AI incidents at banks: AI used against the institution

How many AI incidents at banks since 2022 were cases where criminals or other outsiders used AI (deepfakes, voice clones, AI phishing, synthetic identities) against the institution or its customers?

As of Oct 21, 2026, the register holds 29 publicly reported AI incidents at banks and fintechs where criminals or other outsiders used AI (deepfakes, voice clones, AI phishing, synthetic identities) against the institution or its customers since January 2022. 14 of the 29 records involve systems the institution or a regulator described as AI; 0 are automated systems not described as AI, and 15 are machine-learning systems not labelled AI on the record. Countries: United States (6), United Kingdom (5), India (2). Average severity 1.6 on a 1–5 scale. Status: 10 reported, 14 confirmed by the institution, 1 court filing, 3 resolved, 1 disputed. The most recent is "AI-agent-assisted intrusions breach Shinhan, KB Kookmin, Hana and 13 other Korean financial firms" (Sep 29, 2026).