ISLAMABAD (The Thursday Times) — Pakistan’s National Cyber Emergency Response Team (National CERT) has warned banks that attackers using artificial intelligence could tamper with the balances customers see in their banking apps, causing panic even when the money in their accounts has not moved.
In an advisory titled “Emerging AI-Enabled Cyber Threats Targeting Financial Institutions and OT/Critical Infrastructure”, the agency said it had recently seen growing use of AI, automated bots, botnets and agentic tools to scout targets, find weak points, steal login details and launch coordinated attacks. Such tools can help criminal groups operate at greater scale and speed, it said.
Banks could face attacks on core banking systems, digital banking platforms, payment systems, customer apps and the APIs that connect them. Warning signs include surges in automated login attempts and repeated failed sign-ins, unusual API requests, abnormal transaction patterns, unauthorised access to payment systems, and gaps between core banking records and the balances shown to customers.
What banks are told to do: use multi-factor authentication and defences against automated logins, tighten control of privileged accounts, run integrity checks between customer apps and core banking records, reconcile transactions independently, and watch for bot-driven activity and abnormal API traffic.
The advisory also flags risks to oil and gas facilities, power generation and distribution, water utilities, manufacturing and transport, where connected devices, industrial control systems and insecure remote access by outside contractors could let attackers disrupt physical operations. Operators are told to find their internet-facing equipment, limit direct internet exposure and third-party remote connections, separate office networks from operational systems, keep applying security updates and maintain backup procedures for essential processes.
It points to the recent attacks on refrigeration and freezer systems at European supermarkets as an example of the physical and commercial damage such attacks can do, though it says AI involvement in those incidents has not been confirmed.
For customers: the advisory is aimed at organisations, not account holders. If your banking app ever shows a balance that looks wrong, check through your bank’s official helpline or a branch before acting, and never share a one-time password with anyone who calls you. Pakistan has recorded more than 1,000 cyberattacks this year, officials have told parliament.
