TL;DR: Across 3,000 years of fraud, the tactics change from counterfeit coins and false weights to deepfakes and fraud-as-a-service, but the psychological levers stay the same: trust, fear, greed, urgency, and authority, according to Sumsub. The history matters because modern deception now scales faster than human verification cycles can keep up.
At a glance
What this is: This is a historical analysis of fraud that argues the methods keep changing while the underlying manipulation patterns stay the same.
Why it matters: It matters because identity, fraud, IAM, and security teams still have to defend against the same trust exploitation patterns, now amplified by AI-generated deception and faster social engineering.
Context
Fraud is a governance problem as much as a technical one: deception succeeds when organisations accept familiar signals without independent verification. The article argues that the medium changes, but the underlying manipulation of trust, authority, urgency and greed remains stable across eras.
For identity practitioners, the relevance is direct even though the article is not an IAM how-to. Fraud increasingly intersects with authentication, social engineering, identity verification and approval workflows, which means controls must assume that appearance and urgency can both be fabricated.
Key questions
Q: How should security teams verify high-risk requests when impersonation is convincing?
A: Use a verification path that cannot be satisfied by the same channel used to make the request. For payments, account changes, or privileged actions, require out-of-band confirmation, pre-agreed callback steps, or dual approval from independent people. The goal is to break the attacker's ability to control both the message and the confirmation path.
Q: Why do AI-generated scams still succeed even when users know about phishing?
A: Because awareness alone does not stop pressure, familiarity, and speed from shaping decisions. AI makes it cheaper to copy a trusted voice, face, or message, while urgent framing shortens the time available to check. The result is not better persuasion in the abstract, but faster and more convincing manipulation of normal business behaviour.
Q: What breaks when organisations let urgency override normal approval steps?
A: The control that breaks is the pause between request and action. Once teams accept urgency as a reason to skip verification, they remove the only window in which deception can be challenged. That is why fraud often succeeds at the moment of exception handling, not during routine operations.
Q: What is the difference between identity verification and transaction approval?
A: Identity verification answers who or what appears to be asking. Transaction approval answers whether the action should happen. Fraud often works when organisations collapse those two steps into one, allowing a convincing identity signal to trigger an irreversible business outcome without separate control over the decision itself.
Technical breakdown
Why fraud scales when verification lags
Fraud becomes more effective when the attacker can outpace the victim's ability to verify claims. Historically that meant distance, slow communication and information asymmetry; today it includes synthetic media, cross-channel impersonation and low-cost automation. The technical constant is not the channel but the trust gap between what is presented and what can be independently confirmed. That is why fraud often succeeds even when the story is implausible: the check comes too late, or not at all.
Practical implication: build verification steps that do not depend on the same channel used to deliver the request.
Deepfakes and fraud-as-a-service change reach, not intent
The article's modern cases show that AI does not invent a new fraud model, it industrialises an old one. Deepfakes, voice cloning and ready-made fraud kits compress the cost of impersonation and let criminals reuse the same psychological scripts at scale. That matters because the threat is no longer just a skilled operator, but a commoditised workflow that lowers the bar for repetition, variation and localisation. The defender now faces volume as well as believability.
Practical implication: treat AI-generated impersonation as a scale problem and harden approval paths accordingly.
Authority cues are now part of the attack surface
The article repeatedly shows that fraud works when a message appears to come from someone trusted, powerful or familiar. In identity terms, that means title, voice, face, channel and context can all be copied well enough to trigger action before scrutiny. This is why authentication alone is not sufficient if downstream business processes trust what authentication appears to prove. Fraud is increasingly a workflow compromise that starts with identity simulation and ends with irreversible action.
Practical implication: separate identity verification from high-risk transaction approval so a convincing prompt cannot complete the workflow on its own.
Threat narrative
Attacker objective: The objective is to convert fabricated trust into a real financial transfer, credential handover or other irreversible action.
- Entry begins with a fabricated identity or plausible pretext that reaches the target through email, phone, video call or messaging.
- The attacker leverages urgency, authority or social proof to suppress scrutiny and gain trust before independent verification occurs.
- Impact follows when the victim authorises a transfer, shares access, or accepts a false narrative as operational truth.
Breaches seen in the wild
- Arup deepfake fraud 2024: Deepfakes of Arup's CFO and colleagues on a video call led a Hong Kong employee to transfer HK$200 million (about US$25.6m) to fraudsters.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Fraud is fundamentally a trust-control failure, not a novelty problem. The article shows that the tactics change, but the operating principle does not: attackers get people to act before they verify. That makes fraud a governance issue for identity, approvals and transaction controls, not just a training issue. Organisations that treat each new scam as a separate threat miss the stable pattern that binds them together. The implication is that trust must be designed as a control surface, not assumed as an input.
Deepfakes turn identity assurance into a layered challenge. A convincing face, voice or message can now satisfy the first human check while still being false. That means the control problem moves from simple recognition to corroboration across channels, context and business rules. When a single signal can be simulated cheaply, identity assurance has to rely on independence between evidence sources. Practitioners should rethink any workflow where one authentic-looking interaction can trigger irreversible action.
Urgency is the fraud multiplier: the article is right to frame speed as part of the attack, because compressed decision time removes the victim's chance to compare signals. Fraudulent requests are often engineered to feel routine, familiar and time-sensitive at once. That combination defeats both technical controls and human judgment when organisations have no enforced pause in the process. The lesson for security teams is to treat rushed decisions as a security event in their own right.
Fraud-as-a-service is the industrialisation of deception. Once impersonation becomes a subscription market, the defender no longer faces isolated criminals but repeatable playbooks with support, pricing and scale. That shifts the problem from detection of a single bad actor to suppression of a reusable fraud supply chain. For practitioners, the strategic response is to assume adversaries can buy capability rather than build it. Security programmes should plan for commoditised deception, not bespoke artistry.
What this signals
Fraud history is now operationally relevant to security teams. The article's value is that it shows how today's scams inherit the same mechanics as older confidence tricks, even when the delivery vehicle is a deepfake or a synthetic voice. Teams that map fraud only to current tooling will miss the stable behaviours that make the attack work.
AI has lowered the cost of believable deception. That does not mean every interaction is suspicious, but it does mean the threshold for trust must rise when a request is unusual, urgent or financially material. Programmes that still rely on a single sign of authenticity are overexposed to simulation at scale.
For practitioners
- Introduce independent verification for high-risk requests Require callback, out-of-band confirmation or a second trusted channel before approving payments, credential changes or exception requests.
- Add friction to urgent approvals Force a pause or secondary review when a request arrives with urgency, secrecy or pressure to bypass normal process.
- Separate identity proof from transaction approval Do not let a single convincing message or video interaction both establish legitimacy and authorise an irreversible action.
- Train teams on deepfake and impersonation cues Use examples from voice cloning, video impersonation and synthetic messages so staff can recognise how authority and familiarity are being simulated.
Key takeaways
- Fraud keeps succeeding because it exploits stable human and organisational behaviours, not because attackers keep inventing entirely new psychology.
- Deepfakes and fraud-as-a-service make deception cheaper, faster and easier to repeat, which raises the risk for approval workflows and identity checks.
- Security teams need separate verification from action so a convincing message, voice or video call cannot complete an irreversible request on its own.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-10 — Human Use of NHI | Fraud now exploits human trust in identity signals, including simulated people and channels. |
| Recommendation — Treat identity-simulation attacks as misuse of trust boundaries and validate actions through independent channels. | ||
| OWASP Agentic AI Top 10 | ASI09 — Human-Agent Trust Exploitation | AI-generated impersonation is a trust exploitation pattern that borrows authority to trigger action. |
| Recommendation — Design approval workflows so a convincing interaction cannot by itself authorise high-risk actions. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Fraud prevention depends on separating who appears legitimate from who is authorised to act. |
| Recommendation — Enforce separate authorisation checks for high-risk actions instead of relying on identity presentation alone. | ||
| MITRE ATT&CK | TA0001;TA0006 — Initial Access; Credential Access | Fraud cases frequently begin with deception and can end in credential or payment compromise. |
| Recommendation — Map impersonation and credential-theft scenarios to initial access and credential access detection patterns. | ||
Key terms
- Deepfake-based impersonation: A fraud technique that uses synthetic audio, video, or both to make an attacker appear to be a trusted person during a live interaction. The tactic exploits human trust in familiar cues and often aims to trigger urgent actions such as payments, resets, or access changes before verification is challenged.
- Fraud-As-A-Service: Fraud-as-a-service is the outsourcing of scam operations through rented tools, stolen data, and ready-made attack services. It lowers the skill needed to commit fraud and lets bad actors scale quickly across industries. For defenders, it means attacks are faster, cheaper, and more operationally organized than traditional one-off fraud attempts.
- Verification Window: The time and process gap between a request being made and its legitimacy being independently confirmed. When that window is short, pressured, or missing, fraud becomes easier because the attacker can push the target to act before scrutiny happens.
- Identity Simulation: The use of copied names, titles, voices, faces, or channels to appear legitimate without actually being who the interaction claims. It matters because many approval workflows still treat appearance as proof, even when the underlying identity has not been independently established.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on June 20, 2026.
Updated on October 10, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org