracking, automatic backups and immediate screen locking.