TL;DR: AI-powered phishing, synthetic identities, and account takeover are pushing banks toward device intelligence, behavioural analytics, and real-time risk decisions, according to Fingerprint’s summary of Gartner’s 2025 Fraud and Financial Crime Prevention Hype Cycle. Static controls are losing ground; fraud programmes now need adaptive identity signals that protect both compliance and customer experience.
At a glance
What this is: This is Fingerprint's analysis of Gartner's 2025 fraud and financial crime prevention outlook, arguing that adaptive device intelligence is becoming a core fraud signal as AI-driven attacks outpace static controls.
Why it matters: It matters because fraud, IAM, and risk teams in regulated environments need controls that reduce false positives, support KYC and AML decisions, and still preserve low-friction customer journeys.
Context
Financial crime controls are being stressed by faster attack automation, synthetic identity abuse, and AI-assisted phishing. In banking, the problem is no longer just stopping fraud after the fact, but making reliable risk decisions at onboarding, login, and transaction time without turning every interaction into a manual review.
The governance gap is that many fraud programmes still rely on signals that were designed for stable, human-paced user behaviour. Device intelligence changes the model by adding persistent, session-level context from the endpoint, which is especially relevant when fraudsters spoof devices, rotate networks, or try to blend into normal customer activity.
Key questions
Q: How should banks use device intelligence without creating another silo?
A: Banks should treat device intelligence as a shared decision layer, not a stand-alone fraud tool. The signals need to feed onboarding, authentication, investigations, and compliance workflows so the same context supports multiple decisions. If the data cannot be reused across teams, it is adding cost without improving trust decisions.
Q: Why do static MFA and legacy fraud rules fail against AI-driven account takeover attempts?
A: Static controls fail because they assume predictable attack patterns and stable user behavior. AI-generated voices, synthetic identities, and automated scripts can mimic legitimate activity closely enough to pass simple thresholds. Once adversaries can vary inputs at scale, rule-based engines become easy to probe, evade, and tune against. Dynamic risk scoring is more resilient because it weighs multiple signals together.
A: Common signs include too many false positives, repeated fraud losses despite active controls, and weak differentiation between normal users and suspicious traffic. If teams cannot explain why a session was flagged, or if the same risky behaviours repeatedly pass through, the signal strategy is likely too shallow, too noisy, or not tuned to the actual attack patterns.
Q: What is the difference between device intelligence and traditional identity verification?
A: Traditional identity verification focuses on who the user claims to be, while device intelligence focuses on the environment and signals around the session. Device intelligence can identify bot behaviour, headless browsers, incognito use, and spoofed devices. Used together, they give security teams a stronger basis for deciding whether to allow, step up, or block an authentication attempt.
Technical breakdown
Why static identity checks fail against AI-assisted fraud
Static checks assume a user presents consistent evidence that can be evaluated once and trusted for the rest of the session. In modern banking fraud, attackers can use synthetic identities, emulators, VPNs, browser tampering, and device spoofing to bypass those checks while still appearing legitimate at the moment of verification. That makes the control problem dynamic rather than point-in-time. The article's core mechanism is persistent device context: repeated signals from the same visitor help separate normal customer behaviour from rapidly changing attacker infrastructure. Practical implication: fraud programmes need signals that can be scored continuously, not just at login or account creation.
Practical implication: Move fraud decisions from one-time verification to continuous signal scoring across the session.
How device intelligence supports risk-based authentication and step-up decisions
Device intelligence is not a replacement for authentication. It is an input to risk decisions that determine when extra friction is justified. A persistent visitor ID, plus signals such as bot activity, VPN use, browser tampering, unusual geography, or device mismatch, gives fraud teams evidence to trigger step-up authentication only when the transaction or session becomes suspicious. That matters because over-triggering step-up controls increases abandonment, while under-triggering leaves takeover attempts untouched. In practical terms, this is an access decision problem, not just a detection problem. Practical implication: calibrate step-up logic to device risk signals rather than broad customer segments.
Practical implication: Tune step-up authentication to specific device and session risk indicators, not broad user groups.
Why machine learning models need live device data
Fraud models degrade when they are trained on stale or overly abstracted features. The article argues that each login, transaction, or account-creation event can feed self-supervised, supervised, and unsupervised models with real-world device data, helping them adapt to new attack patterns faster. That reduces dependence on fixed decision rules, which are easy for fraud rings to learn and evade. The deeper point is operational: model quality depends on the freshness and fidelity of the signal stream. Practical implication: fraud teams should treat device telemetry as a model-input asset and review retraining cadence alongside detection performance.
Practical implication: Feed fraud models with current device telemetry and retrain often enough to outpace attacker adaptation.
Breaches seen in the wild
- Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Adaptive device context is now a fraud governance requirement, not a nice-to-have signal. Banks are being forced to replace static trust assumptions with evidence that changes as the session changes. When attackers can rotate devices, networks, and browser attributes on demand, point-in-time checks become easy to game and hard to govern. The programme implication is clear: fraud controls now need to evaluate trust as a moving state, not a fixed attribute.
Persistent visitor identification creates a more useful control boundary than cookie-based recognition. Cookies can be cleared, but device-level context can still expose spoofing, emulation, and tampering patterns. That makes the control boundary more resilient to attacker tradecraft and more useful for step-up decisions, KYC workflows, and account takeover prevention. The practitioner takeaway is to anchor fraud policy on repeatable device context, not on assumptions about browser persistence.
Device intelligence closes the gap between fraud prevention and customer experience. The strongest fraud programmes are no longer just stricter, they are more discriminating. By using device and behavioural context to narrow false positives, banks can reserve friction for higher-risk interactions and avoid punishing legitimate customers. That is increasingly important in digitally native banking, where bad risk decisions become both a security issue and a retention problem.
AI-driven fraud is accelerating the convergence of fraud operations, identity governance, and compliance monitoring. KYC, AML, account takeover prevention, and user experience are now linked by the same decisioning layer. A bank that treats them as separate workflows will keep duplicating controls and missing cross-signal patterns. The field is moving toward one adaptive risk fabric, and practitioners should design their governance model around shared signals rather than isolated control owners.
From our research library:
- U.S. fraud losses are projected to reach $40 billion by 2027.
What this signals
Device intelligence is becoming a governance control, not just a fraud feature. As banks push more decisions into online channels, the question shifts from whether a user can authenticate to whether the session is trustworthy enough to continue. That makes device signals part of the broader identity decision fabric across onboarding, login, and transaction review.
Fraud teams should expect more value from layered signals than from any single detector. Bot detection, tamper detection, VPN detection, and behavioural context work best when they inform one risk decision rather than separate silos. The practical challenge is less about adding more sensors and more about ensuring they influence one consistent policy engine.
For practitioners
- Instrument device-level risk signals Capture persistent visitor identifiers, device tampering indicators, VPN usage, browser anomalies, and geolocation mismatches as part of each authentication and transaction decision.
- Re-tune step-up thresholds Use device and behavioural context to decide when to add friction, so legitimate users are not forced through unnecessary verification while suspicious sessions are challenged.
- Feed telemetry into model retraining Treat login, onboarding, and transaction telemetry as model input so supervised and unsupervised fraud models adapt to emerging attack patterns faster.
- Align fraud signals with KYC and AML reviews Use the same device anomalies, such as emulators, rooted devices, and unusual velocity patterns, to support onboarding checks and ongoing monitoring.
Key takeaways
- Device intelligence helps banks respond to AI-assisted fraud by adding persistent context that static checks cannot provide.
- The operational value is strongest when device signals inform step-up decisions, model retraining, and KYC or AML workflows together.
- Fraud prevention is shifting toward adaptive risk scoring, where customer experience and security are governed by the same telemetry.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 and MITRE ATT&CK address the attack surface, NIST CSF 2.0 sets the technical controls, and GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP API Security Top 10 | API2 — Broken Authentication | Fraud control depends on rejecting spoofed or manipulated session trust. |
| Recommendation — Apply API2 controls to harden authentication decisions against spoofed device and session signals. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Risk-based access decisions are central to step-up and session challenge logic. |
| Recommendation — Use PR.AA-05 to align access challenges with observed device risk and session context. | ||
| MITRE ATT&CK | TA0006;TA0011 — Credential Access; Command and Control | AI-assisted fraud relies on credential theft and remote control patterns. |
| Recommendation — Map fraud telemetry to TA0006 and TA0011 to detect credential abuse and attacker infrastructure. | ||
| GDPR | Art.32 — Security of Processing | Device intelligence processes personal data in regulated banking workflows. |
| Recommendation — Apply Art.32 to ensure fraud telemetry is proportionate, protected, and justified in processing. | ||
Key terms
- Device Intelligence: Device intelligence is the practice of interpreting signals from a device to assess whether a session or transaction is likely legitimate. It goes beyond fingerprinting by combining device context with behavioural, identity, and payment evidence to support a risk decision.
- Persistent Visitor ID: A persistent visitor ID is a stable identifier generated from combined telemetry so a returning device or browser can be recognised across sessions. It is useful when cookies are cleared or networks change, but it must be treated as one risk input, not as proof of identity.
- Step-up Authentication: Step-up authentication is an additional verification step triggered when a session becomes higher risk or a user attempts a sensitive action. It is used to reduce exposure without forcing extra friction across every interaction, which makes it useful for runtime access governance.
- Synthetic Identity Document Fraud: Synthetic identity document fraud is the use of fabricated or AI-generated identity documents to impersonate a real or invented person. It targets verification workflows by presenting fake passports, driver’s licences, or IDs that can look credible enough to pass basic checks unless teams use stronger authenticity and anomaly detection controls.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 11, 2026.
Updated on October 10, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org