Most conversations about AI in banking begin with the same question: how do we protect ourselves against AI-enabled fraud?
It is an understandable concern. Generative AI can already produce convincing voices, documents, identities, and digital interactions at a scale unimaginable only a few years ago. Deloitte estimates AI-enabled fraud losses in the US banking sector could more than triple to $40bn by 2027.
We’re asking the wrong question.
The challenge facing financial institutions is not how to defend against another cyber threat but rather how to redesign cybersecurity for a world where authenticity itself can no longer be taken for granted.
For more than two decades, cybersecurity has evolved by adding new layers of protection to existing systems. Firewalls protected networks, encryption secured data and multi-factor authentication strengthened access control. Each new threat was met with another security control.
AI changes that mode, and unlike previous technologies, AI does not simply attack systems, it undermines the assumptions on which those systems were built.
We have traditionally assumed that people are who they claim to be; documents are genuine, voices belong to real individuals and images provide reliable evidence, but increasingly, none of those assumptions can be accepted without verification.
That is why deepfake detection, while important, is not the only answer.
Too many organisations are treating AI security as another product category that can be integrated into an existing technology stack. It cannot. Deepfake detection is one control within a much broader cyber architecture that must establish authenticity continuously across every digital interaction.
Identity verification, biometrics, liveness detection, behavioural analytics, device intelligence, fraud prevention and AI-generated media detection are no longer independent technologies. They are becoming interdependent components of a single resilience framework.
This architecture matters because AI is becoming infrastructure and it is rapidly embedding itself into customer onboarding, payments, fraud detection, lending, compliance and customer service. Soon, almost every interaction between a financial institution and its customers will be mediated, assisted or influenced by AI in some form.
As intelligence becomes embedded across the enterprise, the infrastructure that governs, authenticates and secures that intelligence becomes just as important as the intelligence itself.
This represents a fundamental shift in how company executives should think about cyber risk.
Historically, cybersecurity has been measured by an organisation’s ability to protect systems from compromise. In the AI era, organisations must also demonstrate that the interactions occurring within those systems are authentic.
That is a different engineering challenge entirely, and it also explains why regulators around the world are expanding their focus beyond responsible AI towards operational resilience, identity assurance and digital trust. They recognise that AI does not simply introduce new risks but that it changes the nature of trust within digital systems.
South Africa’s financial sector will not be immune to that shift.
The country’s banks have earned a global reputation for resilience, innovation and robust risk management. Maintaining that position will depend on recognising that AI security is no longer a technology procurement exercise. It is an architectural decision that touches every part of the enterprise.
History offers a useful lesson here. The organisations that navigated previous waves of cybercrime most successfully were not necessarily those with the largest security budgets, but the ones that recognised cybersecurity as a strategic capability rather than a compliance requirement.
AI presents a similar inflection point. The institutions that continue to add point solutions to yesterday’s architecture may find themselves constantly reacting to increasingly sophisticated attacks.
Those institutions that redesign their cyber architecture around authenticity, identity assurance and continuous verification will be better positioned to protect customers, maintain resilience and preserve confidence in an increasingly AI-mediated world.
The question, therefore, is no longer whether banks should adopt AI, because that debate is over. The real question is whether their cyber architecture was designed for a world where almost every digital interaction can be generated, manipulated or impersonated by AI.
The financial institutions that answer that question first are unlikely to gain stronger security only, they will earn something far more valuable: the ability to prove what and who can be trusted.
• Renirie is CEO and co-founder at Certified AI Access and former MD at Morgan Stanley.
