Key Takeaways
- FinCEN's November 2024 alert (FIN-2024-Alert004) confirmed a rise in deepfake-enabled fraud against financial institutions, citing an incident where fraudsters used a deepfake video call impersonating a company's CFO to convince a finance employee to wire $25 million.
- Deloitte's Center for Financial Services projects generative-AI-enabled fraud losses in the US could reach $40 billion by 2027, up from $12.3 billion in 2023 — a 32% compound annual growth rate.
- Prompt injection has ranked #1 on OWASP's Top 10 for LLM Applications for two consecutive editions, and it's the risk most likely to hit customer-facing banking chatbots and AI agents directly.
- The U.S. Treasury's March 2024 report on AI-specific cybersecurity risk found that signature-based detection often can't catch AI-modified malware, and recommended expanding NIST's AI Risk Management Framework for financial-sector use.
- Shadow AI, employees or systems using unsanctioned AI tools, creates the same blind spot shadow APIs did a decade ago: risk you can't govern because you don't know it exists.
- Securing AI in finance means governing the model, the data it touches, the agents it can trigger, and the identities behind all three, not deploying one tool and calling it done.
AI security in financial services means protecting the AI systems banks, insurers, and fintechs now run for fraud detection, credit underwriting, customer service, and trading, from both attacks that use AI (deepfakes, AI-generated malware) and attacks against AI itself (prompt injection, model poisoning, data leakage). It’s a different discipline from traditional application security, because the thing you’re protecting can be manipulated through its inputs in ways a REST API never could be. This guide covers the risks that are actually being reported to regulators right now, what US and global regulation already requires, and the controls that address each risk specifically.
Why AI Security Matters in Financial Services Now
Financial services adopted AI faster than most sectors, and attackers followed. Two threads make 2026 different from even two years ago. First, generative AI has made fraud tooling cheap: Deloitte’s Center for Financial Services projects that generative-AI-enabled fraud losses in the US could climb from $12.3 billion in 2023 to $40 billion by 2027, a 32% compound annual growth rate, driven by how easily deepfake and synthetic-identity tooling can now be rented or bought on underground markets. Second, banks themselves are now running AI as production infrastructure, not pilots, which means the model, its training data, and the agents it can trigger are all now part of the attack surface a security team has to own.
The Banking AI Threat Landscape in 2026
Two categories of risk sit side by side, and conflating them is the most common strategic mistake:
- AI-enabled attacks: fraud and cyberattacks that use AI to be more convincing or more scalable — deepfake impersonation, AI-generated phishing, AI-assisted malware.
- Attacks on AI systems themselves: exploiting the bank's own AI, fraud models, chatbots, underwriting engines, or agentic tools, through their inputs, training data, or excessive permissions.
The U.S. Department of the Treasury’s March 2024 report, Managing Artificial Intelligence-Specific Cybersecurity Risks in the Financial Services Sector, drew the same distinction after interviewing financial institutions of varying size. It found that AI can meaningfully lower the bar for attackers to generate and deploy malware and discover vulnerabilities, and specifically warned that signature-based detection systems, the backbone of a lot of legacy security tooling, may not catch AI-modified malware. Treasury’s recommendation was to expand NIST’s AI Risk Management Framework for financial-sector-specific use rather than build a parallel standard from scratch.
Key AI Security Risks in Banking and Financial Services
Deepfake Impersonation
Fraudsters use AI-generated voice and video to bypass customer authentication and call-center identity checks, and increasingly to bypass internal financial controls, not just customer-facing ones. FinCEN’s Alert FIN-2024-Alert004 (issued November 13, 2024) responded to a rise in suspicious activity reports describing deepfake media in fraud schemes, most involving fabricated or altered identity documents used to defeat account-opening verification. The alert also cited a widely reported incident earlier that year in which fraudsters staged a deepfake video call impersonating a multinational company’s CFO, convincing a finance employee to wire $25 million to the fraudsters’ account. FinCEN’s recommended mitigations include phishing-resistant multi-factor authentication and live verification checks that require a customer to confirm identity through audio or video in real time, rather than relying on static document checks alone. Credential-based account takeover follows a related but distinct pattern; see our guide to credential stuffing and banking account takeover for that specific threat.
Prompt Injection
OWASP’s Top 10 for LLM Applications & Generative AI (2025 edition) ranks prompt injection as the top risk for the second consecutive release. It occurs when crafted input, direct or embedded in an external document or webpage the model later processes, overrides the model’s intended instructions, extracting sensitive data or triggering actions the deploying institution never intended. For a bank running an AI-powered customer service agent or an internal research assistant that reads external documents, this is a direct exposure path. Securing an LLM-backed API against this requires the same defense-in-depth logic covered in a recent LLM API security article. So treat every model input as untrusted, validate what the model is allowed to do with its outputs, and don’t let a single injected prompt cascade into an API call the institution didn’t authorize.
Autonomous Attack Surrogates and Agentic Risk
As banks move from single-turn chatbots to AI agents that can call tools, query databases, and take multi-step actions, OWASP’s “Excessive Agency” category becomes directly relevant: unchecked permissions on an agent can turn a single successful manipulation into a chain of unintended actions rather than one bad response. This is compounded when agents communicate through newer protocols like MCP; see our article on Model Context Protocol security and the analysis of a real AI agent security incident involving OpenAI and Hugging Face infrastructure for how this plays out against production systems, not hypothetical ones.
Permission Sprawl and Shadow AI
Employees adopting AI tools without security review, pasting customer data into a public chatbot, connecting an unsanctioned AI plugin to internal systems, creates exactly the same governance gap that shadow APIs created a decade ago: risk that exists whether or not the security team knows about it. Our analysis of shadow AI and shadow MCP covers how this surfaces in practice and what discovery looks like for AI-specific shadow infrastructure, not just shadow APIs.
Model Poisoning and Data Integrity
Adversaries who can influence a model’s training data, or the data a retrieval-augmented system pulls from at inference time, can bias fraud models toward missing specific patterns or push credit models toward specific bad outcomes. This is harder to detect than a traditional breach because the system keeps functioning; it just functions wrong, in a way that may only surface in an audit or after losses accumulate.
AI Fraud Detection Risks: When the Defense Becomes the Target
The uncomfortable irony in AI security for financial services is that the same generative tools banks use to fight fraud are the tools attackers use to defeat fraud detection. Deloitte’s assessment notes that generative AI-enabled deepfakes increasingly incorporate self-learning mechanisms that continuously test against and adapt to computer-based detection systems, meaning a fraud model tuned against last quarter’s deepfake generation techniques may already be behind the current ones. This is why Treasury’s report and Deloitte’s assessment both converge on the same recommendation: AI-based fraud defenses need continuous retraining and human-in-the-loop review, not a set-and-forget deployment.
AI Security Regulations in Finance
Regulatory coverage of AI in financial services is still forming, but three reference points already matter for compliance planning:
- NIST AI Risk Management Framework (AI RMF 1.0): the voluntary framework Treasury explicitly recommended expanding for financial-sector use; it structures AI risk into govern, map, measure, and manage functions, and is becoming the de facto reference for AI governance documentation even absent binding regulation.
- U.S. Treasury (March 2024): recommends financial institutions manage AI-specific cybersecurity risk within existing laws, regulations, and supervisory guidance, and calls for a common AI lexicon between industry and regulators, an unresolved gap that still complicates audits and vendor due diligence today.
- FinCEN (November 2024): creates a concrete Bank Secrecy Act reporting obligation, financial institutions filing Suspicious Activity Reports connected to deepfake fraud should reference the alert using the key term "FIN-2024-DEEPFAKEFRAUD."
- Global comparison point - India's RBI FREE-AI framework: released August 13, 2025, the Reserve Bank of India's Framework for Responsible and Ethical Enablement of Artificial Intelligence sets out 26 recommendations across governance, consumer protection, and assurance for AI use in regulated financial entities. It's a useful comparison for multinational institutions since it takes a more prescriptive, principles-based approach than the still-developing US posture, built around explicit disclosure obligations and a customer's right to override an AI-driven decision.
None of these currently function as a single unified “AI compliance checklist” the way PCI DSS does for card data, which is itself a compliance risk: institutions operating across jurisdictions are assembling a governance posture from multiple partial frameworks rather than one standard.
AI Model Risk Management in Banking
Model risk management isn’t a new discipline for banks. The Federal Reserve and OCC’s SR 11-7 guidance governed quantitative model risk from 2011 until April 17, 2026, when the Fed, OCC, and FDIC jointly issued SR 26-2, “Revised Guidance on Model Risk Management,” which supersedes SR 11-7 and updates it toward a risk-based approach tailored to a bank’s specific model risk profile and complexity (most directly relevant to banking organizations with over $30 billion in total assets). Either version stresses the same underlying point for AI: machine learning models strain model risk management in ways traditional statistical models didn’t, since they’re harder to explain, they can drift without an obvious trigger, and a compromised or poisoned model can fail silently rather than throwing an error. Extending model risk management practice to AI systems means treating the model itself as a governed asset, with documented validation, monitoring for performance drift, and an explicit owner accountable for its behavior, in addition to the infrastructure-level security controls covered above.
Essential Security Controls for AI in Financial Services
For a broader, enterprise-wide version of this framework not specific to financial services, check our AI security strategy guide. None of these controls work as a single deployed product; they’re a governance and monitoring posture that a platform can support but not replace.
- Secure Your Institution's AI Systems Today
If your institution has deployed generative AI or agentic tools without a documented review against NIST’s AI RMF, that’s the highest-leverage starting point, before the next audit or the next SAR makes the gap visible for you. See how our AI & LLM Security platform detects prompt injection and anomalous AI/API behavior in real time, and estimate the cost of unmitigated AI-driven fraud against a platform investment with the WAAP security ROI calculator. And for further discussion or if you want to have a free run of our AI security.
Frequently Asked Questions (FAQ)
1. How is AI being used in financial services?
Financial institutions use AI for fraud detection, credit underwriting, customer service chatbots, algorithmic trading, compliance monitoring, and personalized financial recommendations. Generative AI specifically is expanding into drafting, summarization, and increasingly agentic tools that can take multi-step actions rather than just answering questions.
2. How does JPMorgan use AI?
JPMorgan has publicly discussed using AI across fraud detection, risk management, and internal productivity tools, including large-scale model deployment for transaction monitoring. Deloitte’s fraud research specifically names JPMorgan among institutions that have built AI-based fraud defenses to counter the same generative-AI-enabled fraud techniques discussed above.
3. What does AI security do?
AI security protects AI systems from being manipulated (through prompt injection, data poisoning, or excessive agent permissions) and protects organizations from AI-enabled attacks like deepfake fraud, distinct from traditional cybersecurity, which protects infrastructure and applications that don’t take probabilistic, input-dependent actions the way AI models do.
4. Which AI tool is best for financial services?
There isn’t a single best tool; the right choice depends on the use case (fraud detection, underwriting, customer service, or agentic automation) and the institution’s regulatory environment. What matters more than the specific model or vendor is whether the deployment includes governance mapped to a framework like NIST’s AI RMF, documented model risk management, and runtime monitoring for the specific risks covered above, prompt injection, excessive agency, and data integrity, before it goes into production.
