Your salary, savings and bank account, the chilling risk hiding behind a simple online purchase

As critical flaws in software underpinning much of the internet trigger emergency shutdowns, deVere Group chief Nigel Green warns consumers to rethink how much of their financial lives they expose to online retailers.

Consumers who use a debit card linked directly to their main bank account for everyday online purchases could be exposing far more money than they intend to spend, as artificial intelligence accelerates the scale and sophistication of cybercrime.

That is the warning from Nigel Green, chief executive of financial advisory group deVere Group, following the discovery of critical vulnerabilities in PHP, a programming language estimated to underpin about 70 per cent of the world’s websites.

The flaws have prompted government agencies and cybersecurity authorities to take precautionary measures, including temporarily disabling public-facing websites, while urging operators to install security updates.

“When governments are hitting the off switch on their own websites, it’s serious,” Green said. “The code behind most of the internet had holes in it for over a decade and it took AI to find them.”

Finland temporarily closed public government web services, while the Dutch national cybersecurity agency took its website offline as a precaution. Authorities in Britain, Japan and Australia urged operators to patch vulnerable systems or take them offline, while the US National Security Agency warned that the weaknesses could provide attackers with a route into server files and databases.

The incident highlights a broader problem for consumers: online payments increasingly depend on interconnected systems whose security is largely invisible to the people using them.

The financial exposure behind a checkout

From grocery deliveries and airline bookings to streaming subscriptions, gym memberships and parking applications, consumers routinely provide payment details to dozens of digital services.

If a website is compromised, the consequences can extend beyond the immediate purchase, depending on what information is stored, how the system is configured and whether attackers can access connected networks.

“Look at how many places have your card details,” Green said. “Your food shop, your streaming, your airline, your gym, the parking app. You’ve no idea what’s sitting behind any of those checkouts, and neither have I.”

The financial incentives for criminals are substantial. Global e-commerce fraud losses were estimated at $48bn in 2025, according to figures cited in the supplied material, while fraud facilitated by AI is forecast to rise from $12.3bn in 2023 to $40bn by 2027.

Online transactions in which the physical card is not present already account for about 65 per cent of credit-card fraud losses, underscoring the risks associated with digital payments.

Green argues that AI could make attacks faster and cheaper to execute, enabling criminals to automate website scanning, generate convincing fraudulent checkout pages and process stolen payment details at greater speed.

“One criminal with AI can now do the work of an entire gang,” he said. “Scan thousands of websites overnight, knock up fake checkout pages, run stolen card numbers faster than any human could. I expect attacks to get more frequent.”

Why separating spending money matters

One way to limit potential losses is to separate online spending from the account that holds a household’s salary, savings and regular cash flow.

Prepaid debit cards operate differently from conventional debit cards linked directly to a current account. Users load a specified amount onto the card, limiting the funds immediately available through its payment credentials.

“A prepaid card is simple,” Green said. “You put on it what you want to spend. If the details get stolen, the thieves get what’s on the card and nothing else. They can’t touch the account your salary goes into.”

He recommends considering a dedicated prepaid card for online purchases, topped up when needed. DeVere’s Vault Prepaid Mastercard is one product offered on this basis.

The approach can reduce the amount directly exposed if card details are compromised, although it is not a substitute for secure websites, strong authentication or monitoring transactions. A prepaid card may still be subject to fraud, and protections, fees and dispute procedures vary by provider and jurisdiction.

AI creates a race between attackers and defenders

The discovery also illustrates AI’s dual role in cybersecurity. The same technology that can help criminals automate attacks can enable researchers to identify weaknesses before they are exploited.

Green welcomed the discovery and subsequent fixes, arguing that defensive capabilities should improve significantly over the coming years.

“AI found these holes and they got fixed. Good,” he said. “I believe defences will get much, much stronger over the next few years.”

For now, however, consumers cannot assume every website they use has been updated or that every payment system is equally secure.

“Shopping online is brilliant,” Green said. “Just don’t expose more of your financial life to it than you need to.”

The broader lesson is that payment convenience and financial exposure do not have to be inseparable. Keeping online spending separate from essential household funds can provide an additional layer of protection while the contest between cybercriminals and security researchers intensifies.