Financial sector threats: what identity abuse means for defenders

TL;DR: Financial-sector attackers are combining third-party compromise, vishing, credential theft, AI voice impersonation, and document forgery to reach cloud services, defeat KYC, and extort victims, according to Intel 471’s Follow the Money report. The pattern shows identity controls, not perimeter strength, remain the decisive failure point when fraud and intrusion merge.

Editorial analysis by NHI Mgmt Group, based on content published by Intel 471: “Follow the Money: The Financial Sector's Threat Landscape in 2026”.

By the numbers:

• Intel 471 recorded 340 victims in 74 countries in financial services during the reporting period.
• Intel 471 tracked 562 DDoS attacks claimed against the financial sector in the reporting window.
• Initial access brokers advertised unauthorized access impacting 159 financial services entities over the period.

Key questions

Q: What breaks when third-party access is not governed in embedded finance?

A: The relationship between business intent and actual access state breaks down.

Q: Why do stolen MFA codes and session tokens still lead to account takeover?

A: Because authentication success is not the same as session trust.

Q: What are the signs that an AI vishing call is trying to bypass controls?

A: The main signs are urgency, secrecy, pressure to skip normal verification, and a request to keep the conversation isolated from colleagues.

Practitioner guidance

• Tighten supplier identity lifecycles Map every third-party account, remote support path, and vendor token to an owner, expiry date, and offboarding trigger.
• Harden session and token handling Treat MFA as necessary but not sufficient.
• Rework recovery and verification workflows Assume forged documents, deepfakes, and mule-assisted verification will pass weak checks.

Bottom line: Financial-sector attackers are increasingly winning by abusing identity, verification, and supplier trust rather than by breaking through the perimeter alone.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →