Wes SpencerCo-Founder, Empath · Co-Founder of Empath | Recovering Cybersecurity Guy| Keynote Speaker | 2020 Cyber Educator of the Year | Building the MSP Workforce Operating System

Phishing Pitfalls: A Fintech Firm's Wake-Up Call from Above the Stack, Episode One

11 Sept 2025 · 1 min

Watch on YouTube

1:03

In this segment, the speaker describes a fintech firm that was deploying AI‑driven agents to automate loan agreement processing. An investigation revealed that loan officers were using personal devices and storing customer personally identifiable information (PII) locally. One officer clicked a phishing email link, and because the organization lacked endpoint, malware, and browser protections, the phishing attack succeeded, leading to a breach and exfiltration of the locally stored PII. The example illustrates how the pursuit of AI‑generated ROI can expose critical security gaps in fintech operations.

Chapters

They're approaching us now for a lot of these conversations because they have some type of ROI that they see, right, with AI. And a great example was I worked with a company that, you know, was a loan officer company and, or, you know, more of a fintech firm itself and was trying to stand up, you know, these agents that would allow them to auto-process loan agreements. But doing initial investigation, you know, could see that loan officers actually were working from personal devices and were downloading, you know, customer PII locally as well too. And one of those loan officers is kind of why the engagements came up as well, too, was he actually clicked on a phishing link that we all might get through our email but didn't have any of the native protections on the endpoint for the malware protections, the web browser protections, and so forth. And that actually caused the breach. And then there was data exfiltration that occurred because they were actually managing that customer PII locally as well, too. So that's one example of some of the things that we're seeing in that sense.