Why Financial Institutions Are Rethinking Cybersecurity in the AI Era

Financial institutions were early and enthusiastic adopters of artificial intelligence long before the current generation of models arrived. Machine learning has scored credit applications, flagged anomalous transactions and filtered phishing emails for the better part of two decades. What changed is the character of the technology. Generative models do not just classify; they produce convincing text, voice and video on demand. That single shift has pushed cybersecurity from a familiar discipline of patching, detection and response into something more disorienting, where the boundary between real and fabricated identity is negotiable and where the defensive tools themselves carry novel risk.

This report examines why that rethinking is happening now, what actually changed, and where the new defence priorities are settling. It draws primarily on regulator publications and documented incidents rather than vendor claims, because in this space the gap between marketing and reality is itself a security problem.

The threat model changed on both sides

The most visible change is that the cost of producing a convincing impersonation has collapsed. In February 2024, Hong Kong police described a case in which a finance employee at a multinational firm joined a video call with several colleagues, including the chief financial officer, and transferred roughly 25 million dollars across fifteen transactions. Every other participant on the call was a deepfake recreation built from public footage of the executives 1. The company was later identified as the engineering firm Arup, which confirmed that fake voices and images were used 1. The case matters for financial institutions because the attack did not exploit a vulnerability in any system. It exploited the ordinary trust that authentication processes are designed to confirm: the person on the call looked and sounded right.

The US Financial Crimes Enforcement Network formalised the pattern in an alert issued in November 2024, describing schemes in which deepfake media is used to defeat identity verification, most commonly by submitting synthetic or altered identity documents at account opening. FinCEN reported an increase in suspicious activity filings describing suspected deepfake use and published red flag indicators for institutions to build into their monitoring 2. The alert matters less for its novelty than for what it signals: identity fraud powered by generative models had become common enough to warrant a standing typology, not a case study.

The second side of the changed threat model is that attackers also use AI the way defenders do, for reconnaissance, for writing more plausible phishing in any language, and for scaling social engineering that used to require patient, skilled operators. None of this is new in kind. What is new is the price and the volume. A fraud attempt that once needed a fluent speaker and weeks of preparation now needs a prompt.

Identity is the new perimeter

For decades the defensive perimeter of a bank was a network boundary, then it became an identity boundary, and identity was verified with documents, knowledge-based questions and, increasingly, selfies compared against document photos. Generative models degrade every one of those controls. A synthetic identity document passes casual visual inspection. A generated face passes liveness checks that were designed against static photos. A cloned voice passes callback verification.

The consequence is that financial institutions are re-examining controls that were considered adequate for years. Know-your-customer processes built around document inspection now sit on top of an evidentiary base that can be manufactured. The Treasury Department's report on AI-specific cybersecurity risks in the financial sector, published in March 2024 after 42 in-depth interviews with banks, technology firms and anti-fraud companies, identified exactly this: fraudsters using generative AI to create synthetic identities and bypass verification, with digital identity processes and document authentication among the most exposed controls 3.

The responses now taking shape share a common logic: move trust away from what can be synthesised. That means liveness checks that require challenge-response rather than passive comparison, verification anchored in data the attacker cannot generate, such as verified credentials from issuing authorities, and behavioural signals that are expensive to fake consistently across a long session. None of these is a complete answer. The direction of travel, though, is clear. Verification is shifting from proving you look like your document to proving you are plugged into a web of records no model can fabricate.

The defence stack is becoming attack surface

The uncomfortable part of the AI shift is not that attackers got better tools. It is that the tools defenders deployed to keep up created a new category of system that nobody fully knows how to secure. Fraud detection models, AI assistants answering customer queries, and large language models summarising compliance documents are all now part of the institution's attack surface, and they fail in ways traditional security controls do not catch.

The failure modes are structural. Prompt injection lets an attacker redirect a model through its own inputs, which matters when the model has access to customer data or transaction systems. Data poisoning corrupts a model during training or fine-tuning, which matters because detection models trained on historical transaction data are only as trustworthy as that data. Model theft through extraction attacks matters because a fraud-scoring model that can be replicated offline can be probed until its blind spots are found and then traded. The Treasury report devotes sustained attention to these risks and to a third problem that compounds both: reliance on a small number of external providers for the underlying models, which concentrates risk in ways existing third-party risk frameworks were never designed to assess 3.

Concentration deserves separate emphasis because it connects AI risk to the resilience agenda regulators were already pursuing. The Financial Stability Board's November 2024 assessment of AI in finance identified third-party dependencies and service provider concentration, cyber risk, and model risk and governance as the vulnerabilities most capable of amplifying systemic risk 4. A financial system in which many institutions run risk scoring, fraud detection and customer communication on models from the same handful of providers has a correlated failure mode: a poisoned update, a subtle defect or an outage at one vendor propagates across the sector simultaneously. That is a systemic concern, not merely an operational one, and it is why supervisors rather than just chief information security officers are paying attention.

Regulators moved first

Financial institutions operate under some of the strictest technology regulation of any industry, and the AI-era cybersecurity rethink is being driven substantially by supervisory expectation rather than by internal conviction alone.

The baseline for model risk predates the current wave. The Federal Reserve's Supervision and Regulation letter 11-7, issued in 2011, established the model risk management framework US banks still operate under: models must be independently validated, their limitations documented, and their use governed 5. That framework extends, sometimes awkwardly, to machine learning and now to generative systems, and much of the current rethinking consists of working out how validation and governance disciplines written for spreadsheet-era models apply to systems whose behaviour cannot be fully enumerated.

Newer instruments build on it. The NIST AI Risk Management Framework, published in final form in 2023, has become the reference structure for organising AI risk into governance, mapping, measurement and management, and financial institutions use it to align AI programmes with their existing risk committees 6. In the European Union, the Digital Operational Resilience Act, applicable since January 2025, imposes ICT risk management, incident reporting and, critically, oversight of critical third-party technology providers on financial entities, which is where the model-provider concentration concern lands in practice 7. The Financial Stability Board's conclusion was that existing financial policy frameworks cover many AI vulnerabilities but may need reinforcement, and that authorities should close information gaps and build supervisory capability, including by using AI tools themselves 4.

The practical effect on institutions is a shift in what their security programmes must document. An AI model in a customer-facing or risk-relevant role now needs an owner, a validation record, documented failure modes, and a place in the institution's incident response and third-party management regimes. Models that would once have been deployed by a fraud team as an internal tool now attract the same scrutiny as a core banking system.

The capability gap

One finding recurs across every serious assessment: the AI security gap is widening between large and small institutions. The Treasury report found that large institutions are building in-house AI capabilities and hiring specialised staff, while smaller banks and credit unions generally depend on external vendors and lack the resources to evaluate what those vendors are actually doing 3. The FSB reaches a similar conclusion from the supervisory side, noting capacity constraints among regulators trying to keep pace 4.

This matters because the threat is not proportional to size. A community bank's customers are targeted by the same industrialised fraud operations that target global banks, and identity fraud at account opening is arguably easier against an institution with thinner verification infrastructure. The vendors smaller institutions depend on become the sector's soft flank, which loops back to the concentration concern. Treasury's recommended responses lean heavily on shared resources: sector-wide information sharing, government-provided guidance and tooling, and standardised vendor assessment, on the theory that individual small institutions cannot solve this alone 3.

What the rethink looks like in practice

Stripped of the strategy language, the institutional response now underway has five concrete components.

First, inventory. Institutions are cataloguing where AI systems touch customers, money and data, because a model nobody has registered is a model nobody governs. Second, identity hardening: upgrading verification against synthetic documents and deepfake impersonation, with the emphasis shifting to challenge-based liveness and out-of-band confirmation for high-value transactions. Third, extending model risk management to AI systems, including validation, documented limitations and independent review for models in risk-relevant roles, in line with the existing supervisory framework 5. Fourth, third-party and concentration analysis: understanding which model and cloud providers sit behind which processes, and what happens to the institution when a provider fails, in line with operational resilience rules such as DORA in the European Union 7. Fifth, fraud workflow redesign, because detection that flags a synthetic identity is worthless if the alert lands in a queue nobody staffs, a lesson financial institutions already learned with conventional fraud.

None of this is exotic. Most of it is the existing security and risk apparatus, pointed at a new class of system and a new class of attacker capability. That is also why the rethinking is realistic: institutions are not being asked to defend against the unknowable, only to extend disciplines they already have to systems that punish unexamined assumptions.

Limitations

Three caveats bound this report. First, the documented evidence base is asymmetric: regulator publications and a small number of confirmed incidents, such as the Arup case, are well established, but the overall prevalence of AI-enabled fraud against financial institutions is not reliably measured, since much depends on suspicious activity reporting that is itself incomplete. Second, the field is moving: standards, supervisory expectations and attacker technique all continue to evolve, and specific control recommendations age faster than the structural analysis. Third, much of the quantitative discussion of AI adoption in finance rests on surveys and interviews, including the Treasury report's 42 interviews, which capture the practices of participating institutions rather than the sector as a whole.