A $900 Million Deepfake Tab, DORA's First Real Enforcement Wave, and a Ransomware Hit That Should Worry Every CISO
As of this week, the WEF's 2026 Cybersecurity Outlook has put a $1.1 trillion price tag on fraud, and the headlines are catching up. From a US Bank ransomware incident to Marquis Software's 670,000-customer breach, financial cybersecurity has entered a new phase.
The uncomfortable truth, as of this week, is that cybersecurity in financial services has stopped being a back-office function and become a boardroom emergency. Three stories this week tell the shape of the new threat landscape: deepfake-fuelled fraud is approaching $900 million in reported losses, the EU's Digital Operational Resilience Act (DORA) is handing out its first serious penalties, and a ransomware incident at a core banking software vendor has exposed data on roughly 670,000 US bank customers.
If you run risk, compliance, or security inside a bank or a fintech, this is your reading list for the weekend.
The WEF Puts a $1.1 Trillion Price Tag on the Problem
The context for everything that follows comes from the World Economic Forum's 2026 Global Cybersecurity Outlook, published this quarter. The headline number: $1.1 trillion in projected global cyber-fraud losses over the coming three-year horizon, with financial services absorbing the largest share.
What Changed From 2025
Two numbers matter. First, AI-generated social-engineering attacks are now the number-one financial-crime vector by volume for the first time in the WEF's series. Second, the median time from initial compromise to fraudulent transaction is now under 90 minutes, faster than most banks' end-of-day reconciliation cycles. Translation: the cheque has cleared before the alert fires.
Deepfakes: Nearly $900 Million in Direct Losses, and That's the Measured Half
Reporting aggregated by Disaster Recovery Journal and amplified by Pulse.bot puts direct financial losses from deepfake-related fraud at just under $900 million, year-to-date. KnowBe4's Threat Lab blog argues that the real number, once you include unreported business-email-compromise cases where the "sender" voice was synthetic, is meaningfully higher.
The UK's Bitter Milestone
IBTimes UK reports that UK fraud losses have hit £1.28 billion, with banks warning that AI makes scams harder to spot by ordinary customers. SW Londoner carried a vivid frontline piece earlier this week documenting an attack in which criminals used a cloned voice and video likeness of a UK CFO to move funds within minutes.
Why "Liveness" Is Not Enough
Reality Defender and Incode, two of the deepfake-defence vendors that spent the week at Money20/20, are both warning that traditional "liveness checks", the blink-or-turn-your-head cues used by many onboarding flows, are now routinely defeated by generative-AI tools. The Oscilar blog argues that detection has to move from the image layer to the behavioural and device-fingerprint layers to have any chance of keeping pace.
DORA: The Enforcement Phase Begins
For the European compliance crowd, this is the quarter DORA stopped being an acronym on a slide and became a line item. According to Nordlayer's enforcement guide and Bastion.tech's primer, national competent authorities across the EU now have the power to impose penalties of up to 2% of a firm's annual worldwide turnover for serious failures in ICT risk management, incident reporting, or third-party oversight.
Why This Hits Differently
Legiscope and SureCloud both flag the structural shift: under DORA, a bank is accountable for the operational resilience of its critical third-party providers, not just its own systems. That means a ransomware incident at a cloud provider or a KYC vendor can trigger a DORA finding against the bank that uses them.
The Finastra Case Study
Our own reporting at FinanceX tracked a 400GB data-breach incident at banking-software provider Finastra earlier this cycle. The question regulators are now asking is not just "how did it happen?" but "which of the 45 banks that outsource to Finastra should have had tighter oversight?" That's the DORA lens applied in anger.
The Pulse Verdict
Pulse.bot's survey found that most European financial firms still are not ready for full DORA enforcement, a sobering benchmark heading into year-end audits.
Ransomware: The Marquis Incident and LockBit 5.0's US Bank Operation
Two ransomware stories broke in parallel this week.
Marquis Software and 670,000 Customers
According to Threatcluster, a ransomware attack on Marquis Software, a provider of document and transaction-management tools to community banks in the US, has affected more than 670,000 bank customers. The attack vector is still under investigation, but the vendor-risk implications are already front and centre, exactly the scenario DORA was designed to address.
LockBit 5.0 Targets US Bank
Separately, Escudo Digital and SOCRadar report that the LockBit 5.0 ransomware group has claimed an attack on U.S. Bank, one of the largest banks in the United States. The bank has not publicly confirmed the scope, but the mere credible claim from a reconstituted LockBit, the group was supposedly dismantled earlier in the cycle, is a reminder that the ransomware ecosystem rebuilds faster than law enforcement can decapitate it.
Deutsche Bank's Earlier Incident
Our own coverage tracked an earlier ransomware incident involving Deutsche Bank. The pattern across all three incidents is consistent: attackers are pivoting from pure data-theft to combined extortion-and-disruption plays that take aim at operational continuity.
The Verification Layer Is the Breach
The theme tying this week's headlines together is identity. A new Regula study, summarised by The Paypers, surveyed banks and fintechs on their 2026 verification plans. Three findings stand out.
Document Checks Alone Are Dead
Eighty-four percent of respondents said they will layer behavioural biometrics on top of document and selfie checks within the next 12 months. The reason, as Regula puts it bluntly, is that generative AI has made a convincing fake ID "trivial" to produce.
eIDAS 2.0 Is the European Backstop
The European Digital Identity Wallet, launching across member states under eIDAS 2.0, is widely expected to become the trust anchor that banks lean on by 2027. BusinessWire's syndication of the Regula findings notes that 61% of European banks surveyed plan to integrate EUDI Wallet verification into their onboarding stack within the next 18 months.
Innovatrics and the Singapore Signal
Innovatrics will be unveiling an updated biometric-fraud-detection stack at the Singapore FinTech Festival from 18–20 November 2026. The vendor side of this market is consolidating fast, and the buy-side pressure from DORA, eIDAS 2.0, and the fraud numbers above is enormous.
What You Should Do This Weekend
Three practical moves.
Aaudit your third-party inventory against DORA's register requirements. If your bank cannot produce a complete list of critical ICT providers and the resilience evidence for each within 24 hours, you have a DORA problem, not a security problem.
Assume your current liveness check is defeatable. Run an internal red-team exercise with a modern generative tool against your onboarding stack this quarter. If you do not, a motivated adversary will.
Table-top the Marquis scenario. The question is not whether a core vendor will be ransomwared, it is whether your incident playbook routes around the right vendor within the DORA-mandated reporting window.
The Big Picture
The WEF's $1.1 trillion number is a projection, not a bill. But the deepfake losses, the DORA enforcement wave, and the Marquis and LockBit incidents are not projections, they happened. The common thread is that the attackers have industrialised, and the defenders are still regulating.
As of this week, the regulators are catching up. Whether the market catches up with them is the open question for 2027.
