Banks risk failure deploying AI faster than they govern it

AI is accelerating phishing deepfake scams and attacks on software weaknesses across the sector.

Indonesian banks risk undermining their artificial intelligence investments when governance, staff capabilities and security processes fail to keep pace with deployment.

Attackers are already using AI to sharpen phishing campaigns, enable deepfake fraud and connect software weaknesses into more effective attack paths. Banks are deploying the technology in response, but moving first offers little protection without clear controls.

“The differentiator will not be who adopts AI first, but who adopts it most effectively with a strong cybersecurity and governance framework,” said Alex Cheung, Partner at Deloitte Cyber Indonesia.

The strongest early use cases are fraud detection and prevention across digital banking, payment fraud, account takeovers and identity theft. Security operations centres can also use AI agents to prioritise alerts, identify abnormal behaviour and speed up investigations.

Banks may gain further value from phishing and deepfake detection, as well as vulnerability management that identifies which weaknesses require urgent patching.

The danger is treating AI as a ready-made answer to security failures.

“I think a lot of banks here run into trouble when they implement AI faster than they can govern it,” Cheung said.

Projects can break down when banks lack the people, processes and oversight needed to manage automated decisions. Formal governance must therefore precede deployment across critical systems, whilst customer data protection and cyber resilience must remain operating requirements rather than later additions.

Human review is also necessary where AI affects customers, investigations or security decisions.

“I honestly believe that humans should always be part of that AI equation,” Cheung said.

For Indonesian banks, the competitive advantage will come from governing AI well enough to use it quickly without weakening trust.