Navigating The Risks Of ChatGPT On Financial Institutions

ChatGPT, an advanced AI language model created by OpenAI, is gaining popularity for its ability to generate human-like responses to natural language input.
By
CTM360 Team
February 28, 2023
1 mins read
Navigating The Risks Of ChatGPT On Financial Institutions
background-graphics

What’s on this page

Overview
CTM360’s observation of the trend
Recommendations

What is ChatGPT?

ChatGPT, an advanced AI language model created by OpenAI, is gaining popularity and attention for its ability to generate human-like responses to natural language input. Trained on large amounts of data, ChatGPT's context comprehension and relevant response generation have made it a popular choice for businesses seeking to enhance customer experience and operations.

Major technology corporations are making significant investments in Artificial Intelligence (AI). Microsoft, for instance, has declared that it will invest $10 billion in OpenAI and intends to merge ChatGPT into its Azure OpenAI suite. This will allow businesses to include AI assets, including DALL-E, a program that generates images, and Codex, which transforms natural language into code, in their technology infrastructure.

While ChatGPT has several benefits for financial institutions, such as improving customer service and automating certain tasks, it also carries some risks that need to be addressed. Major banks and other institutions in the US have banned the use of ChatGPT within the organization. Concerns over sensitive information being put into the chatbot.

pic 1

Risks associated with incorporating ChatGPT

Let's delve into the potential risks that are currently being debated regarding the use of ChatGPT:

  1. Data Exposure: One potential risk of using ChatGPT in the workplace is the inadvertent exposure of sensitive data. For example, employees using ChatGPT to generate data insights and analyze large amounts of financial data could unknowingly reveal confidential information while conversing with the AI model, which could lead to breaches of privacy or security. Another known data exposure case observed is Employees could potentially expose private code if they inadvertently include confidential information in the training data. This could occur if an employee includes code snippets that contain sensitive data or proprietary information, such as API keys or login credentials.
  2. Misinformation: ChatGPT can generate inaccurate or biased responses based on its programming and training data. Financial professionals should be cautious while using it to avoid spreading misinformation or relying on unreliable advice. ChatGPT’s current version was only trained on data sets available through 2021. In addition, the tool pulls online data that isn’t always accurate.
  3. Technology Dependency: While ChatGPT offers useful insights for financial decision-making, relying solely on technology may overlook human judgment and intuition. Financial professionals may misunderstand ChatGPT's recommendations or become over-reliant on it. Thus, maintaining a balance between technology and human expertise is crucial.
  4. Privacy Concerns: ChatGPT gathers a lot of personal data that users, unassumingly, might provide. Most AI models need a lot of data to be trained and improved, similarly, organizations might have to process a massive amount of data to train ChatGPT. This can pose a significant risk to individuals and organizations if the information is exposed or used maliciously.

External Risks associated with ChatGPT

  1. Social Engineering: Cybercriminals can use ChatGPT to impersonate individuals or organizations and create highly personalized and convincing phishing emails, making it difficult for victims to detect the attack. This can lead to successful phishing attacks and increase the likelihood of individuals falling for the scam.
  2. Creating malicious scripts and malware: Cybercriminals can train ChatGPT on vast amounts of code to produce undetectable malware strains that can bypass traditional security defenses. By using polymorphic techniques like encryption and obfuscation, this malware can dynamically alter its code and behavior, making it challenging to analyze and identify.

Recommendations:

  • Financial institutions should establish clear policies and guidelines for using ChatGPT in the workplace to safeguard confidential information and mitigate the risks of data exposure.
  • Anonymized data should be used to train an AI model to protect the privacy of individuals and organizations whose data is being used.
  • Specific controls should be applied to how employees use information from ChatGPT in connection with their work.
  • Awareness training should be provided to Employees who have access to ChatGPT on the potential risks associated with the use of the technology, including the risks of data exposure, privacy violations, and ethical concerns.
  • Restricting access to ChatGPT will limit the potential for data exposure and misuse of the technology.

Recent Blogs

Overview

The fight against email-based threats is intensifying. Following the lead of Google and Yahoo, Microsoft has officially announced the mandatory implementation of email authentication protocols, SPF, DKIM, and DMARC, for high-volume email senders, effective May 5, 2025. Domains sending over 5,000 daily emails to Microsoft's platforms, including Outlook.com, Hotmail.com, and Live.com, will be required to authenticate their messages. Initially, non-compliant messages will be redirected to recipients' Junk folders, with eventual total rejection expected if compliance isn't achieved. This enforcement represents a critical step in securing global email communications from spoofing and phishing threats (Microsoft Tech Community).

Understanding Email Authentication

Email authentication has become essential in combating increasingly sophisticated phishing and spoofing attacks. Three core standards have been adopted widely:

  • Sender Policy Framework (SPF: RFC 7208): Verifies the legitimacy of the sending mail server, ensuring messages originate from authorized infrastructure. SPF helps prevent sender address forgery by defining authorized sending sources in DNS records.
  • DomainKeys Identified Mail (DKIM: RFC 6376): Cryptographically signs email messages, allowing recipients to confirm message content hasn't been altered in transit. DKIM leverages public-private key pairs to ensure message integrity and authenticity.
  • Domain-based Message Authentication, Reporting, and Conformance (DMARC: RFC 7489): Combines SPF and DKIM to enforce domain alignment, verify authenticity, and provide reporting mechanisms for senders to track email usage and potential abuse. DMARC is recommended to be implemented in three incremental stages: initial monitoring (p=none), intermediate quarantining of suspicious messages to test the policy impact (p=quarantine), and full rejection of unauthorized emails to achieve DMARC compliance (p=reject). 

Email Content and Delivery Best Practice Guidance

To help the email ecosystem thrive and ensure that legitimate communications reach users' inboxes, major providers like Google, Yahoo, and Microsoft have released a unified set of technical and content-based requirements. This section consolidates these guidelines into a single resource for senders seeking to avoid spam filtering and maintain high deliverability rates.

1. Message Headers & Structural Integrity

Best Practice Description
Valid and consistent From header Use a single, clear email identity. Avoid multiple addresses in From and misleading sender names.
Aligned Reply-To domain Ensure Reply-To reflects the same domain or purpose as From.
Unique and compliant Message-ID Follow RFC 5322 formatting. Avoid duplicate or malformed IDs.
Proper MIME structure and header syntax Messages must conform to standard email formatting. Avoid malformed headers and nested MIME issues.
Avoid forged headers Do not spoof or misuse headers associated with major domains (e.g., gmail.com, outlook.com).

2. Content Hygiene and Formatting

Best Practice Description
Avoid deceptive subject lines Refrain from using misleading tags like "RE:" or "FWD:" unless applicable.
Balanced text-to-image ratio Do not send image-only emails. Include meaningful text with alt text for images.
Email size < 100 KB Ensure the email body stays within standard size limits (typically under 100 KB) to avoid clipping in mail clients. This refers only to the message content and does not include attachments.
Professional formatting Avoid ALL CAPS, excessive punctuation, invisible text, and non-standard fonts.
Exclude scripts and forms Embedded forms or JavaScript will trigger spam or phishing filters.
Consistent branding and tone Use recognizable logos, colors, and sender names to build trust.

3. Infrastructure and Technical Configuration

Best Practice Description
Valid PTR (reverse DNS) records The sending IP address must resolve to a valid hostname that maps back to the same IP address.
TLS for outbound SMTP TLS is mandatory for Gmail. Senders without encryption may be rejected.
SPF lookup limit adherence Keep SPF DNS lookups ≤ 10. Microsoft enforces this.
IP/domain warming Gradually increase send volume from new IPs or domains to build a reputation.
Consistent sending patterns Avoid sending bursts or erratic volumes. Maintain daily volume stability.
ARC headers for forwarded email ARC ensures original authentication results are preserved through intermediaries.

4. Recipient List Management

Best Practice Description
Explicit opt-in only Do not use purchased lists. Only email users who have explicitly subscribed.
Functional one-click unsubscribe Add RFC-compliant headers:
List-Unsubscribe: <https://domain/unsub?id=xyz>
List-Unsubscribe-Post: List-Unsubscribe=One-Click
Unsubscribe fulfillment within 48 hours Honor removal requests promptly to reduce complaints.
List cleaning and bounce management Regularly purge unengaged, bounced, or invalid addresses.
Segmentation by message type Separate promotional, transactional, and notification content using distinct sender identities.

5. Engagement and Complaint Monitoring

Tool / Method Purpose
Google Postmaster Tools Monitor domain/IP reputation, spam rate, and user engagement.
Yahoo Complaint Feedback Loop (CFL) Receive ARF reports for complaints and unsubscribe flagged users.
Maintain a complaint rate < 0.3% High complaint rates trigger deliverability throttling and domain penalties.
Monitor bounce and open rates Use these to assess the health of your lists and campaigns.

6. Summary Recommendations

  1. Align headers and domains with clear, professional identities.
  2. Respect opt-in and unsubscribe behaviors with transparent mechanisms.
  3. Structure content to be clean, concise, and free of deceptive or spammy characteristics.
  4. Maintain technical hygiene through DNS, TLS, SPF limits, and ARC usage.
  5. Monitor sender reputation and user engagement continuously.

Immediate Impact and Risks of Non - compliance

As of May 2025, domains that fail SPF or DKIM checks or lack a correctly configured DMARC policy with alignment will risk having their emails marked as spam or not delivered at all. Misalignment occurs when the domain used in the message's "From" address doesn't match the domains authenticated by SPF or DKIM.

Organizations failing to comply face significant risks, including diminished deliverability rates, compromised customer trust, and increased susceptibility to impersonation attacks. These impacts directly affect an organization's reputation, customer engagement, and potentially, its revenue.

Actionable Recommendations for Immediate Implementation

To effectively prepare for these mandatory standards, organizations should:

  • Audit current DNS records: Utilize tools such as "dig" or Google DNS to verify SPF, DKIM, and DMARC records.
  • Begin with Monitoring (p=none): Initially deploy DMARC in monitoring mode to understand email flows and detect anomalies without risking legitimate email delivery.
  • Gradually enforce stricter policies: Move from quarantine to full rejection while monitoring.
  • Ensure domain alignment: "From" domain must match what’s authenticated via SPF or DKIM.
  • Maintain email hygiene: Clean lists, include a clear opt-out option, and avoid using misleading subject lines or headers.

Start Your DMARC Journey with CTM360 Free Community Edition

To support organizations navigating these changes, CTM360 offers a complimentary zero-cost Community Edition platform. It allows comprehensive monitoring, management, and enhancement of your DMARC records and email authentication setup. This proactive approach helps organizations reduce risks associated with impersonation attacks and maintain reliable email communication.

Join CTM360 Community Edition today, no hidden costs, simply real security.

Reference:

Disclaimer:

The information contained in this document is meant to provide general guidance and brief information to the intended recipient pertaining to the incident and recommended action. Therefore, this information is provided "as is" without warranties of any kind, express or implied, including accuracy, timeliness, and completeness.

Consequently, under NO condition shall CTM360®, its related partners, directors, principals, agents, or employees be liable for any direct, indirect, accidental, special, exemplary, punitive, consequential, or other damages or claims whatsoever including, but not limited to loss of data, loss in profits/business, network disruption...etc., arisina out of or in connection with this advisory.

For more information: Email: monitor@ctm360.com Tel: (973) 77 360 360

Summary:

In December 2024, hackers compromised at least 35 Google Chrome extensions, affecting approximately 2.6 million users. The attack exploited phishing emails sent to developers, masquerading as Google policy violation notices. These emails tricked developers into granting permissions to a malicious OAuth application named

“Privacy Policy Extension.

” Once authorized, the attackers gained control over the extensions, injecting malicious code to steal user data, particularly targeting Facebook credentials and business accounts. Browser extensions can significantly enhance productivity by adding new features to web browsers like Microsoft Edge and Google Chrome. However, they also pose significant security risks, as malicious or compromised extensions can lead to data breaches, malware infections, and unauthorized access to corporate networks. It is crucial for organizations to control, block, or manage browser extensions to minimize security risks, particularly in an enterprise environment. This advisory outlines the steps to block and protect browser extensions for Microsoft Edge and Google Chrome, and it also includes specific guidance on managing extensions using Microsoft Intune.

Risks Associated With Browser Extensions

Data Exposure: Some extensions can access sensitive data (e.g., browsing history, credentials, and files), potentially exposing confidential information.

Malicious Extensions: Cybercriminals can create or compromise extensions, making them a vector for malware distribution or data exfiltration.

Phishing Risks: Extensions may manipulate web content, tricking users into providing sensitive information.

Performance Degradation: Some poorly coded extensions can slow down browsers or degrade system performance.

Managing Browser Extensions Using Group Policy

A. Microsoft Edge

Using Group Policy (Windows)

1. Open the Group Policy Management Console (GPMC).

2. Navigate to:  Computer Configuration > Administrative Templates > Microsoft Edge > Extensions

3. Set the following policies:

a. Control which extensions are installed silently: Specify allowed extensions by adding their extension IDs.

b. Configure extension management settings: T o block all extensions, set this policy to "*" (deny all).

c. Configure the list of force-installed extensions: If any extension is necessary for business, add the corresponding extension ID here.

B. Google Chrome

Using Group Policy (Windows)

1. Open the Group Policy Editor.

2. Navigate to: Computer Configuration > Administrative Templates > Google > Google Chrome > Extensions

3. Set the following policies:

a. Block external extensions: Set the policy to block all extensions unless specifically allowed by adding the extension IDs.

b. Configure extension install allow list: If certain extensions are necessary, add their extension IDs here.

c. Configure extension install blocklist: Add a wildcard"*" to block all extensions.

Managing Browser Extensions Using Microsoft Intune

Organizations using Microsoft Intune for endpoint management can apply policies to control browser extension installations across all managed devices. This approach is particularly useful for managing large numbers of endpoints efficiently.

Blocking Extensions in Microsoft Edge Using Intune

1. Sign in to Microsoft Endpoint Manager Admin Center.

2. Navigate to: Devices > Configuration profiles > Create profile

3. Choose:

a. Platform: Windows 10 and later.

b. Profile type: Settings catalog.

4. In the Configuration settings, search for Extensions under Microsoft Edge:

a. Allow specific extensions to be installed (User): Specify allowed extension IDs

b. Control which extensions cannot be installed (User): Add a wildcard"*" to block all extensions.

5. Assign this profile to your target groups (specific users or devices).

Blocking Extensions in Google Chrome Using Intune

1. Sign in to Microsoft Endpoint Manager Admin Center.

2. Navigate to: Devices > Configuration profiles > Create profile

3. Choose:

a. Platform: Windows 10 and later.

b. Profile type: Settings catalog.

4. In the Configuration settings, search for Extensions under Google Chrome\Extensions:

a. Configure extension installation allow list (User): Specify allowed extension IDs

b. Configure extension installation blocklist: Add a wildcard"*" to block all extensions.

5. Assign this profile to your target groups (specific users or devices).

Note: These steps are mentioned for user-based controls. Similar configuration steps can be applied for device-based controls.

Best Practices for Managing Browser Extensions

Audit Extensions Regularly: Regularly audit the extensions installed on users’ browsers to detect unauthorized or risky extensions.

User Training: Educate users about the risks associated with browser extensions and how to identify malicious ones.

Implement a Zero-Trust Model: Always assume that extensions can potentially be compromised. Apply the principle of least privilege when granting extension permissions.

Use Security Solutions: Consider deploying security solutions that can monitor and block malicious browser activities, including suspicious extension behavior.

Conclusion

Controlling browser extensions in Microsoft Edge and Google Chrome is a critical aspect of securing enterprise endpoints. By implementing the steps outlined above, organizations can significantly reduce the risks associated with browser extensions. Whether you manage your endpoints using Group Policy or Microsoft Intune, these controls can help protect your network from potential extension-related threats. By following this advisory, organizations can take proactive steps to mitigate browser extension risks, enhancing their overall cybersecurity posture.

Reference:

https://www.bleepingcomputer.com/news/security/new-details-reveal-how-hackers-hijacked-35-google-chrome-extensions/

https://learn.microsoft.com/en-us/defender-endpoint/manage-profiles-approve-sys-extensions-intune

https://gbhackers.com/malicious-editthiscookie-extension/#google_vignette

Disclaimer

The information contained in this document is meant to provide general guidance and brief information to the intended recipient pertaining to the incident and recommended action. Therefore, this information is provided "as is" without warranties of any kind, express or implied, including accuracy, timeliness, and completeness. Consequently, under NO condition shall CTM360®, its related partners, directors, principals, agents, or employees be liable for any direct, indirect, accidental, special, exemplary, punitive, consequential, or other damages or claims whatsoever including, but not limited to: loss of data, loss in profits/business, network disruption…etc., arising out of or in connection with this advisory.

For more information:

Email: monitor@ctm360.com Tel: (+973) 77 360 360

There is an ongoing scam email campaign targeting executives from prominent organizations around the world. These reported email addresses on the domains are genuine email accounts of 'Virgin Media', 'Optimum' & 'Cox communications' users' which are compromised and sold on underground forums. Scammers buy and use such accounts as they have a higher reputation compared to newly created free accounts to bypass email gateways and spam filters and also lower their risk of being detected or tracked back in a bigger BEC attack.

These accounts are compromised by threat actors via phishing emails and malware, and the issue with such accounts will persist as long as end users are not careful enough while dealing with phishing and malicious emails. Based on our previous experience in response with the hosts Virgin Media, Optimum and Cox.net which are TV and cable providers in the UK and USA. They do not investigate email accounts reported to their abuse team without the original email and header information as this is a mandatory requirement as per their abuse policies. However, once this information is provided they do take action by resetting/recovering the reported account of the original user.

Additionally, enabling strict quarantine measures on your email gateway from these domains will make you a harder target and eventually the attackers moving on to another one.

RECOMMENDATIONS

  • As a precautionary measure, all email from private and/or external email addresses which contain the name of your executive staff in the "From" field may flagged.
  • As part of containment, please ensure to quarantine emails from the domain @virginmedia[.]com, @optimum[.]net, @optonline[.]net, @cox[.]net, @cox[.]com
  • As this type of email is tricky, it is highly recommended to conduct phishing awareness training for all employees to avoid potential risks.
//chatbot //Ahrefs