Fraud has shifted to identity attacks

Criminals now impersonate legitimate customers using synthetic identities, deepfakes and AI-assisted social engineering. The challenge is no longer detecting suspicious transactions but distinguishing real customers from convincing impostors.

AI is scaling fraud at unprecedented speed

A 2026 Bankrate survey found 40% of adults encountered financial scams in the past 12 months, up from 34% a year earlier. UK Finance reported scam attempts surged 62% across 100 million accounts in 2025.

“Fraudsters are getting more sophisticated, thanks to artificial intelligence, and they're reaching more people than ever.”

Phishing and social engineering exploded

UK Finance found phishing attempts skyrocketed 140% in 2025. Criminals are using AI to personalize, automate and scale social engineering and identity-based attacks across channels.

Unauthorized-party fraud now dominates

Unauthorized-party schemes accounted for 71% of total fraud incidents and dollar losses in 2025, up from 48% the prior year. Credential theft and account takeover have become major threats.

Authorized push payment fraud exploits trust

Criminals persuade victims to authorize fraudulent payments themselves. UK Finance reported 248,070 confirmed APP fraud cases in 2025, with losses climbing 19% to £576.4 million.

Synthetic identity fraud is especially dangerous

Criminals combine legitimate and fabricated personal information to create identities that appear credible during traditional verification. These identities can remain undetected until used for fraud.

Card-not-present fraud masks identity attacks

CNP fraud cases rose 13% in 2025, with losses up 3% to £423.5 million. Criminals use social engineering to obtain one-time passcodes and bypass authentication, revealing that even traditional fraud categories now involve identity attacks.

Voice authentication has already failed

AI can now simulate voice, video and behavioral biometrics convincingly. Tim Joslyn, CTO of Paymentology, said voice authentication is already compromised and banks relying on it are exposed.

“I think voice has already failed. If you're a bank and you're aligned on voice, then potentially you're already in trouble.”

Deepfakes defeat visual authentication

Selfies and video checks are becoming unreliable as AI improves. Techniques like holding up today's newspaper or time-stamping video can now be easily faked.

“Even with holding up a copy of today's newspaper or time-stamping a video, all of this now can be easily faked.”

Behavioral biometrics face a deeper problem

AI systems can now imitate what banks have learned to recognize as normal behavior. A machine can maintain long sessions and type with human-like timing, making it indistinguishable from legitimate users.

“That's where the real fraud starts to come in. Fake-normal behavior worries me the most.”

Patterns reveal what single checks miss

A single interaction may look legitimate, but a pattern repeated across hundreds or thousands of interactions can reveal fraud. Something that looks human but appears a thousand times is probably not human.

“Something might look human, but if you see it a thousand times, it's probably not human.”

Continuous trust replaces binary checks

Instead of determining if a customer is authentic at one moment, banks need to build trust over time. Real-time trust scoring assesses transactions based on accumulated evidence rather than single authentication events.

“Over time, it builds up an authentication profile of you. So, when you make payments, it knows that actually is you because it's building real-time trust scoring.”

Selective friction improves customer experience

Low-risk activity moves through payment with minimal interruption while higher-risk activity triggers additional authentication. This reduces false positives that frustrate legitimate customers.

Fraud damages customer loyalty and brand

Half of financial institutions said fraud damaged customer loyalty, while 44% reported harm to their brands and reputations. One-third reported high false-positive rates that unnecessarily decline legitimate transactions.

Tokenization limits what credentials can do

Payment tokens can carry attributes and restrictions that determine how a credential may be used. A compromised token with defined controls draws strict guardrails around its use, unlike a full card number.

“Using a token is like giving someone a five-dollar bill. Not using tokenization is like giving them your card, your PIN number and access to your entire bank account.”

Scoped tokens enable safe AI agents

Instead of giving AI agents unrestricted access to accounts, banks can use scoped tokens that specify what the agent can purchase, how much it can spend or where it can be used.

Issuers see fraud control as critical for AI

68% of high-customer-lifetime-value card issuers said stronger security and fraud prevention are necessary for agentic commerce. 42% ranked fraud and disputes among their top two operating costs.

Build platforms that adapt to new threats

Modern issuer infrastructure must integrate new fraud capabilities, extend programmable trust through tokenization, and protect customers without sacrificing speed. Platforms need flexibility to adapt as threats change.