The AI threat is already within banks

South-east Asia’s lenders have handed credit, fraud and compliance decisions to autonomous technology

    • Controls that regulators still treat as the gold standard, such as SMS one-time passwords, are now near obsolete.
    • Controls that regulators still treat as the gold standard, such as SMS one-time passwords, are now near obsolete. IMAGE: BT FILE
    Published Thu, Jun 25, 2026 · 07:00 AM

    THE credit card’s activity looked normal: a S$4 coffee, a purchase on an e-commerce platform, a small digital subscription. None triggered the bank’s fraud detection – because they were not meant to. 

    And overnight, the same card made one transfer of nearly S$50,000. The cardholder slept through it.

    The instructive part in this hypothetical scenario is what those first three transactions actually were. They were not made by the legitimate cardholder; instead, they were low-value tests quietly executed by attackers as training data.