AI-enabled fraud is a permanent operating risk, not an anomaly

At a glance

What this is: SEON argues that AI has accelerated existing fraud dynamics by making identity abuse, synthetic personas and social engineering cheaper and easier to scale, not by creating an entirely new problem.

Why it matters: This matters because fraud controls, identity verification and access governance now have to operate earlier in the customer journey and closer to first-party signals, or they will keep reacting after the loss has already occurred.

By the numbers:

• The Association of Certified Fraud Examiners has measured organizational fraud losses across 13 editions and more than 20,000 investigated cases, with the figure staying at approximately 5% of revenue every year.
• The FBI’s Internet Crime Complaint Center logged $16.6 billion in reported losses in 2024, a 33% increase from the prior year.
• The financial industry detects approximately 2% of global financial crime flows despite increasing compliance spending by up to 10% a year.
• A $20-a-month subscription can generate synthetic identities at scale, clone voices from minutes of audio and forge identity documents that pass automated verification.

Context

Fraud becomes harder to contain when economic pressure, new infrastructure and low-cost tooling converge. The article frames that pattern as a repeating feature of market economies rather than a temporary surge, which is why a purely reactive control model keeps failing. That matters for identity governance because fraud increasingly sits at the boundary between verification, authentication and account abuse, not just in the transaction layer.

AI has changed the cost structure of fraud more than the nature of fraud itself. Synthetic identities, voice cloning, document forgery and fluent phishing all reduce the skill barrier that once limited advanced fraud to organised groups. That pushes institutions to treat identity proofing, customer risk scoring and fraud monitoring as a single governance problem, not separate operational teams.

Key questions

Q: How should organisations design fraud controls when AI makes identity abuse cheaper to scale?

A: They should move from isolated checkpoints to a lifecycle model that combines proofing, device intelligence, behavioural signals and recovery controls. AI lowers the cost of creating convincing false identities, so the response has to focus on how trust is established and maintained, not just on blocking one fraudulent event. Shared ownership between fraud, AML and IAM is essential.

Q: Why do fraud controls keep pushing attackers into new channels?

A: Because fraud is adaptive. When one control closes a path, attackers shift to the next best economic route, whether that is card-not-present abuse, social engineering or account recovery fraud. Teams that only measure what they catch miss the migration effect. The right response is to govern the whole trust surface, not a single channel.

Q: What signs show that identity proofing is no longer enough on its own?

A: High-confidence documents that still lead to downstream abuse, repeated recovery fraud, and mismatches between proofing results and later behavioural patterns are all signs. If identity checks look strong at onboarding but do not hold during account use, the problem is not the document check alone. It is the absence of continuous trust validation across the lifecycle.

Q: Should fraud teams and IAM teams be run separately or together?

A: Together, where possible. Separate teams often create gaps between proofing, authentication, recovery and transaction monitoring, which attackers exploit. A combined model does not mean one team owns everything, but it does mean the organisation treats identity confidence, behavioural risk and financial loss as linked decisions rather than unrelated workflows.

Technical breakdown

Why fraud shifts channels when one control closes

Fraud is adaptive economics, not a fixed attack pattern. When a control blocks one route, attackers move to the channel with the best return and the least friction. The historical examples in the article show the same mechanism across eras: stronger card controls pushed fraud toward card-not-present activity, and two-factor authentication shifted some abuse toward SIM swapping and call-centre social engineering. For identity teams, the technical lesson is that isolated controls do not end fraud pressure. They relocate it. A control that only measures caught fraud will miss the migration into adjacent account-opening, recovery and trust-verification workflows. See the [Fraud Prevention Guide for Digital Businesses]. Read Fraud Prevention Guide for Digital Businesses.

Practical implication: Map fraud controls to the full customer journey, not just the transaction point.

How AI compresses the fraud skill barrier

AI reduces the cost of producing convincing fraudulent artefacts. With widely available tools, an attacker can create synthetic identities, generate multilingual phishing, clone a voice from short audio samples and forge documents that satisfy some automated checks. The important mechanism is scale plus plausibility: more attempts, more variation and less manual effort per attempt. That undermines controls that assume sophistication is rare or expensive. It also weakens the protective value of document-only or voice-only checks when those signals are not tied to stronger behavioural and device context. Identity proofing now has to assume that authenticity claims can be manufactured on demand, not just manually counterfeit. See the Identity Proofing and KYC Guide.

Practical implication: Add behavioural and device context to identity proofing, not just document and liveness checks.

Why first-party data matters more than retrospective review

The article’s core architectural point is that the strongest anti-fraud signals come before the transaction is complete. First-party behavioural, device and identity data captured at the first customer touchpoint is harder for an attacker to mimic consistently than a single document or credential. That shifts detection earlier in the lifecycle and lowers dependence on manual review after loss indicators appear. In governance terms, this is where IAM, fraud and AML begin to overlap: identity confidence, account trust and anomalous access patterns all inform the same decision. If teams only analyse completed transactions, they are already downstream of the most defensible intervention point. See the Identity Fraud Prevention Guide.

Practical implication: Move fraud scoring into onboarding and session establishment, where trust can still be shaped.

Threat narrative

Attacker objective: The objective is to obtain money, accounts or verified trust at scale while keeping the activity cheap enough to repeat.

1. Entry begins with AI-assisted identity fabrication, phishing or synthetic persona creation that lowers the cost of getting a foothold in onboarding or recovery flows.
2. Credentialed trust is then abused through liveness bypass, call-centre manipulation or recovery fraud, allowing the attacker to appear legitimate inside verification workflows.
3. The attacker scales the abuse through account opening, payment fraud, mule activity or unauthorised transfers, turning low-friction deception into measurable loss.

NHI Mgmt Group analysis

Fraud should be governed as a permanent operating condition, not a discrete incident class. The article is right to reject the idea that fraud can be eradicated by a single control wave. Once organisations accept that losses recur as a structural feature of the market, they design differently: earlier signal capture, stronger orchestration between verification and access, and fewer assumptions that any one check will hold indefinitely. The practitioner implication is to budget for continuous adaptation, not periodic remediation.

AI has created a verification trust gap, not just more fraud volume. The real problem is that several long-standing identity assurances now fail at lower cost and higher speed than before. When synthetic identities and forged artefacts become easy to generate, the question changes from whether a document looks real to whether the surrounding behavioural and device context can sustain the claim. Practitioners should treat this as a governance gap between proofing and ongoing trust, not as a point-solution failure. See identity proofing and KYC.

Fraud and AML separation is now a control weakness, not an organisational convenience. The article’s strongest operational point is that fraud and AML teams often see the same abuse from different angles but act through different systems. That leaves attackers exploiting the seam between onboarding, transaction monitoring and account recovery. A combined operating view improves decision quality because it links identity confidence, behavioural anomalies and financial crime patterns before loss becomes visible. The practitioner conclusion is to remove the seam, not merely improve each side of it.

The named concept here is fraud infrastructureisation: fraud has become a low-cost, scalable operating layer that adapts as controls change. That matters because institutions keep responding as if each wave is a separate event, when the economics are increasingly continuous. The result is a permanent contest between control design and attacker return on effort. Practitioners should build governance around resilience to repeated adaptation, not around the hope of a final fix.

Identity governance has to move upstream into the customer lifecycle. The article shows that the earliest signals, not the final transaction, are where defensible decisions are made. That is especially true where machine-generated content can impersonate legitimate users, documents and voices. The implication is that identity, fraud and access programmes need shared signals and shared accountability for trust decisions.

From our research library:

• Nearly 60% of companies reported that fraud losses were still increasing in 2025.

What this signals

Fraud infrastructureisation: the useful concept here is that fraud now behaves like a scalable service layer that expands or contracts as controls move. That makes governance harder because the threat does not disappear when one route is blocked; it reappears where the control surface is weakest.

The practical consequence for programmes is that KYC, account recovery, transaction monitoring and access governance need shared signal design. If those functions remain separated, attackers will keep using the seams between them to convert cheap synthetic trust into loss.

For practitioners

• Build a shared fraud and identity operating model Align fraud, AML, KYC and IAM teams around a single view of customer trust, so onboarding, recovery and transaction monitoring use the same risk signals.
• Shift controls to the first customer touchpoint Capture device, email, phone and behavioural signals before the identity document is submitted or the transaction is initiated, because that is where the most effective intervention begins.
• Measure false positives as revenue loss Track legitimate declines as a financial metric, not just an operations issue, so friction is evaluated against conversion and retention instead of only against blocked fraud.
• Assume proofing artefacts can be generated at scale Review KYC and liveness workflows for places where AI-generated documents, voices or faces can satisfy a check without proving durable identity confidence.

Key takeaways

• Fraud is best understood as a persistent operating condition, because the article shows that controls change the route of abuse more often than they eliminate it.
• The scale signals are stark, with the article citing roughly 5% of revenue in organisational losses, $16.6 billion in reported FBI IC3 losses in 2024 and only about 2% of global financial crime flows detected.
• The most effective response is to move identity and fraud decisions earlier, combine fraud and AML with IAM signals, and treat first-party behavioural data as a core control input.

Related NHI Mgmt Group resources: Identity Fraud Prevention Guide · Identity Proofing and KYC Guide · Fraud Prevention Guide for Digital Businesses · Account Takeover Prevention Guide

Key terms

• Fraud Infrastructure: Fraud infrastructure is the technical stack that makes a scam appear legitimate enough to steal money, including websites, domains, hosting, payment rails, and operational tooling. In crypto-enabled fraud, this layer matters because it allows operators to scale quickly, rotate assets, and keep victim-facing services online despite enforcement or takedown actions.
• Activation Trust Gap: The activation trust gap is the difference between trusting data because it is protected and governing it because it is being reused. It appears when organisations move data from backup or archival systems into AI pipelines without reapplying access, sensitivity, and consumer controls.
• First-party Risk Signals: Behavioural, device and identity signals generated directly by an organisation’s own customer interactions. They are harder for attackers to fake at scale than isolated documents or credentials, which makes them a stronger foundation for early fraud detection and trust scoring.
• Recovery Abuse: Recovery abuse is the use of password reset, fallback verification, or support escalation paths to take over an account after the primary login is defended. It matters because many programmes harden the front door while leaving the back door easier to open under social engineering or session manipulation.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is suitable for practitioners who need to connect identity governance to fraud, access and lifecycle decisions.