Banks are operating in a new and particularly complex environment of digital threats. As the Bank of Greece notes in its latest Financial Stability Review, sophisticated artificial intelligence models have emerged alongside familiar digital threats and could pose a risk to the financial sector.
While digital transformation boosts operational efficiency, it also exponentially increases financial institutions’ exposure to operational risks and cyberattacks.
The complexity of interconnected systems means that a single incident can trigger a chain reaction, harming not only banks’ reputations but also broader economic stability.
The risk posed by Frontier AI models
The rapid development of advanced artificial intelligence models (Frontier AI models) has changed the cybersecurity landscape. According to the European Systemic Risk Board (ESRB), these systems are now an official source of systemic risk because of their unprecedented capabilities.
For example, they can carry out complex operations without human intervention, increasing the speed and scale of cyberattacks. They can also scan for and exploit weaknesses in banks’ digital infrastructure. In addition, they make it easier to design and carry out highly specialised attacks that are difficult for traditional security systems to detect.
The Bank of Greece’s warnings come in the wake of highly alarming recent incidents in which sophisticated AI models were used to attack banks.
In South Korea, seven financial institutions fell victim to a coordinated cyberattack in which hackers used AI tools, including ARTEX and the Claude model, to automatically identify weaknesses in the authentication of peripheral systems, exposing the data of more than 67,000 customers.
In Latin America, cybercrime groups deployed sophisticated AI models, specifically Grok and Claude, to automate and scale up attacks on banks.
The threat of quantum computing
Alongside artificial intelligence, quantum computing is emerging as a major future threat to the integrity of transactions. Quantum computers are expected to be powerful enough to “break” today’s cryptographic algorithms, which protect the confidentiality of banking data and digital signatures.
To address this risk, the European Commission and supervisory authorities have drawn up a roadmap for the transition to post-quantum cryptography (Post Quantum Cryptography - PQC). Banks are being called on to secure high-risk applications by 2030, with the aim of completing the transition by 2035.
Internal failures
However, not all threats come from external sources. The Bank of Greece notes that the growing complexity of internal IT projects, such as upgrades and system mergers, carries significant risks.
Significantly, according to data from the Single Supervisory Mechanism (SSM), 38% of major ICT incidents in Europe in 2025 were due to internal changes (ICT changes) – a trend also seen in Greece. “Similar proportions of these types of operational ICT incidents were observed in 2026 at Greek financial institutions, according to their reports of major incidents to the Bank of Greece,” the report says.
Financial institutions also remain in the sights of organised cybercrime groups, while geopolitical tensions heighten the risk of targeted attacks on critical infrastructure.
Defences and the supervisory framework
Although Greek banks successfully dealt with the attacks in 2026 thanks to significant investment, supervisory authorities are calling for constant vigilance. 2026 is the second year of implementation of the DORA Regulation and, together with the Cyber Resilience Act (CRA), it creates a strict compliance framework. The main lines of defence include:
- Stricter oversight of third-party technology providers, on which institutions are increasingly dependent.
- Closer cooperation and voluntary sharing of information on new threats.
- Coordination at European level (EU-SCICF), to ensure an immediate cross-border response in the event of a systemic cyberattack.
The Bank of Greece makes clear that the continuous enhancement of digital resilience, the adoption of cryptographic agility and stronger internal controls are essential in the face of an evolving risk landscape.