Agentic AI is accelerating fraud into a software-scale threat

At a glance

What this is: Incode argues that agentic AI is turning fraud into a scalable software operation, with a case database showing rapid growth in documented AI-enabled fraud and losses approaching 900 million dollars.

Why it matters: This matters because identity verification, KYC, and fraud teams now face attacks that can adapt, persist, and scale without human bottlenecks, so controls must shift toward proving a real person is present.

By the numbers:

• The report's incident database tracks 66 independently sourced, cross-checked AI-fraud cases in the US.
• The report says 44 cases were confirmed through documented methods.
• Reported losses across the catalogued cases approach 900 million dollars.
• The FBI's Internet Crime Complaint Center logged 20.9 billion dollars in reported US cyber-enabled losses in 2025.

Context

Agentic AI changes fraud economics because it removes the human ceiling that previously constrained how many scams could be researched, initiated, and adapted at once. In identity and fraud programmes, that shifts the control problem from spotting isolated suspicious events to governing continuous, machine-speed interactions that can impersonate people, learn from responses, and scale across channels.

This is a genuine identity verification problem, not only a fraud-ops problem, because the attacker objective is to pass as a real person long enough to complete a high-value action. Traditional review and escalation workflows assume a human threat actor has limited throughput; agentic fraud breaks that assumption by making one operator look like many.

The article's starting position is atypical only in degree, not in kind: the fraud playbook is familiar, but the scale, speed, and autonomy are new. That is why identity assurance, liveness, and step-up verification are becoming control-plane issues rather than supporting checks.

Key questions

Q: What breaks when fraud can be run by agentic AI instead of people?

A: The main failure is labour-based security assumptions. If an attack can research, adapt, and scale automatically, controls built around human delay, limited throughput, and manual review no longer contain it. Teams need to assume the attacker can run many parallel journeys at once and design verification and escalation around that reality.

Q: Why do synthetic voice and video scams defeat conventional fraud controls?

A: Because conventional controls often score each channel separately. A scammer can make text, voice, and video each look plausible in isolation while still running one coordinated fraud journey. The defence is to bind all channels to the same identity risk model, so one convincing layer cannot mask a weak or synthetic actor.

Q: How should identity teams reduce risk in high-value customer journeys?

A: Use step-up verification at the point of highest consequence, such as account recovery, payout changes, and beneficiary edits. Pair that with liveness checks, behavioural risk signals, and stronger proofing so a convincing synthetic interaction cannot complete the transaction without a verified identity event.

Q: What should organisations measure if they want to know fraud controls are working?

A: Organisations should measure whether controls are increasing attacker cost, reducing campaign success rates, and forcing repeated abuse to become uneconomic. A control can reduce one attempt and still fail strategically if attackers can immediately retry at low cost. The right metric is not only detection, but deterrence.

Technical breakdown

Why agentic fraud scales beyond human labour

Fraud has always been labour-constrained: attackers needed people to research targets, open conversations, adapt scripts, and follow up. Agentic AI changes that by chaining those tasks into an execution loop that can run thousands of parallel interactions with minimal oversight. The key architectural shift is not just better content generation, but persistence, feedback, and concurrency. An agent can learn from rejection, refine its approach, and keep operating without the pauses, fatigue, or staffing limits that used to cap scam volume. That makes attack throughput software-like rather than workforce-like.

Practical implication: Treat fraud volume spikes as a control failure signal, not just a growth metric, and design controls around machine-speed interaction rather than manual case review.

Why identity verification becomes the last trust checkpoint

When a scam can be executed end to end by software, the control objective moves from detecting suspicious language to proving who or what is on the other side of the interaction. Identity verification, liveness, and proofing are the last checkpoints because they challenge the attacker’s ability to impersonate a real person before the transaction completes. In agentic fraud, the relevant trust question is whether the actor is human, synthetic, or delegated. That is where fraud prevention intersects directly with identity governance: the organisation has to bind trust to a verified identity event, not to conversational fluency.

Practical implication: Anchor high-risk workflows in stronger identity proofing and step-up verification before approval, payout, or account recovery.

Why deepfakes and chatbot scams now reinforce each other

The article shows a progression from chatbots to voice cloning to generated video, and agentic systems unify those techniques into a single operational model. A scam no longer needs one channel or one imitation style. It can open with a text conversation, move to voice, and close with live video or document exchange, adjusting as the target resists. That multi-modal flexibility makes static fraud rules brittle because each channel looks individually plausible. The real failure mode is fragmented trust evaluation across separate channels that should instead be governed as one identity journey.

Practical implication: Correlate signals across text, voice, video, and document steps so a synthetic interaction cannot pass because each channel looks acceptable in isolation.

Threat narrative

Attacker objective: The attacker wants to convert synthetic, machine-speed trust into fraudulent payments, account access, or impersonation outcomes at scale.

1. Entry begins when an agentic system initiates contact with a target through chat, email, or voice and uses fluent, adaptive conversation to earn trust.
2. Credential_harvested or trust-exploited when the target is persuaded to disclose sensitive information, approve access, or complete an action that should have required stronger identity proofing.
3. Escalation occurs as the same operator scales the play across thousands of victims, using real-time adaptation, deepfakes, and delegation to move from first contact to high-value fraud outcomes.
4. Impact is financial loss at industrial scale, including scams that can reach payment, account takeover, or fraudulent transfer before traditional review catches up.

Breaches seen in the wild

• Meta AI Instagram Account Takeover: 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic fraud is no longer a volume problem, it is a governance problem. Once fraud can be run by software, the old assumption that attack throughput is limited by human labour stops holding. That changes how identity, fraud, and customer protection teams should think about control ownership. The practical conclusion is that fraud governance now has to cover machine-speed orchestration, not just suspicious behaviour.

Verified human presence is becoming the decisive control concept in agentic fraud. If an agent can impersonate fluency, urgency, and even live video, then the security boundary shifts to proving that a real person is present at the critical step. That makes identity verification the control plane for high-risk transactions and recovery journeys. Practitioners should treat liveness and proofing as trust anchors, not convenience features.

Agentic fraud exposes a verification trust gap. The gap is between what a system can convincingly simulate and what a business is willing to trust without re-verification. That gap widens when workflows rely on conversational confidence, callback recognition, or single-channel checks. The practitioner takeaway is to map every high-risk journey to a positive verification event before value moves.

Fraud operations must stop treating channels as separate trust domains. The article's examples show that text, voice, and video can be chained together in one attack path. That means a control that fails open in one channel weakens the whole journey. Identity teams should push for unified policy across channels, because synthetic actors exploit the seams between them.

Agentic AI accelerates the convergence of fraud prevention and identity assurance. Fraud teams can no longer rely on post-event detection alone because automated attacks can adapt faster than case handling. The stronger model is preventive: bind trust to verified identity, step-up assurance, and continuous risk scoring at the moment of interaction. That is where KYC, digital identity, and fraud analytics now meet.

From our research library:

• 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Guide

What this signals

Agentic fraud changes the unit of defence from the suspicious incident to the verified identity event. Programmes that still rely on pattern recognition after the fact will miss the real shift, because the attacker can now generate, test, and adapt at machine speed. Teams should move trust decisions closer to the moment of proofing and value movement.

Verified human presence will matter more as synthetic interaction quality improves. The more convincing chat, voice, and video become, the less security value there is in treating each channel as a separate check. Identity and fraud teams should prepare for unified verification journeys that assume one actor can traverse multiple channels without friction.

For practitioners

• Strengthen high-risk identity verification Require step-up verification for account recovery, payout changes, and other high-value journeys where synthetic actors can impersonate trust.
• Correlate signals across channels Fuse text, voice, video, device, and behavioural signals so one plausible channel cannot override weak evidence in another.
• Harden fraud workflows for machine-speed attacks Assume a single operator can run many simultaneous interactions and tune queueing, review, and escalation thresholds accordingly.
• Use liveness and proofing before value transfer Place liveness checks and identity proofing immediately before money movement, credential reset, or beneficiary changes.
• Reassess manual review as a primary control Treat manual review as a backstop, not the main defence, because agentic fraud can outpace human case handling and callback processes.

Key takeaways

• Agentic AI is removing the labour ceiling that once limited fraud, so scams can now run and adapt at software scale rather than human scale.
• Incode's case database shows 66 independently sourced AI-fraud cases and reported losses approaching 900 million dollars, which is enough to justify control redesign, not just tuning.
• Identity verification, liveness, and step-up checks should move earlier in high-risk journeys because the attacker objective is now to reach a verified trust point, not merely to look suspicious.

Key terms

• Agentic Fraud: Fraud executed by systems that can plan, adapt, and complete tasks with limited or no human intervention during the session. The control problem is not only account creation, but whether the system can continue to behave within approved bounds after access is granted.
• Identity verification: Identity verification is the process of confirming that a user, workload, or agent is the entity it claims to be before access is granted. In AI-heavy environments, that verification must include the requester, the system acting on its behalf, and the sensitivity of the action.
• Liveness Detection: Liveness detection is the mechanism that checks whether a biometric sample comes from a real, present person rather than a spoof such as a photo, screen, or mask. In identity programmes, it is a core defence against presentation attacks and should be tested under realistic operating conditions.
• Step-Up Verification: Step-up verification is a stronger identity check applied when risk increases, such as during password reset, device change, or privileged access request. It uses higher-assurance signals than a static question, such as device possession, authenticated context, or approved administrative review.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and agentic AI identity. It helps practitioners connect identity assurance to the broader security programme that fraud, access, and trust decisions depend on.