Identity protection is the next fintech battleground

For years, financial institutions have invested heavily in cybersecurity. Banks have strengthened their networks, improved fraud detection systems, enhanced authentication controls and built sophisticated monitoring capabilities designed to identify suspicious activity.

Yet the next major battleground in financial cybersecurity is not inside the bank. It is the customer.

Cybercriminals are increasingly recognising that the easiest way to access financial information is not necessarily through a technical attack on an institution's systems, but by convincing customers themselves to provide the keys.

Through phishing, impersonation scams, social engineering, credential theft and identity fraud, criminals are targeting individuals at an alarming scale. The result is a fundamental shift in the way financial institutions need to think about customer protection.

Cybersecurity is no longer just about protecting infrastructure. It is becoming about protecting identity.

The scale of Australia's scam problem

The numbers demonstrate why this issue has moved beyond being an IT concern and into the realm of financial services strategy.

According to the National Anti-Scam Centre's Targeting Scams Report 2025, Australians made 481,523 scam reports during 2025, with 274,577 reports involving financial losses totalling $2.18 billion.

Investment scams represented the largest category of reported losses at $837.7 million, while phishing, impersonation and payment redirection scams continued to expose Australians to significant financial and personal risks.

However, the true impact of cyber-enabled fraud extends well beyond the initial financial loss.

When criminals obtain personal information, the consequences can continue long after money has been stolen. Victims may face compromised accounts, fraudulent applications for credit, damaged reputations and lengthy processes to restore their identity.

This is why identity protection is becoming an increasingly important component of financial wellbeing.

The customer has become the new attack surface

Traditional cybersecurity has focused on defending systems from unauthorised access. But modern scams often involve actions unwittingly authorised by the victim.

A customer may approve a payment after receiving a convincing phone call from someone pretending to represent their bank. They may enter login details into a fake website that looks identical to a trusted service. They may provide personal information after receiving a highly personalised message generated with the assistance of artificial intelligence.

From a fraud perspective, the criminal has not necessarily defeated the bank's security controls. They have convinced the customer to bypass them.

This creates a difficult challenge for financial institutions.

Fraud detection systems remain essential, but they are increasingly only one part of the solution. The next evolution of customer protection requires helping people understand their own cyber risk and giving them tools to reduce their exposure before an incident occurs.

AI is changing the economics of cybercrime

Generative artificial intelligence is accelerating this challenge.

Scammers can now create more convincing emails, websites, social media profiles and voice impersonations at a speed and scale previously unavailable to them.

The warning signs that consumers once relied on – poor spelling, obvious mistakes or unrealistic messages – are disappearing.

At the same time, Australians are embracing digital banking, real-time payments, and digital identity services. These innovations provide enormous benefits, but they also increase the importance of protecting personal credentials and identity information.

Digital trust will become one of the defining issues for financial services over the next decade.

Cybersecurity is becoming a customer experience issue

Historically, cybersecurity has generally been viewed through the lens of compliance, risk management and operational resilience. Those areas remain critical. However, the role of cybersecurity is expanding.

Banks, credit unions, insurers and fintechs are increasingly looking at cyber protection as a way to improve customer experience, strengthen relationships and provide additional value.

Just as financial institutions help customers manage their financial wellbeing through budgeting tools, savings products and credit monitoring, there is a growing opportunity to help customers manage their digital wellbeing.

This includes services such as:

• Identity monitoring
• Scam prevention
• Cyber awareness education
• Personal cyber risk assessments
• Support following identity compromise

The organisations that help customers feel safer in a digital environment will build stronger trust.

A shift reflected at COBA and WCUC

This evolution was evident during last week's Customer Owned Banking Association (COBA) Convention and World Council of Credit Unions (WCUC) Conference.

Conversations with customer-owned banking executives highlighted growing interest in solutions that extend beyond traditional fraud prevention and help members proactively reduce their cyber risk.

The opportunity for financial institutions is not simply to respond faster after fraud occurs, but to help prevent customers becoming victims in the first place.

Increasingly, organisations are exploring ways to deliver these capabilities through embedded services, white-labelled customer benefits or referral partnerships.

Moving from cyber response to cyber prevention

The future of financial cybersecurity will require a broader definition of protection.

Antivirus software, fraud monitoring and secure banking platforms remain important, but they do not address every risk consumers face. The human element – the decisions people make, the information they expose and the trust they place in digital interactions – has become central to the cybersecurity challenge.

This is why understanding personal cyber risk is becoming as important as understanding financial risk. Most Australians know their credit score, or they at least know how they can access it. Increasingly, they will also need to understand their cyber risk score.

MY CYBER GUARD recently launched Cyber Risk Assessment tools designed to help individuals and small businesses better understand their online exposure and identify practical steps to improve their cyber resilience.

The assessments form part of Digimune's broader identity protection ecosystem, which enables financial institutions, insurers, telecommunications providers and membership organisations to provide cyber protection services through embedded, white-label and referral models.

The next generation of fintech innovation will not only be about making financial services faster and more convenient. It must also be about helping customers participate in the digital economy with greater confidence.