3 Steps to Help Your Financial Institution Stay Ahead of Evolving Cyber Crime
By Rick Van Luvender, Senior Vice President, Information Security, Fiserv
Simple Subscribe
Subscribe Now!
Executive Summary
- AI-driven cyberattacks are evolving faster than traditional defenses, exploiting human trust as much as technology. Financial institutions face adversaries that automate deception, infiltrate systems at scale and undermine confidence in digital banking.
- The threat now extends beyond data loss to trust erosion. Deepfakes and social engineering blur the line between real and fake, turning every employee and customer interaction into a potential vulnerability.
- Resilience demands intelligence-led defense. Banks must integrate threat insights into strategy, manage vendor risk continuously, and embed security into every digital touchpoint to protect both customer experience and institutional credibility.
It begins with a series of system slowdowns — what the IT team initially mistakes for a routine hardware issue. The investigation, however, reveals a far worse reality: a stealthy cyberattack. Suddenly, the personal and financial data of millions of customers — from account details to Social Security numbers — is at risk of exfiltration.
This scenario represents a threat that financial institutions have battled for years, as the very nature of the financial services sector makes it a target. Today, however, these classic attacks on a bank’s infrastructure are being amplified as cybercriminals weaponize AI to operate with unprecedented speed and sophistication. The most alarming development is how this technology is being used not just to attack systems, but to manipulate people.
According to Accenture’s Guardians of Trust survey, AI-generated deepfakes are now the most common threat observed by banks, with deepfakes targeting customers and employees increasing by 243% over the past year. While new digital tools like mobile banking and AI-powered chatbots make life easier, they also create fertile ground for cyberattacks.
Simultaneously, the scope of social engineering is growing, with phishing campaigns that look like legitimate corporate emails with a spoof link or lookalike websites, where the deception can be as subtle as, for example, replacing the letter ‘O’ with a ‘0.’ An employee clicking on one of these links can put a financial institution’s entire infrastructure at risk of cyberattacks.
Countering these evolving cyber threats requires a flexible, intelligence-driven defense built on three pillars: proactive threat intelligence, active third-party vendor management and a delicate balance between robust security and protecting the customer experience. These are essential when the average cost of a breach is $6.1 million per incident, according to a recently released IBM report, making financial services one of the hardest-hit industries in the U.S.
Invest in Intelligence, Not Just Tools
The biggest mistake financial institutions can make is spending their budget on new technology without a strategy that connects that technology to the real-world threats they face. A modern security program must be built on a foundation of threat intelligence that dictates every investment, including what parts of your infrastructure — from payment gateways to mobile banking platforms and cloud environments — to protect and how to configure defenses.
With this integrated approach, security tools are targeted at actual threats and attack vectors rather than a popular new tool that may not address specific risks a financial institution faces. The urgency is magnified further by the fast pace of AI-leveraged attacks, with Accenture finding that 83% of banks struggle to align security measures with the pace of new technology.
Effective intelligence should include partnering with vendors with native language capabilities, as attacks can originate anywhere in the world. This goes beyond simply hiring an employee who knows a language formally. Specialized vendors who understand the vernacular of the dark web are better able to identify potential threats, offering a clearer view of emerging threats before they happen.
Dig deeper:
Practice Active Vendor Management
In today’s interconnected ecosystem, an institution’s security is often only as reliable as its weakest link, frequently a third-party vendor. When a financial institution integrates a vendor’s software into its infrastructure, it is potentially opening a backdoor into a bank’s network. Therefore, annual check-ins to make sure your vendor is insured or has proper backup protocols are no longer enough.
Security requires proactive and consistent engagement about new vulnerabilities and vendors’ own supply chains, including where they offshore support. This means moving beyond compliance and asking pointed, operational questions: Are you operating in countries adjacent to sanctioned nations? What are your protocols for a zero-day vulnerability? How do you secure software that connects to your infrastructure?
By treating vendors as extensions of your own security perimeter, you can close critical security and liability gaps before they can be exploited.
Balance Security and Customer Experience
Financial institutions must address two equally vital customer needs: the desire for convenient digital banking and the critical requirement to keep accounts and funds secure from unauthorized access by cybercriminals. The goal is to embed security seamlessly into the entire digital customer journey.
Calculated points of friction, like multi-factor authentication, are not obstacles; they are trust signals that show a commitment to protecting the customer’s financial data. This is critical when the stakes are high: the Accenture survey found 62% of customers lose confidence in their bank after a breach, and 43% choose to move accounts to another bank.
The evolution of cybercrime is inextricably linked to technology, from exploiting early e-commerce in the 90s to deploying AI-powered phishing today. For security leaders, the challenge is no longer just defending against current attacks but building an organization agile enough to anticipate the next wave.
However, technology is also your ally. Countering the threat from increasingly sophisticated cyber threats requires embedding intelligence into the core of your strategy, demanding transparency from your supply chain, and proving to customers that they can put their trust in your institution to protect them as far as possible against ever-changing threats. The question is no longer whether your defenses are strong enough for today, but if your security strategy and tools are resilient enough for tomorrow.
