The limits of a money safety checklist in the age of convincing fakes
According to a Euro Security commentary published in October 2026, an employee in the Hong Kong office of Arup, an engineering consultancy, was deceived into transferring about HK$200 million, around US$25 million, after a video conference in which criminals impersonated the company’s UK-based chief financial officer and colleagues. Hong Kong authorities later concluded that the meeting had been pre-recorded rather than interactive, the commentary says, and Arup confirmed it was a victim of fraud.
The account does not describe a broken password. It describes a broken assumption: that a familiar face, a known voice and a meeting of colleagues proved who was asking for money. That is the uncomfortable shift behind much current worry about artificial intelligence and personal finance. The strongest documented cases are not stories of AI cracking banking cryptography. They are stories of synthetic media, stolen information and social pressure persuading an authorised person to approve a payment.
That distinction matters for a consumer money safety guide. A feature syndicated by Apple News and attributed to The Independent sets out a familiar checklist: unique passwords, password managers, multi-factor authentication, prompt updates, private networks, suspicious financial communications, multiple ways to access money and account monitoring. The advice is mostly sensible. The question is what it can achieve, and where responsibility moves beyond the individual.
A real trend, with limits
The Independent feature frames the issue through rising cyberattacks and AI finding vulnerabilities at unprecedented volume. It also cites an overnight US$6 billion hack on Binance without a date, amount basis, cause or source. That claim is not corroborated here and should not be repeated as established fact. Nor does the evidence establish a measured surge in AI-enabled cyberattacks overall. It supports a narrower picture: reported AI-enabled fraud is growing in some datasets, and the main mechanism is deception rather than broken encryption.
A Lexology commentary, citing the Report Fraud annual assessment for 2025/26, reports that UK victim reports identifying AI as a factor rose by 395 per cent, from 193 to 956, while associated reported losses rose from £1.2 million to £9.6 million. It cautions that better awareness may contribute and that the figures do not mean AI caused a comparable increase in fraud overall. Euro Security commentary, citing a joint European Banking Authority and European Central Bank report, says payment fraud across the European Economic Area was €4.2 billion in 2024, against €3.5 billion in 2023. Strong customer authentication remained effective, particularly against traditional card fraud, but customers manipulated into authorising payments were a growing risk. The datasets differ in place, method and year and should not be combined.
What the advice can and cannot prove
The practical core of the Independent checklist is sound harm reduction. Unique passwords and passcodes, especially for banking apps, limit the damage when one account is exposed. A password manager makes that realistic. Never entering banking credentials on another website or app, including an AI assistant asked to manage transactions, preserves a boundary phishing depends on breaking. Prompt updates offered inside the software itself close known vulnerabilities while avoiding fake prompts. Multi-factor authentication adds a step beyond a password. Treating every financial message as unverified until checked separately is sensible.
The captured checklist supplies no evidence that its combined advice prevents fraud. No study in the material tests these habits as a package. They are widely recommended precautions, not a guarantee. The related Independent explainer adds useful distinctions. It reports Nic Adams of 0rcus advising people to check a company’s instructions by opening its app or typing its web address themselves rather than following a link in an urgent message. It reports Paul Benda of the American Bankers Association recommending passkeys where available and warning against reusing passwords across shopping sites. Passkeys are website-specific keys, making a copied login page less useful. Benda’s industry view is not an independent audit of bank security.
The part a customer cannot fix
A separate Independent explainer shows where personal control runs out. It reported a vulnerability in PHP, a programming language used to run many websites, and noted that only people running affected sites could fix it directly. The account did not name the CVE or affected versions, but the structural point survives: a customer cannot patch a bank’s website, a hospital’s booking system or a retailer’s checkout. Emily Austin of Censys, reported by The Independent, cautioned that there was little an end user could do beyond hoping relied-on services did not use the affected software or were patched. Dan Guido of Trail of Bits made the broader point that someone can do everything right, including using two-factor authentication, and still have information exposed because they cannot patch a hospital’s website.
The Bank of England, Financial Conduct Authority and HM Treasury made a related institutional point in a joint statement on frontier AI cyber risks in finance, as summarised by Digital Watch Observatory. The summary says current frontier models can perform certain cyber tasks at high speed and scale, potentially increasing operational and security risks if misused. It says regulated firms should strengthen governance, vulnerability management, third-party risk oversight and recovery. The controls that decide whether a bank or website withstands an attack are not in a customer’s password manager.
When authentication succeeds and trust fails
Authorised payment fraud exposes the limit of authentication more than a stolen password does. If the right customer initiates a transfer and the approved method is used, technical controls can work while the outcome is still a disaster. Euro Security commentary argues that banks have become good at protecting transactions and less good at protecting the people authorised to approve them. It also cautions against treating more biometric checks as a complete answer, arguing that a voice is not a secret and a face is not a replaceable password. It recommends phishing-resistant authentication, transaction-specific confirmation and independent approval channels. These are recommendations, not proven fixes, but they point to the right question. Can the system verify not only who pressed the button, but whether the instruction was true?
The UK introduced mandatory reimbursement for eligible victims of authorised push payment fraud in October 2024 under a Payment Systems Regulator framework. According to Euro Security’s account, qualifying consumers, microenterprises and charities can receive reimbursement for covered domestic bank-transfer scams, generally subject to a maximum of £85,000 and specified exceptions. The rules put stronger incentives on payment providers to prevent fraud. They are not a universal safety net. The cap, eligibility rules and domestic scope all matter.
Data exposure can feed the same deception without a cryptographic break. The crypto.news guest post on CoinMarketCap reports that Coinbase said in May 2025 that criminals bribed overseas support personnel to obtain information they used while pretending to represent the company. The disclosed records reportedly included contact details, government identification images, masked financial identifiers and account information. Coinbase said the attackers did not obtain private keys or login credentials, and that the stolen access did not itself allow them to move customer funds. The disclosure did not establish that AI was used, but it shows how a convincing customer service story can be assembled from real fragments of identity.
A checklist with boundaries
Start with what is within reach. Use unique credentials and a password manager. Turn on app-based second factors, and use passkeys where offered. Install updates from the software’s own settings. Check unexpected financial requests through an app or independently sourced number. Review statements and password exposure alerts. They need not be an obsession. Add restraint. A call from a bank, a video call from a boss or a message from a relative are claims about identity, not proof of it. Verification needs a channel the claimant does not control. The 159 switchboard can route callers to most major banks; readers should confirm it serves theirs.
Finally, know what the tools do not do. Multi-factor authentication protects account access, not a payment a customer is manipulated into approving. A VPN can reduce some network risks but does not make a fake bank message genuine. A biometric check may be convenient, but it does not prove the transaction was legitimate. Reimbursement rules can help in covered cases, but they do not make every transfer reversible. A password manager audit can show that a credential appeared in a breach; it cannot tell the customer how a criminal will use the information next.
The unresolved question is accountability. If a customer uses the right password, passes the bank’s authentication and approves a payment because the instruction looked and sounded legitimate, what should happen next? UK rules answer that for some eligible domestic transfers, within a cap and subject to exceptions. They do not answer it everywhere. They do not decide how platforms should police fraudulent advertisements, how AI developers should curb impersonation tools, or how banks should respond when authentication succeeds but the context fails. Consumers can make themselves harder to deceive. They cannot make the whole system trustworthy alone. That is the practical meaning of a money safety checklist after AI: useful, necessary and incomplete.
If the right customer approves the right payment with the right password, what exactly has been verified? A money safety checklist can confirm an account and still leave the truth of the instruction untouched, because authentication and trust are different questions. Cybersecurity fundamentals is the relevant area for learning how identity, access and controls are treated as separate, checkable concepts rather than one reassuring tick. The broader point is useful beyond banking: knowing what a safeguard actually proves helps you see where personal habits end and provider or platform responsibility begins. If you want to build that habit, explore The Hack Academy’s online cybersecurity training programme, which lists cybersecurity fundamentals among its subject areas and sets self-paced learning and practical exercises alongside the theory.