Shopping online with a debit card tied to your everyday current account where your salary lands, your savings sit and your monthly cash flow runs could be handing criminals a far bigger prize than they need to, as AI pushes cybercrime into a faster and more dangerous era. This is the stark warning from the CEO of deVere Group, one of the world’s largest independent financial advisory organisations, as governments across Europe and beyond pull public websites offline after AI uncovered two critical flaws in PHP, the programming language estimated to run around 70% of the world’s websites. Nigel Green says: “When governments are hitting the off switch on their own websites, it’s serious.
The code behind most of the internet had holes in it for over a decade and it took AI to find them.” Finland temporarily closed its government’s public web services, while the Dutch national cybersecurity agency took its own website down as a precaution. Agencies in Britain, Japan and Australia urged operators to patch immediately or go offline, and the US National Security Agency warned the weaknesses can hand attackers a direct route into a server’s files and databases. The White House says federal agencies are working alongside leading AI labs to speed up a fix.
With PHP behind such a vast share of the web, the exposure could reach almost everywhere people spend money online. Booking platforms, marketplaces, subscription services, ticketing sites, delivery apps and utility portals could all be holding card details on systems built with the same kind of code. You’ve no idea what’s sitting behind any of those checkouts, and neither have I.” The financial toll is climbing fast.
Global ecommerce fraud losses reached an estimated $48 billion in 2025, a 141% jump in five years. Fraud facilitated by AI is forecast to rise from $12.3 billion in 2023 to $40 billion by 2027, and online purchases where the card isn’t physically present already account for around 65% of all credit card fraud losses. I expect attacks to get more frequent.” Prepaid debit cards, such as deVere Vault, sit apart from a person’s main current account.
They carry only the money loaded onto them, so stolen details cannot be used to reach the funds behind the card.” The deVere multi-currency Vault Prepaid Mastercard® can be used online, in-store and at any ATM location across the world. If the details get stolen, the thieves get what’s on the card and nothing else. They can’t touch the account your salary goes into.” He adds: “People should consider using one prepaid card for everything they buy online and topping it up when they need to.
If one of the dozens of sites holding your details gets breached, it’s a nuisance, nothing more.” The deVere CEO is upbeat about the bigger picture. These flaws were found by AI and patched before being made public. Right now, though, criminals can move faster than a lot of the websites we use every day, so protect yourself while that’s the case.” He concludes: “Shopping online is brilliant.
Extract — continue reading at the source.
