The heads of the Bank of England and the International Monetary Fund used the IMF-World Bank meetings in Bangkok to deliver a blunt warning: cyber-fraud is now scaling fast enough to threaten the foundational trust that makes modern finance possible. Andrew Bailey and Kristalina Georgieva framed the problem not as a technical nuisance but as a systemic risk to financial inclusion itself. Bailey anchored his argument in specifics — self-replicating AI agents hijacking personal devices, and a French supermarket hack that heated refrigeration units to 50°C. These are not hypothetical scenarios. They are evidence that the attack surface is expanding faster than defences. The BoE governor was explicit: "If we don't have trust in money, we don't operate as a society." Georgieva made the point personal. Growing up behind the Iron Curtain, she said, people kept dollars in shoeboxes because they didn't trust the system. Her worry is that unchecked fraud could reproduce that dynamic in modern economies — driving people, particularly those on the fringes of the financial system, to opt out entirely. The IMF flagged a major cyber-attack as one factor raising global financial stability risk to "elevated" this week, alongside higher borrowing costs and the threat of an AI-driven share price crash. The sharpest structural claim Bailey made concerned liability. Traditional publishers are legally responsible for what they publish. Social media platforms are not. Bailey called this "quite an extreme position" and argued it has created an environment where fraud is transmitted freely through channels that bear no legal consequence for hosting it. He stopped short of naming specific companies but was unambiguous: "We must get the social media companies involved because a lot of this fraud is transmitted through those channels." The Bangkok meeting launched a new set of international principles for cyber-fraud in financial institutions — the Bangkok Blueprint. The details remain thin. What is clear is the diagnosis: the same AI tools arming cyber-criminals can be turned to defence, but the incentive structure currently favours offence. Platforms profit from engagement regardless of whether it is legitimate or fraudulent. Financial institutions bear the cost of fraud remediation. Consumers bear the loss when remediation fails. The twenty-year question is whether international principles without binding liability reform change anything. Bailey's own sporting metaphor — "this technology is arming the offence but it can also arm the defence" — acknowledges that the tools exist on both sides. What's missing is the mechanism to force the platforms that transmit fraud to invest in defence at scale. Without that, the Bangkok Blueprint risks being another set of principles that reads well and changes little. The subtext is a power struggle. Central banks and multilateral institutions are signalling they cannot secure the financial system alone while big tech operates under a liability framework designed for a pre-AI internet. The question is whether this warning translates into regulation with teeth, or remains a panel-discussion talking point that resurfaces at every subsequent meeting.
