Exclusive research: Cybersecurity issues may worsen in 2026 | PaymentsSource

American Banker’s 2026 Predictions Report

Results from the report are highlighted below using interactive charts. Mouse over each section for more detail, click on the chart labels to show or hide sections and use the arrows to cycle between chart views.

Processing Content

This item is part of a series diving into new data from American Banker, so check back for the latest updates.

The growing cybersecurity and fraud problem for banks

Bankers are on heightened alert for fraud and cyberattacks in 2026.

It’s a high possibility, according to respondents, that fraud schemes in the payments industry are going to get more sophisticated over the coming months, with 68% responding that this is definitely going to happen and 28% saying it will probably happen.

Data released by the Federal Bureau of Investigation in November showed that the bureau’s Internet Crime Complaint Center received more than 5,100 complaints tied to account takeover fraud amounting to over $262 million in losses.

“Once the impersonators have access and control of the accounts, the cyber criminals quickly wire funds to other criminal-controlled accounts,” the FBI alert stated.

This trend has become so problematic that JPMorganChase was driven to launch what it’s dubbed the largest fraud and scam prevention initiative in the firm’s history.

Features of the initiative include alerting customers when it detects instances of suspicious activity and allowing consumers to name a trusted contact to additionally notify when transactions are flagged. The bank also has a special team of representatives trained to help older and vulnerable customers who are more prone to financial abuse.

“Protecting our customers from fraud and scams requires a united front — banks, technology companies, social media platforms and law enforcement all have a role to play,” Jennifer Roberts, CEO of Chase Consumer Banking, said in a press release.

In addition to fraud, cybersecurity attacks are predicted to become more frequent and harder hitting. Fifty-two percent of bankers said this dynamic was virtually a certainty for 2026, with a further 43% responding that this shift will probably happen.

This month, marketing and compliance vendor Marquis Software Solutions disclosed that it was the victim of a ransomware attack compromising sensitive consumer information such as names, Social Security numbers, dates of birth and more. The breach affected roughly 824,000 customers at a minimum of 80 banks and credit unions.

Another noteworthy cybersecurity incident from last year involved alleged associates of Tren de Aragua, a Venezuelan transnational criminal organization, who deployed malware to collectively withdraw millions of dollars from ATMs without debiting any accounts. This technique is known as jackpotting.

Key takeaway: Fraud schemes are predicted to become more sophisticated in the coming months, while cybersecurity attacks will similarly grow in frequency and severity.

How much risk will these trends create?

The vast majority of respondents, about 90%, said increasingly sophisticated schemes will create severe risks in the U.S. banking industry as a whole. Nine percent responded that only a little risk will be created and 1% said no risk at all would be created.

Similarly, more than 90% of respondents expected increasingly severe cybersecurity attacks will pose risk to the banking industry in the coming year. Seven percent said little risk would be created and 1% said no risk at all.

A survey of business leaders released last year by TransUnion found that fraud led respondents to lose, on average, the equivalent of 9.8% of revenue over the prior year. This figure was an increase from 6.7% in the  2024 report.

New changes in the fraud landscape are set to take effect in March, as the National Automated Clearing House Association introduces its two-phased fraud monitoring rule updates for banks, credit unions and other financial entities that utilize the ACH networks.

The changes to existing regulations are aimed at combatting the rise of sophisticated authorized push payment, or APP, fraud and business email compromise, or BEC, scams, which often trick legitimate account holders into authorizing fraudulent payments.

Key takeaway: Worsening cybersecurity breaches and fraud scams will create greater risks to the financial sector in 2026.