An AI-powered cyberattack uses artificial intelligence to make cybercrime more convincing, scalable or automated—or targets AI systems and the data they use. Banks can be approached through scams aimed at customers and employees, attacks on bank technology, or attempts to manipulate AI tools used in financial operations. These are distinct routes: a deepfake or AI-written message can support a scam, but does not by itself bypass a bank’s security controls.
How AI-powered attacks against banks differ
AI can help produce or adapt an attack; it can also be the thing an attacker tries to manipulate. The distinction matters: familiar fraud can become more persuasive without becoming a new kind of bank-system exploit, while attacks on AI systems involve weaknesses in models, their inputs or their data.
As an Amazon Associate I earn from qualifying purchases.
| Attack route | Primary target | Typical intended outcome | Evidence status |
|---|---|---|---|
| Deception and impersonation | Customers or bank employees | Disclosure of information, account access or a fraudulent payment | Documented criminal use described by the FBI |
| Technology compromise | Bank software, devices or networks | Information theft, disruption, file encryption or unauthorized access | AI-assisted malware is described by BIS; advanced vulnerability discovery and exploit development are assessed risks |
| Attacks on AI systems | Models, their inputs or training data | Altered model behavior, misclassification or information extraction | Risk categories described by the FSB and BIS; not evidence of a particular bank incident |
How AI scams target customers and bank staff
Generative AI can produce fluent, tailored text, synthetic images, cloned audio and deepfake video. Criminals can use these materials to impersonate a bank employee, a customer, a manager or another trusted person. The goal is to influence a human decision: share credentials or sensitive information, follow an instruction, grant access, or authorize a transfer.
The FBI’s December 3, 2024 public service announcement describes generative AI being used for fraud at greater scale and believability. Its examples include spear-phishing messages, fake social profiles and identity documents, cloned voices, and video impersonation. The FBI also warns that criminals may use generated audio while impersonating individuals to obtain access to bank accounts. These are described methods, not evidence that every scam succeeds or that AI is necessary to conduct one.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
For a bank customer, the practical warning is not simply “watch for bad spelling.” A convincing message, familiar voice or realistic video is not proof of identity. Be especially cautious when a communication creates urgency and asks for a password, one-time code, sensitive information or payment.
How AI can help compromise bank technology
AI can assist with familiar technical attacks as well as social engineering. The BIS Annual Economic Report describes generative AI as a possible aid to writing credible phishing emails and malware that steals information or encrypts files. In this route, the target is the bank’s technology or the people who operate it, rather than the AI model itself.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
A separate concern involves more capable frontier models. A Bank for International Settlements Financial Stability Institute paper dated September 9, 2026 assesses that such models could help discover software vulnerabilities, develop exploits and carry out multi-step cyber operations. If discovery and exploitation happen faster, banks may have less time to identify affected systems and apply fixes. This is a capability and risk assessment, not proof that a named bank has experienced such an attack.
Why shared technology providers matter
A bank’s exposure can extend beyond systems it operates directly. The BIS Financial Stability Institute warns that financial firms’ reliance on common cloud, software and frontier AI providers can create concentration and dependency risks. A disruption or policy change at a provider used by many institutions could affect several firms or jurisdictions at once, even without a direct attack on each bank.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How attackers can target AI systems and data
The Financial Stability Board’s June 2026 consultation report identifies several categories of attacks involving AI systems. They are related but not interchangeable:
- Data poisoning: tampering with data used to train or operate a model so its performance or outputs are degraded or altered.
- Prompt injection and jailbreaking: using malicious inputs or instructions to change a model’s behavior or bypass safeguards.
- Evasion: crafting inputs that cause an AI system to misclassify or mishandle something it is meant to assess.
- Model extraction: probing a model to infer information about the model or the data it contains.
The BIS Annual Economic Report also discusses prompt injection and data or model poisoning. These categories describe ways AI systems may be attacked; their inclusion in official risk assessments does not establish that a particular bank has suffered one.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What is known—and what the evidence does not show
The official sources describe methods, documented criminal uses and emerging capability concerns, but they do not provide a directly comparable statistic for the number or share of bank cyberattacks caused by AI. Broad fraud or cybercrime totals should not be treated as measurements of AI-enabled attacks against banks.
Free tools Windows power users keep installed
One-click scans. No signup required.
A 2024 BIS paper reports a survey of cybersecurity experts at major central banks. Respondents saw potential defensive uses for generative AI, including better threat detection and faster response, alongside concerns such as social engineering and unauthorized disclosure. Central banks are relevant to financial-sector cybersecurity, but that survey is not an incident count for commercial banks.
How banks can reduce the risks
AI does not replace the fundamentals of cyber and operational resilience. The controls highlighted across BIS and FSB sources include:
- Maintain an inventory of technology and monitor systems for suspicious activity.
- Identify and remediate software vulnerabilities promptly, with response plans that account for a potentially shorter window between discovery and exploitation.
- Test incident response and recovery so the organization can contain disruption and restore operations.
- Assess dependencies on cloud, software and AI providers, including the consequences of a disruption affecting a shared supplier.
- Govern AI use, inputs and access to sensitive data, and manage risks to models and the information they rely on.
What bank customers can do
- Verify urgent requests independently. If a call, message, voice note or video asks you to disclose information or move money, contact the bank using a number or channel you obtain independently, such as its official app or card.
- Do not treat a familiar voice or face as authentication. Call the person or institution back through a known channel before acting on an unusual request. The FBI also suggests a shared verification phrase for family-impersonation scams.
- Follow the bank’s authentication procedures. Do not share passwords or one-time codes in response to an unsolicited request. A FIDO-compliant hardware security key or software passkey may offer stronger account authentication where supported, but availability varies by bank and device.
- Report suspected impersonation or unauthorized activity promptly. Use the bank’s official contact route so it can advise on securing the account and investigating the report.
In remarks delivered August 17, 2026, Monetary Authority of Singapore Deputy Governor Adnan Zaylani Mohamad Zahid said AI can make phishing more personalized and persuasive at scale, including through deepfake impersonation and customized scam messages. MAS remarks also identify FIDO-compliant security keys and software passkeys as methods being studied with banks; that does not establish universal support or a particular product recommendation. Authentication keys are one control, not a defense against every social-engineering attempt, malware infection or bank-side vulnerability.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute
