Fintech & paymentsYour AI agent can commit money.
Your AI agent can commit money.
Who wrote what it is allowed to pay?
Transfers, accounting entries, IBAN checks: when a finance agent acts, the operation is often irreversible. A booby-trapped ticket or an invoice containing an instruction can be enough to make it comply. We test these actions on your test environment.
Applicable regulations
DORA
In force since January 2025Digital Operational Resilience Act: mandatory resilience testing for financial entities in the EU.
PCI-DSS v4.0
In forcePayment data security standard. Tighter requirements on authentication, encryption, and monitoring.
GDPR: financial data
In forceBanking data is personal data. Free leaked 24 million IBANs in 2024, and sanctions do follow.
Common fintech vulnerabilities
- Stripe or payment configuration that can be tampered with client-side
- Transaction APIs with no rate limiting and weak authentication
- IBANs and banking data served by unprotected endpoints
- Payment webhooks with no signature verification
- Privilege escalation that opens up other users' data
We keep finding tamperable payment configurations and unprotected financial APIs in French fintechs.