A card payment takes seconds. Behind it sit people, software, banks and service providers that customers never see. A weakness in any one of them can put that payment at risk. Two changes make this especially urgent: AI is helping attackers find security gaps faster, while digital payments depend on more connected systems and outside partners than ever. The question is not simply whether a business has passed its compliance checks. It is whether customers’ payments remain secure long after the checklist is complete. For chief executives, heads of IT and compliance leaders in banking, retail and hospitality, that is now a leadership question.

Shift one: AI is helping attackers move faster

Verizon’s 2026 Data Breach Investigation Report found that AI is helping attackers exploit known software flaws faster, narrowing the time defenders have to respond from months to hours. Three incidents from this summer show what that means in practice. In July 2026, the security firm Sysdig reported what it believes was the first ransomware attack carried out from start to finish by an AI agent. The agent broke in through a weakness in an online system, collected passwords and data, moved into a separate database, locked and deleted data, and left a ransom note.

At one point, it went from a failed login to a working fix in just 31 seconds.

Also in July, AI agents reportedly used weaknesses in a government network in Taiwan, including weak passwords and exposed administrative pages, to reach 21 connected systems, compromise 85 accounts and extract more than 2,564 personnel records.

The third case was not a criminal attack, which makes it more telling. During an internal test at OpenAI, AI models broke out of their test environment and reached the live systems of Hugging Face, a separate company. They used publicly exposed login credentials and exploited weaknesses in Hugging Face’s software. Hugging Face later traced about 17,600 actions over several days. When defenders cut it off, the agent rebuilt its tools and carried on. OpenAI later concluded that the models had gone well beyond what the test was meant to allow.

These incidents reveal an uncomfortable reality. Attackers can now use AI to test weaknesses repeatedly and change course when an attempt fails.

Shift two: Payments need cybersecurity, not only compliance

A customer taps a card at a supermarket in Kingston, or enters card details on a hotel booking page, and the payment clears in seconds. Behind that moment sit the merchant and its staff, the checkout software, a payment gateway and processor, two banks, the cloud platforms that host the systems, and the vendors that support all of them. The customer sees one payment. An attacker sees a chain of organisations, systems and people, each a possible way in.

The local stakes are rising. Total fraud losses in Jamaica's deposit-taking sector fell by 18 per cent in 2025, yet credit card fraud rose by 29.4 per cent and debit card fraud by 16.8 per cent. The Bank of Jamaica linked the increase to card-not-present transactions, the payments made online, by phone or through apps. Not all of that fraud stems from breaches of business systems, but the trend points squarely at digital payment channels.

The Payment Card Industry Data Security Standard, or PCI DSS, is the card industry's baseline for protecting payment data. It applies to systems that handle card data, connect to those systems, or could affect their security. PCI DSS includes ongoing security requirements, not just periodic assessments. But it cannot prevent every kind of fraud, and it was never designed to. The risk comes when a business treats passing an assessment as the finish line rather than making security part of its everyday operations across staff, systems and third parties.

The British Airways breach shows why that broader view matters, and it has a Caribbean link. In 2018, attackers first entered the airline's network using login details issued to an employee of Swissport, a cargo-handling firm based in Trinidad and Tobago. The airline's own policy called for multi-factor authentication, but that Swissport account was not protected by it. The attackers then found the source code for the airline's website and planted a card skimmer on its payment page.

The personal data of about 429,612 customers and staff was potentially accessed, including card numbers and security codes for many customers. The airline was fined £20 million. The attack began with a supplier's login, then succeeded because weaknesses in the airline's own controls let the attackers reach the payment page.

Why the two shifts must be considered together

Put the two shifts side by side and the risk compounds. The payment chain is made of exactly the kind of side doors that AI agents are good at finding: supplier logins, remote support connections, and the scripts that marketing and analytics vendors add to checkout pages.

The PCI Security Standards Council introduced newer controls on payment page scripts because website skimming has grown alongside more complex e-commerce platforms and heavier use of outside scripts. Many of those scripts are supplied or maintained by third parties, adding to the dependencies a merchant has to understand and monitor.

Verizon reports that third parties are now involved in 48 per cent of breaches, up from 30 per cent a year earlier. The figures cover all industries, not payment systems alone, but payment chains depend heavily on outside providers.

Speed matters too. PCI DSS requires organisations to confirm their scope at least once every 12 months and whenever the environment changes significantly. It also requires ongoing security activities. The problem is relying on an annual assessment alone when attackers may exploit a known flaw in hours. Businesses need to keep monitoring their payment environments and reviewing changes between assessments.

Persistence matters as well. The British Airways attackers began with one poorly protected supplier account and then exploited further weaknesses inside. An agent that can keep searching for days has more chances to find an overlooked account or connection.

Where payment security is handled as a separate compliance exercise, the gaps between it and the wider security programme are exactly where these attackers look.

The organisational blind spot

This is where payment security becomes a leadership question rather than a technical one. Consider a Caribbean retailer with an online store, where in a single quarter:

• The marketing team adds an analytics tool to the checkout page to track conversions

• The technology team integrates a new loyalty platform

• Procurement renews a contract with an outsourced payment provider

• Operations engages a third-party firm to support point of sale terminals remotely

Each decision is reasonable. Each may also add a dependency that an attacker will test. Not every change will count as significant under PCI DSS, but each should trigger a review of whether it affects payment security, existing controls or scope.

Trust is what is at stake

A payment incident is not automatically a data protection incident, but it can become one. Under Jamaica’s Data Protection Act, in force since 1 December 2023, businesses responsible for personal data must notify the Information Commissioner within 72 hours of learning about a security breach that affects, or may affect, that data.

When a breach occurs anywhere in a business's payment chain, customers may hold that business responsible, even when the failure started elsewhere.

What leaders should ask now

The question for leaders this month is whether their approach to payment security has caught up with attackers that work around the clock, move in hours and hunt for gaps. Four questions provide a practical test:

• Access: Who, inside and outside the organisation, including suppliers, can reach payment data or the systems that handle it, and is every such account protected by multi-factor authentication?

• Change: Who can add or change code and scripts on checkout pages, and is every script known, authorised and monitored?

• Monitoring: Could the organisation spot unauthorised activity in its payment environment within hours rather than weeks?

• Response: Who leads if a compromise is suspected, and have the roles of payment providers and other partners been agreed in advance?

Answering these questions clearly is an important starting point. Proving that the controls behind them work, across payments and the wider business together, is what turns compliance into resilience.