AI-driven threats

AI-driven threats are attacks that use artificial intelligence to increase the speed, scale, realism or adaptability of criminal activity, or that target the data, models and applications used to operate AI systems. For financial institutions, the risk spans two connected surfaces: attacks that use AI against customers and employees, and attacks against AI-enabled systems themselves.

The most important shift is operational. AI helps attackers create convincing messages, imitate trusted people, automate reconnaissance and adapt campaigns faster. At the same time, AI applications introduce technical attack paths such as prompt injection, model and data poisoning, excessive agency, supply-chain compromise and sensitive information disclosure.

This guide provides a November 2026 snapshot of AI threat vectors, their implications for banking and payments, and security principles that can help contain their impact. The threat landscape is evolving rapidly: attacker capabilities, model behavior, deployment patterns and security guidance can change. The focus is on practical risk management, not an exhaustive or permanent ranking of threats.

AI-driven threats at a glance

1. AI-enhanced phishing and social engineering

AI-enhanced phishing uses generative tools to create persuasive messages, landing pages, chat conversations and follow-up campaigns at scale. The attack does not need to contain obvious spelling errors or awkward phrasing. It can be tailored to a target’s role, language, organization and recent activity.

In banking, this can support credential theft, account takeover, payment redirection and authorized push payment scams. Attackers can also use conversational systems to maintain pressure across email, text, messaging applications and voice calls. The campaign becomes a coordinated interaction rather than a single suspicious message.

Controls should assess more than the message itself. Device identity, behavioral patterns, transaction context, session changes and the customer’s normal activity can reveal risk that language analysis misses. Risk-based authentication and adaptive step-up controls help institutions challenge high-risk actions while keeping trusted activity moving.

2. Deepfake voice, video and identity impersonation

A deepfake is AI-generated or AI-manipulated media that imitates a real person or creates a synthetic identity. Criminals use them to impersonate customers, executives, relatives, public officials and service agents.

Financial attacks can begin with a convincing phone call requesting a payment, a video interaction used during onboarding, or synthetic identity evidence used to pass remote checks. A familiar voice or face is not proof of intent, authorization or transaction legitimacy.

Social engineering scams: How deepfakes pour fuel on the fire illustrates how convincing impersonation can manipulate customers into making payments.

Financial institutions should treat biometrics and media as signals within a broader identity decision. Strong controls combine possession, device, behavioral and transaction intelligence with verification of the action being requested. High-risk changes, such as adding a new endpoint or initiating an unusual transfer, should receive independent confirmation through a trusted channel.

3. Automated reconnaissance and precision targeting

AI can help attackers collect public information, identify likely employees, map technology stacks and generate tailored pretexts. It can also test many variations of a campaign and retain the responses that produce the strongest engagement.

This reduces the effort needed to target specific roles such as fraud analysts, treasury staff, customer-service agents and executives. It also increases the chance that an attacker will understand an institution’s terminology and approval processes before attempting a high-value action.

Defenses should join signals across channels. A suspicious login, a new device, a password reset, a new payee and a high-value transfer may be related events even when they occur at different times. Authentication Advisor is designed around real-time, context-driven intelligence that helps institutions make decisions across the customer journey.

4. Prompt injection and indirect prompt injection

Prompt injection occurs when content changes an AI system’s behavior in a way the application developer did not intend. Direct injection comes from a user’s input. Indirect injection arrives through content the system retrieves or processes, such as an email, web page, document, support ticket, image, audio file or tool response.

Untrusted content must not become authority to access data or execute an action.

One possible outcome is instruction drift, where an agent’s actions move beyond the user’s original instruction or approved scope.

Prompt injection is primarily an architectural risk. Keep authorization and policy enforcement outside the model. Validate outputs in trusted application code, isolate untrusted content, restrict tool permissions and require approval for high-impact or irreversible actions. Treat model output as untrusted input until it passes deterministic checks.

5. Excessive agency and tool misuse

Excessive agency occurs when an AI system has more functionality, permissions or autonomy than its task requires. A manipulated or incorrect model output can then trigger actions such as sending messages, changing records, moving funds, calling APIs or modifying infrastructure.

Each additional tool, permission and connected system expands the agent’s attack surface: the points where an attacker could influence data, gain access or trigger an unauthorized action.

The risk is especially important in financial services, where a support assistant, payment workflow or operations agent may sit close to sensitive customer and transaction systems. A model that can read a mailbox may not need permission to send messages. An assistant that can review a payment may not need permission to approve it.

Limit each agent to the smallest set of tools and permissions required. Preserve the customer’s authorization context across every step. Use independent policy checks before execution, apply rate limits and circuit breakers, and require explicit approval for actions that are high-value, irreversible or externally visible.

6. Data and model poisoning

Data poisoning is the manipulation of data used to train, fine-tune, evaluate or retrieve information for an AI system. Model poisoning targets model files, adapters or other artifacts so that harmful behavior is embedded into the deployed system.

In fraud prevention, poisoned transaction labels could teach a detection model to treat suspicious activity as legitimate. In a retrieval-augmented generation system, a poisoned document or embedding could influence answers for many future sessions. Poisoning can remain hidden because the system may perform normally under ordinary tests.

Track data and model lineage, verify changes, separate trusted from untrusted sources and retain rollback capability. Financial institutions should monitor model behavior against known baselines and test for trigger-based failures, bias, drift and unexpected changes in fraud detection outcomes.

7. AI supply-chain compromise

AI supply chains include datasets, pre-trained models, adapters, packages, model-serving frameworks, conversion tools, plugins and agent tool servers. A compromise at any stage can introduce malicious code, a backdoor, altered behavior or a privacy risk into a trusted environment.

Model documentation alone does not prove that an artifact is authentic or safe. A model can be replaced, modified during conversion or combined with a compromised adapter. Agent deployments also add tool registries and external protocol servers to the supply chain.

Maintain an inventory of models, datasets, adapters and tools. Pin versions by immutable digest, verify signatures and provenance, scan dependencies, review supplier access and evaluate behavior before promotion.

8. Model extraction, distillation and sensitive information disclosure

Model extraction attempts to infer a model’s architecture, parameters or behavior through queries. Distillation uses the outputs of a more capable model to train another model. Sensitive information disclosure exposes private data through prompts, responses, retrieved passages, logs, embeddings, tool arguments or side channels.

For financial institutions, the exposed material may include customer data, transaction information, credentials, proprietary fraud signals or internal decision logic. A system can appear to return a safe final answer while still recording sensitive content in application logs or observability platforms.

Minimize the data sent to external models, enforce authorization before retrieval, protect vector stores, restrict logs and set query budgets for sensitive endpoints. Treat prompts, completions, traces and tool arguments as governed data. Do not place credentials or security-critical policy in a model’s hidden context.

9. Resource exhaustion and denial of wallet

Resource-exhaustion attacks manipulate AI systems into consuming excessive compute, tokens, tool calls or cloud spend. Attackers can submit repeated requests, create large contexts, trigger long reasoning loops or induce recursive agent behavior.

The impact can include service degradation, higher infrastructure costs, model cloning and disruption of customer-facing services. Traditional request-rate limits may miss attacks that use a small number of unusually expensive requests.

Use limits based on tokens, estimated cost, tool calls, recursion depth and total execution time. Set hard spending caps, isolate workloads, monitor cost per identity and add circuit breakers for abnormal agent behavior. Design graceful degradation so critical authentication and payment functions remain available during an AI service incident.

10. Adversarial evasion against AI detection models

Adversarial evasion changes an input so that an AI model misclassifies it while the input remains useful to the attacker. In fraud systems, the target may be a transaction classifier, behavioral model, identity check or bot-detection system.

Attackers may alter timing, device signals, language, transaction patterns or media characteristics. They can also probe a system repeatedly to learn which behaviors trigger additional verification and then adapt their activity.

Detection models should operate as part of a layered decision system rather than as a single gate. Combine independent signals, limit feedback that reveals control logic, monitor for probing and test against adaptive attackers. Authentication should evaluate the integrity and intent of a high-risk action, not only whether a credential appears valid.

How AI-driven threats affect banking and payments

AI changes the economics of fraud. It reduces the cost of producing credible content, increases the number of targets an attacker can contact and makes campaigns easier to personalize. It also shortens the time between reconnaissance, social engineering and attempted payment.

For examples of these customer-facing fraud methods, read AI fraud threats: How financial criminals are exploiting emerging technology, which explores synthetic identities, voice cloning and coordinated automated attacks.

For a financial institution, the right question is not only whether a customer passed authentication. The institution must also assess whether the device, session, behavior and requested action fit the customer’s established context.

Context Aware™ Authentication connects authentication decisions to risk, channel, transaction and customer context. This approach helps institutions apply stronger controls when risk changes instead of imposing the same challenge on every customer.

How financial institutions should respond

For earlier commentary on combining risk signals against AI-assisted scams, see The best way to fight AI fraud is with AI defense.

Entersekt’s digital account authentication approach combines device intelligence, behavioral signals and authentication methods across banking channels. The goal is to apply the right control at the right moment while preserving a usable customer journey.

AI-driven threats: frequently asked questions

➡️ What are AI-driven threats?

AI-driven threats are attacks that use artificial intelligence to improve speed, scale, realism or adaptability, along with attacks that target AI models, data, applications and connected tools. They include deepfake impersonation, AI-enhanced phishing, prompt injection, poisoning, model theft and adversarial evasion.

➡️ Which AI threat is most relevant to banks?

No single vector accounts for all banking risk. In the 2026 landscape described here, AI-enhanced social engineering, deepfake impersonation, automated account takeover and attacks on AI-enabled fraud systems warrant attention because they can affect customer trust, authentication and payment authorization at the same time. Priorities should be reassessed as threats and institutional exposure change.

➡️ Can AI-driven phishing bypass multi-factor authentication?

AI-driven social engineering can manipulate customers or employees into disclosing credentials or approving actions. Phishing-resistant authentication, device intelligence, behavioral analytics and transaction-aware controls reduce this risk by assessing the request and its context rather than accepting an approval as proof of intent.

➡️ What is the difference between prompt injection and data poisoning?

Prompt injection changes model behavior at runtime through malicious input or retrieved content. Data poisoning alters data, embeddings or model artifacts so harmful behavior persists across later use. Prompt injection targets the instruction boundary; poisoning targets the learning or retrieval process.

➡️ How can banks secure AI agents?

Banks should give agents only the tools and permissions required for their task, enforce authorization outside the model, validate every tool call and require approval for high-impact actions. Monitoring, rate limits, circuit breakers and preserved user authorization context further reduce the impact of a compromised agent.

Sources and related articles

The sources below inform this 2026 overview. Their publication dates and editions vary; consult the latest official versions and security advisories before using this article to make implementation or policy decisions.

• OWASP Top 10 for LLM Applications 2026 covers prompt injection, sensitive information disclosure, excessive agency, supply-chain risks, poisoning, resource exhaustion, misinformation and embedding weaknesses.
• NIST AI 100-2 E2025 defines a taxonomy for adversarial machine learning attacks and mitigations, including evasion, poisoning, privacy and misuse attacks.
• ENISA’s view on cybersecurity in the Frontier AI Era examines emerging AI security conditions and risks.
• Europol’s IOCTA 2026 discusses how AI and automation expand online fraud and cybercrime operations.
• The FBI and ABA Foundation deepfake infographic explains how synthetic audio, video and images support impersonation scams.

AI can increase the speed and realism of attacks, but its capabilities and criminal uses will continue to evolve. Financial institutions should respond by increasing the quality of context around every high-risk decision. The institutions that connect identity, device, behavior and transaction signals will be better positioned to challenge threats without making every legitimate customer prove themselves again.