AI-Driven Cyber Threats Put Banks and Customers at Risk: Can the Internet Be Secured?

By Thomas P. Vartanian, Executive Director, Financial Technology & Cybersecurity Center

The internet is facing a rapid escalation in cybersecurity threats fueled by artificial intelligence. As AI tools become more capable, criminals, hostile groups and rogue automated agents may gain new ways to target financial institutions, disrupt critical systems and steal customer funds.

Banks, credit unions and fintech companies sit at the center of this growing risk. They protect the accounts, payment systems and financial infrastructure that criminals continually attempt to exploit. Although the banking industry has extensive safeguards, no institution can guarantee that every attack will be stopped.

Recent warnings about AI agents accessing financial accounts, discovering software vulnerabilities and bypassing system controls have intensified concerns across the technology and financial sectors. Even if some reports are overstated, the underlying trend is serious: cyber risks are expanding faster than many traditional defenses can adapt.

In 2023, I asked readers of my book The Unhackable Internet to imagine waking up and discovering that their money had vanished. One year later, thousands of bank customers experienced a similar nightmare when account balances temporarily showed no funds. For affected customers, the experience was sudden, confusing and deeply distressing.

As AI becomes more autonomous, that type of disruption could affect many more people unless financial institutions, technology companies and governments take stronger action.

Why AI Creates a Greater Cybersecurity Challenge

• The banking industry operates under some of the most demanding regulations, security standards, operational requirements and disaster-recovery procedures in the economy.
• Despite those safeguards, cyber vulnerabilities are expanding as AI tools become more sophisticated and automated attacks increase.
• AI-powered financial agents could move money rapidly between accounts and investments, creating new liquidity, authorization and risk-management challenges.
• The unresolved AI alignment problem means developers cannot guarantee that autonomous systems will always act in the best interests of users.
• Even strong defenses must operate on an internet infrastructure that was not originally designed for modern identity verification or security.

Financial institutions may ultimately have to prepare for several possible futures. In one scenario, people remain firmly in control of AI and use it to improve society. In another, advanced systems gain influence over human decisions. A third possibility involves humans and AI becoming increasingly integrated, creating an entirely new model of intelligence and technological dependence.

The Financial Industry Cannot Wait for a Perfect Solution

It would be dangerous to assume that government alone will protect the financial system from every cyber disaster. Individual institutions must continue investing in security, resilience and incident response. However, existing laws and policies can limit how aggressively organizations respond when they are attacked.

The financial sector also faces structural problems in regulation. The United States has one of the world’s most complex financial oversight systems, yet it has experienced numerous banking and financial crises over the past two centuries.

Several weaknesses deserve attention:

• Regulatory coverage is uneven. Banks and savings institutions face extensive oversight, while other parts of the financial system, including investment funds, cryptocurrency businesses, fintech firms and non-bank lenders, may operate under different standards.
• Regulatory agencies often disagree. Conflicting authority between federal and state regulators can waste resources, delay decisions and encourage regulatory arbitrage.
• Oversight is fragmented. A more coordinated system could combine public policy goals with the technical knowledge of private-sector security professionals.
• Systemic risk remains possible. A weakness at one connected company can create a path into other organizations, including financial institutions and critical infrastructure providers.

The Internet Was Not Designed for Modern Financial Security

The early internet was created to help universities share information and communicate. Security was not its primary purpose. Over time, financial services, commerce, government operations and essential infrastructure were built on top of that original foundation.

Many modern security problems stem from the fact that online identity remains difficult to verify. Internet addresses, passwords and device signals do not always establish who is actually operating a system or account.

A stronger digital security model could include:

• Authentication that connects each device to a verified person or organization.
• Clear rules governing access to critical systems and sensitive online services.
• Methods for rapidly disabling accounts, devices or automated agents that violate those rules.
• Greater accountability for individuals, companies and governments that deploy technology capable of causing widespread harm.

Without reliable identity and accountability, anonymity can make cybercrime easier to commit and more difficult to investigate. The result is an online environment in which attackers can target people and institutions across borders with a limited risk of being identified.

Cybercrime Is Highly Profitable and Difficult to Stop

The internet has created enormous benefits for society, but it has also produced a dangerous digital ecosystem. Criminals, hackers, predators and hostile governments can exploit vulnerable users, businesses and public institutions.

In the physical world, people rely on locks, police departments, courts and national defense systems. Online, comparable protections are often inconsistent or absent. Critical services may be connected to vendors, contractors and software platforms that create additional points of entry.

For financial institutions, the expanding threat includes account takeovers, payment fraud, ransomware, data theft, supply-chain attacks and automated social engineering. AI may make these attacks faster, cheaper and more convincing.

Potential measures include stronger digital identification, specialized access credentials for critical infrastructure and more effective cyber-investigation capabilities. Defending the financial system may eventually require a combination of human experts, automated monitoring and carefully controlled AI security tools.

Should Financial Institutions Return to Private Networks?

Before banks and other financial institutions became heavily dependent on the public internet, many organizations relied on proprietary systems and private networks. These environments generally offered tighter access controls and fewer connections to unrelated systems.

Private networks may provide a useful model for protecting the most sensitive financial and public infrastructure. A secure private network could restrict access to approved users, require stronger authentication and reduce exposure to the broader internet.

Such networks would not eliminate every cyber risk. Human error, insider threats and compromised credentials would remain concerns. However, limiting access could make attacks more difficult and reduce the ability of criminals to move from one connected organization to another.

Governments could consider incentives to help critical infrastructure providers transition to more secure network environments. Tax credits, grants or shared security standards could reduce the cost of adoption while creating a more consistent national defense.

Global Cooperation Is Essential

The internet crosses national borders, while laws and enforcement powers generally stop at them. This creates a major obstacle for governments attempting to regulate advanced technology, prosecute cybercriminals and protect critical infrastructure.

Countries that impose strict controls on frontier AI also face the risk of falling behind nations that prioritize rapid development. As a result, democratic governments need a coordinated international framework for digital security and AI governance.

A global agreement could establish common standards for:

• Digital identity and authentication.
• Cybersecurity hygiene and system monitoring.
• Cross-border investigations and enforcement.
• Liability for companies and institutions that deploy dangerous technologies.
• Security reviews before advanced AI applications are released.

One important principle should be that AI systems are monitored by other AI tools or independent security mechanisms. No high-impact application should be launched without continuous oversight capable of detecting misuse, unexpected behavior and unauthorized actions.

What Banks Should Do Now

Financial institutions have long been among the most advanced organizations when it comes to cybersecurity. Yet the insecurity of the broader internet makes it increasingly difficult for even well-prepared banks to protect customers and maintain uninterrupted operations.

Banks should continue strengthening identity verification, transaction monitoring, vendor risk management, employee training, backup systems and emergency response plans. They should also evaluate how autonomous AI agents could interact with accounts, payments and internal systems.

The industry should not wait for a major AI-related financial crisis before addressing the weaknesses built into the internet. A safer digital environment will require collaboration among banks, fintech companies, technology providers, regulators and international governments.

The internet can be redesigned to become more secure, but doing so will require political commitment, private-sector investment and a willingness to rethink long-standing assumptions about anonymity, access and accountability. AI may ultimately create the urgency needed to build a more resilient and less hackable internet.

About the Author

Thomas P. Vartanian is executive director of the Financial Technology & Cybersecurity Center. He has served as an official at three federal financial regulatory agencies and led financial services practices at international law firms. He is the author of The Unhackable Internet and 200 Years of American Financial Panics.

Source: Thefinancialbrand.com