Shopping online with a debit card tied to your everyday current account where your salary lands, your savings sit and your monthly cash flow runs could be handing criminals a far bigger prize than they need to, as AI pushes cybercrime into a faster and more dangerous era.
This is the stark warning from the CEO of deVere Group, one of the world’s largest independent financial advisory organisations, as governments across Europe and beyond pull public websites offline after AI uncovered two critical flaws in PHP, the programming language estimated to run around 70% of the world’s websites.
Nigel Green says: “When governments are hitting the off switch on their own websites, it’s serious. The code behind most of the internet had holes in it for over a decade and it took AI to find them.”
Finland temporarily closed its government’s public web services, while the Dutch national cybersecurity agency took its own website down as a precaution.
Agencies in Britain, Japan and Australia urged operators to patch immediately or go offline, and the US National Security Agency warned the weaknesses can hand attackers a direct route into a server’s files and databases. The White House says federal agencies are working alongside leading AI labs to speed up a fix.
With PHP behind such a vast share of the web, the exposure could reach almost everywhere people spend money online.
Booking platforms, marketplaces, subscription services, ticketing sites, delivery apps and utility portals could all be holding card details on systems built with the same kind of code.
“Look at how many places have your card details,” says Nigel Green. “Your food shop, your streaming, your airline, your gym, the parking app. You’ve no idea what’s sitting behind any of those checkouts, and neither have I.”
The financial toll is climbing fast. Global ecommerce fraud losses reached an estimated $48 billion in 2025, a 141% jump in five years.
Fraud facilitated by AI is forecast to rise from $12.3 billion in 2023 to $40 billion by 2027, and online purchases where the card isn’t physically present already account for around 65% of all credit card fraud losses.
“One criminal with AI can now do the work of an entire gang,” says the deVere CEO. “Scan thousands of websites overnight, knock up fake checkout pages, run stolen card numbers faster than any human could. I expect attacks to get more frequent.”
Prepaid debit cards, such as deVere Vault, sit apart from a person’s main current account. They carry only the money loaded onto them, so stolen details cannot be used to reach the funds behind the card.”
The deVere multi-currency Vault Prepaid Mastercard® can be used online, in-store and at any ATM location across the world.
“A prepaid card is simple,” says Nigel Green. “You put on it what you want to spend. If the details get stolen, the thieves get what’s on the card and nothing else. They can’t touch the account your salary goes into.”
He adds: “People should consider using one prepaid card for everything they buy online and topping it up when they need to. It takes two minutes. If one of the dozens of sites holding your details gets breached, it’s a nuisance, nothing more.”
The deVere CEO is upbeat about the bigger picture. These flaws were found by AI and patched before being made public.
“AI found these holes and they got fixed. Good,” he says.
“I believe defences will get much, much stronger over the next few years. Right now, though, criminals can move faster than a lot of the websites we use every day, so protect yourself while that’s the case.”
He concludes: “Shopping online is brilliant. Just don’t expose more of your financial life to it than you need to.”