AI incidents · computed from AI incidents register; nothing on this page is written by a model. All ranked answers: /banks/leaders
On the public record as of Oct 24, 2026, 19 of the 141 large banks profiled appear in a register record where criminals used AI against the bank or its customers. Ranked by register records, the top 5 are BofA (3 records), Lloyds (3 records), Commonwealth Bank (2 records), JPMorgan (2 records) and Wells Fargo (2 records). BofA's strongest evidence: Unvetted AI agents found in US bank customer accounts; Morgan Stanley, JPMorgan, Citi and BofA restrict them (reported, Oct 1, 2026).
141 banks profiled (120 US, 21 non-US) · 19 with matching evidence · ranked answer, not a comparison
Which of the large banks have had AI used against them or their customers?
| # | Bank | Register records | Latest record | Status | Date | On this site | Sources |
|---|---|---|---|---|---|---|---|
| 1 | BofA | 3 | Unvetted AI agents found in US bank customer accounts; Morgan Stanley, JPMorgan, Citi and BofA restrict them (reported, Oct 1, 2026) | Reported · severity 2/5 | Oct 22, 2026 | BofA · AI incidents → | Axios ↗ · ABC7 News (KGO-TV) ↗ |
| 2 | Lloyds | 3 | Lloyds refunds estate of 82-year-old customer lured by an AI Farage deepfake investment scam (confirmed by the institution, May 1, 2026) | Confirmed by the institution · severity 2/5 | Sep 25, 2026 | Lloyds · AI incidents → | News & Star ↗ · BBC News ↗ |
| 3 | Commonwealth Bank | 2 | Commonwealth Bank refers about A$1bn of suspect home loans, some reportedly AI-forged, to police (reported, Feb 26, 2026) | Reported · severity 3/5 | Feb 26, 2026 | Commonwealth Bank · AI incidents → | Australian Financial Review ↗ · Commonwealth Bank of Australia ↗ |
| 4 | JPMorgan | 2 | Unvetted AI agents found in US bank customer accounts; Morgan Stanley, JPMorgan, Citi and BofA restrict them (reported, Oct 1, 2026) | Reported · severity 2/5 | Oct 22, 2026 | JPMorgan · AI incidents → | Axios ↗ · The Wall Street Journal (via Mint) ↗ |
| 5 | Wells Fargo | 2 | Unvetted AI agents found in US bank customer accounts; Morgan Stanley, JPMorgan, Citi and BofA restrict them (reported, Oct 1, 2026) | Reported · severity 2/5 | Oct 22, 2026 | Wells Fargo · AI incidents → | Axios ↗ · VICE (Motherboard) ↗ |
| 6 | Banco Santander | 2 | Deepfake ads clone Santander chair Ana Botín's voice to push fake investment platforms (reported, Jul 1, 2025) | Reported · severity 1/5 | Jul 31, 2025 | Banco Santander · AI incidents → | Maldita.es ↗ · BBC News ↗ |
| 7 | TD Bank Group | 1 | TD customer, 88, loses C$450,000 to a scam that began with a Mark Carney deepfake; bank won't reimburse him (reported, May 1, 2025) | Reported · severity 3/5 | Oct 19, 2026 | TD Bank Group · AI incidents → | CBC News (Go Public) ↗ |
| 8 | Citi | 1 | Unvetted AI agents found in US bank customer accounts; Morgan Stanley, JPMorgan, Citi and BofA restrict them (reported, Oct 1, 2026) | Reported · severity 2/5 | Oct 22, 2026 | Citi · AI incidents → | Axios ↗ |
| 9 | Schwab | 1 | Unvetted AI agents found in US bank customer accounts; Morgan Stanley, JPMorgan, Citi and BofA restrict them (reported, Oct 1, 2026) | Reported · severity 2/5 | Oct 22, 2026 | Schwab · AI incidents → | Axios ↗ |
| 10 | Morgan Stanley | 1 | Unvetted AI agents found in US bank customer accounts; Morgan Stanley, JPMorgan, Citi and BofA restrict them (reported, Oct 1, 2026) | Reported · severity 2/5 | Oct 22, 2026 | Morgan Stanley · AI incidents → | Axios ↗ |
| 11 | HSBC | 1 | Deepfake Zoom call leads a Singapore finance director to wire US$499,000 from an HSBC account; funds recovered (resolved, Mar 26, 2025) | Resolved · severity 2/5 | Apr 7, 2025 | HSBC · AI incidents → | The Straits Times ↗ |
| 12 | Hilltop | 1 | PlainsCapital Bank customer sues after an alleged AI voice clone redirected a $20,000 transfer (court filing, Nov 5, 2024) | Court filing · severity 2/5 | Dec 11, 2024 | Hilltop · AI incidents → | FOX 26 Houston ↗ |
| 13 | NatWest | 1 | Deepfake image of NatWest CEO Paul Thwaite spread on X as scam bait (confirmed by the institution, Jul 3, 2026) | Confirmed by the institution · severity 1/5 | Jul 3, 2026 | NatWest · AI incidents → | City AM ↗ |
| 14 | Barclays | 1 | AI-generated 'Monzo Slots' and 'Barclays Slots' casino ads impersonate UK banks on social media (confirmed by the institution, Jun 3, 2026) | Confirmed by the institution · severity 1/5 | Jun 3, 2026 | Barclays · AI incidents → | Cybernews ↗ |
| 15 | Standard Chartered | 1 | Standard Chartered warns Thai investors of fake ads using AI to impersonate its executives (confirmed by the institution, Feb 24, 2026) | Confirmed by the institution · severity 1/5 | Feb 24, 2026 | Standard Chartered · AI incidents → | Standard Chartered Thailand ↗ |
| 16 | BMO Financial Group | 1 | Instagram ads use AI deepfakes of BMO strategist Brian Belski to lure investors (reported, Jun 17, 2025) | Reported · severity 1/5 | Jun 17, 2025 | BMO Financial Group · AI incidents → | BleepingComputer ↗ |
| 17 | DBS | 1 | DBS warns deepfake videos of its leaders and staff are pushing investment scams (confirmed by the institution, May 20, 2025) | Confirmed by the institution · severity 1/5 | May 20, 2025 | DBS · AI incidents → | DBS Bank ↗ |
| 18 | Goldman | 1 | Deepfakes of Goldman strategists David Kostin and Abby Joseph Cohen used in Instagram stock-tip scams (confirmed by the institution, Apr 1, 2025) | Confirmed by the institution · severity 1/5 | Apr 24, 2025 | Goldman · AI incidents → | Fortune ↗ |
| 19 | ING | 1 | ING manager gets a fake voicemail from 'CEO Steven van Rijswijk' about a confidential project (confirmed by the institution, Jan 1, 2024) | Confirmed by the institution · severity 1/5 | Jun 18, 2025 | ING · AI incidents → | ING ↗ |
Each row quotes one record from AI incidents register; the “On this site” link opens the bank's own page or sub-page with every source. Banks absent from the table have nothing matching on the record this site holds.
How is this ranked?
Data: the AI incidents at banks register (/ai-incidents): dated, sourced records of AI failures, AI used against banks and governance findings, each with a status and severity.
Rule: Records whose AI role is "AI weaponised". Score = records; ties by severity.
Counts: 19 of 141 profiled banks qualify; 19 distinct sources cited in the table. Data checked 2026-10-24; ranking template updated 2026-10-30.
What are the caveats?
A record is a publicly reported event with the status the sources support (reported, bank-confirmed, regulator finding, court filing, settled, resolved or disputed); it is not a finding of fault. Banks absent from the table have no record in the register, which is not evidence that nothing happened.
Banks absent from the table have nothing matching on the record this site holds, which is not evidence that they do nothing. Each row links the bank's own page, where every entry carries its sources.
Which bank ranks first?
Bank of America leads with 3 records: Unvetted AI agents found in US bank customer accounts; Morgan Stanley, JPMorgan, Citi and BofA restrict them (reported, Oct 1, 2026). Lloyds is second with 3.
How many large banks had AI used against them or their customers?
19 of the 141 profiled banks (120 US, 21 non-US groups). Among those listed, 8 are US banks and 11 non-US groups.
What counts, and what does not?
Records whose AI role is "AI weaponised". Score = records; ties by severity. Source: the AI incidents at banks register (/ai-incidents): dated, sourced records of AI failures, AI used against banks and governance findings, each with a status and severity.
Is this a measure of capability?
No. Every row is a sourced fact on the public record: what the bank, a regulator, a filing or an independent outlet has put on the record. The page does not rate how well anything works.
When was this checked, and how often does it update?
The data behind the table was last checked on 2026-10-24 (AI incidents register). The page recomputes whenever that dataset changes and is republished with the site; it is never edited by hand.
When any of these banks moves on AI, you'll read it the next morning.
when one of the banks we cover moves on AI, it is in the next morning's brief · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning