The Increasingly Hackable Internet Endangers Banks and Customers. Is There a Fix?

By Thomas P. Vartanian, executive director, Financial Technology & Cybersecurity Center

Published on October 27th, 2026 in Banking Technology

Simple Subscribe

Subscribe Now!

The internet has been overrun by a “dizzying AI-driven acceleration of cybersecurity threats” that is reverberating around the world. AI has brought cyberspace to a precipice that threatens the safety and security of people and their money.

Financial institutions — banks, credit unions and fintechs — guard the gates through which many of those threats must pass. Money attracts criminals like honey attracts flies, and cyberspace spawns more felonious flies every day.

The Comptroller of the Currency said in a recent TV interview that “banks are well-positioned to defend their systems against threats from rogue AI agents.” But that doesn’t guarantee that they will succeed.

Dark headlines about rogue AI accessing bank accounts, creating bugs that could take down 70% of the internet, jailbreaking its confines, and uncovering damaging internet security flaws appear almost every day. Even assuming a 50% hype factor, these developments are frightening.

In 2023, after predicting events such as we are experiencing, I asked readers of my book, The Unhackable Internet to consider what they would do if they woke one morning to find their money gone.

A year later, that question became frighteningly real for 20,000 customers who logged into their bank accounts to find that their money had disappeared. One account holder, staring at $0 account balances, described it as a “heart-stopping” moment.

AI threatens to make that nightmare a reality for many more customers if we do not act.

Need to Know:

The U.S. banking industry is second only to national defense when it comes to the implementation of regulations, industry standards, tabletop exercises, and operational redundancies, all of which can mitigate the impact of a catastrophic cyber event.
However, cyber vulnerabilities are increasing exponentially as AI evolves and instances of rogue AI intrusions increase. Cyber-defense will struggle to keep up.
AI is also creating new liquidity and money management challenges for financial institutions, given the increasing use of agents that can move funds at the blink of an eye to maximize customer yields.
The inability of experts to solve the “alignment” problem means that no one can guarantee that AI will always pursue the best interests of the user.
Even the best guardrails, defenses and precautions will have to be deployed in a virtual environment that is fundamentally insecure.

As AI matures, financial institutions will have to be prepared for one of three possibilities:

The Zuckerberg world, where humans will control and direct AI for the betterment of all.
The Gates world, where AI may dominate humans.
The Kurzweil world, where human intelligence and AI merge creating the next level of human evolution.

It’s Time to Act on the Hackable Internet

Like the tooth fairy, believing that the government is protecting us against cyber disasters is wishful thinking. Cyber-defense is up to individual institutions.

Unfortunately, their hands are tied by federal law that effectively prevents them in large measure from fighting back when they are attacked. This makes cybersecurity an increasingly uphill battle as new technologies are deployed and the security of networks is determined by the capabilities of the least sophisticated user.

As I detailed in The Unhackable Internet, financial institutions must take the lead in fixing the insecurity of the internet to create an unhackable internet before we are all catapulted into the next level of cyber hell.

Here’s the starting point:

The current model of financial regulation has failed us. The U.S. has the most sophisticated and intricate regulatory system in the world but has also endured more financial banking crises (ten) in the last two centuries than every other industrialized country except Argentina.
Today financial risk gravitates toward less regulated entities since we overregulate 30% of the financial services market made up largely of banks and savings institutions, and under regulate the other 70% that includes funds, cryptocurrencies, fintechs, non-bank lenders, etc.
Federal and state financial regulators constantly contradict, trip over, and sue each other, arguing about who has jurisdiction, wasting valuable time and expertise while creating the opportunity for regulatory arbitrage.
This system is ill-structured and prone to systemic failures. Financial regulators should be consolidated into streamlined cooperative oversight organizations that marry the public policy interests of government with the expertise of private industry.

-- Article continued below --

The Internet Problem Transcends Boundaries

The internet was not built to be secure when it was handed off in 1969 to four universities to facilitate the sharing of academic research. It has not been made secure since. Subsequent technological advancements have simply been layered onto its vulnerable foundation.

Key insight: It makes no sense to live in a digital world where no one is required to identify themselves.

There are internet protocol addresses and other markers of identity, but we need better gating processes that truly identify someone as a specific person who can be held accountable for their online conduct. Social media has only exacerbated the problem, making the anonymity of cyberspace a deeply pernicious feature.

Real authentication must link every device to an approved human being.
Users must be required to adhere to rules and be subject to “kill-switches” that terminate their online existence if they do not.
Individuals, institutions, and nations that do not agree and participate in creating real authentication standards should be excluded from networks and platforms sponsored by those that do.

Cybercrime: Too Easy, Too Rewarding, and Too Difficult to be Stopped

There are two cyberspaces.

One has improved the quality of our social and business lives.
The other is a polluted ecosystem where criminals, hackers, sexual predators and adversarial nations can take advantage of people, with little chance of being apprehended. In that constantly evolving cyberspace relative novices can launder money, traffic humans, distribute weapons, smuggle drugs, finance terrorism and distribute child sexual abuse material.

Key insight: In the analog world, people do not go without locks on their doors, live in cities without police, or disband armies that guard their countries’ borders. But we effectively do just that when we are online.

The list of financial institutions and companies around the world that have been hacked, put out of commission for some period, or otherwise placed in harm’s way is now too long to count. And this trend is only getting worse every month that passes.

Civilized societies need strong governance. The failure to create or adhere to rules has consequences in real life, and so it should in cyberspace.
Access to the internet, and particularly to sites related to critical infrastructures, should require online passports issued after a strong authentication process.
Unless a cyber police force — whether human, AI or both — is achievable, ubiquitous and effective, financial institutions face an uphill battle against a growing legion of global online hackers, criminals, creeps and terrorists.

Turn Back the Clock for the Sake of Security

Before 1994, when financial institutions first went online, the industry functioned more securely through proprietary systems and networks. Such networks controlled access, were less vulnerable to attack, and could not easily be used to gain access to other networks. That has all changed.

Consider the digital leap-frogging lesson that Clifford Stoll described in The Cuckoo’s Egg when a 75-cent computer time discrepancy at his lab was eventually tracked to a breach of their system by a freelance agent working for the KGB. The agent had used entry into the lab’s systems to connect with military bases around the country.

If an AI agent were to hack into the billing and payments system used by a building maintenance company that cleaned the offices of a law firm which advised a Federal Reserve bank, might it similarly be able to breach its way into the Federal Reserve network through the billing and payments portals of each connected entity?

The insecurity of the internet and the increasing vulnerabilities created by human error screams out for a return to secure private networks (SPNs) that maintain high levels of user authentication and offer access only to a limited group of credentialed individuals.
With the increasing costs of cyber-attacks spiraling out of control, the expense of fixing the internet should be more than offset by the savings created by significantly less fraud.
SPNs should be mandated by law for all critical infrastructures as a matter of public safety. Lawmakers should consider things like one-time tax incentives to subsidize the costs of that conversion.

-- Article continued below --

Next Steps for the Industry and the Country

The internet is global in nature and not controlled by any one country, making regulation and enforcement a challenge. At the same time, countries that regulate technologies like frontier AI could fall behind as China sprints forward in the AI arms race.

Democratic nations must come together to establish an online international accord — a tech version of the 1944 Bretton Woods Agreement.

Such agreements should establish international controls and regulations that would secure the internet and create effective forms of online governance. The latter would include enhanced authentication, digital hygiene, effective enforcement, and the imposition of liability to make everyone accountable for the technology they deploy.

And most importantly, AI must be deployed to regulate AI — meaning that no new application should be released unless it is partnered with an AI overseer.

Financial institutions have always been ahead of the curve when it comes to cybersecurity. But the inherent vulnerability of the internet makes the challenge of meeting the threats of AI even more daunting.

Against our better interests, we have chosen not to renovate the internet to make it more secure. It could have been done — and it still could. It just takes public and private sector leaders willing to make the decision to do it. Perhaps AI will create the crisis that they need to encourage them to move toward the creation of an unhackable internet.