A 'Productivity' folder containing Artificial Intelligence applications. EPA/ADAM VAUGHANArtificial intelligence (“AI”) has become one of the most transformative forces in modern commerce, governance, and technology. Yet its rapid proliferation has introduced a disquieting paradox: the same capabilities that empower organisations to streamline operations, enhance decision-making, and protect their stakeholders are simultaneously being weaponised by criminals to perpetrate fraud at unprecedented scale and with a greater degree of sophistication. According to industry estimates, global fraud losses now exceed $5 trillion annually – a figure that has grown by double digits year on year as AI-powered schemes proliferate. For risk management, auditing, and advisory professionals, understanding this dual nature of AI is no longer a matter of intellectual curiosity – it is a strategic imperative that can determine whether an organisation weathers the next major fraud event or becomes a cautionary tale.
The threat landscape is evolving at pace. Global fraud losses continue to climb, and the methods employed by bad actors are growing more inventive with every passing quarter. At the same time, corporations, financial institutions, and technology providers are deploying AI-driven defences that would have been unimaginable a decade ago. This article examines both sides of the equation and considers what the ongoing AI arms race means for corporate resilience and the professionals charged with safeguarding it.
How fraudsters are exploiting AI
The barrier to entry for sophisticated fraud has fallen dramatically. Generative AI tools – many of them freely available or sold on dark-web marketplaces – have given criminals access to capabilities that once required deep technical expertise. The result is a new generation of fraud that is harder to detect, faster to execute, and more convincing than anything that preceded it.
Deepfake technology represents one of the most visible threats. A deepfake is used to replicate a person’s voice, image, and likeness. Audio and video deepfakes are now being used to impersonate senior executives, instruct fraudulent wire transfers, and bypass voice-based authentication systems. In several high-profile cases, finance teams have been deceived into authorising payments running into millions of pounds after receiving what appeared to be video calls from their own chief executives. The realism of these fabrications continues to improve, and the cost of producing them continues to fall.
In early 2024, a Hong Kong-based multinational lost approximately $25 million after finance staff were deceived by a deepfake video call purportedly involving the company’s chief financial officer. Cases such as this demonstrate that deep fake fraud is no longer theoretical - it is an operational reality demanding board-level attention.
Synthetic identity fraud is another area where AI has proved effective. By combining fragments of real personal data harvested from breaches, social media, and public records with AI-generated attributes, criminals can fabricate entirely fictitious identities that pass traditional verification checks. These synthetic identities are used to open accounts, secure credit, and launder proceeds, often remaining undetected for months or even years before losses crystallise.
Automated phishing campaigns, powered by large language models, have rendered older, template-based attacks obsolete. AI-generated phishing emails are contextually tailored, linguistically fluent, and free of the grammatical errors that once served as red flags. Some campaigns now incorporate real-time personalisation, drawing on publicly available information to craft messages that are almost indistinguishable from legitimate corporate correspondence.
Beyond phishing, generative AI is being used to fabricate invoices, contracts, and other supporting documentation at scale. For internal auditors and assurance professionals, this raises the stakes of document verification – traditional sample-based testing may no longer be sufficient when AI-generated forgeries can be produced in volume and tailored to evade routine checks.
Perhaps most concerning for those responsible for fraud detection systems is the emergence of adversarial AI techniques specifically designed to evade machine-learning models. Fraudsters are probing the algorithms used by banks and payment networks, testing inputs to identify blind spots, and then exploiting those vulnerabilities at scale. For example, criminals may subtly manipulate transaction metadata by altering timestamps, merchant category codes, or device identifiers to slip past anomaly-detection models trained on historical patterns. This cat-and-mouse dynamic means that static defences, however sophisticated at the point of deployment, can rapidly become obsolete.
How corporations are fighting back with AI
If AI has given fraudsters new weapons, it has also provided defenders with a formidable arsenal. Across the financial services sector and beyond, organisations are investing heavily in AI-powered tools that can detect threats earlier, correlate disparate signals, and respond in real time. The shift from reactive fraud investigation to proactive threat intelligence represents a fundamental change in how risk is managed.
At a technical level, AI-powered fraud defences typically combine several approaches – anomaly-detection algorithms that flag transactions deviating from established patterns; behavioural biometrics that verify users by how they type, swipe, or hold their devices; and network-graph analytics that map relationships among accounts to surface collusion or money-laundering rings. Each technique has strengths and limitations, and best-practice implementations layer multiple methods to reduce false positives while catching genuine threats.
A compelling illustration of this trend is Visa’s launch of the Visa Threat Intelligence Platform (“VTIP”), announced in July 2026. VTIP is designed to help financial institutions detect and respond to cyber threats that can lead to fraud and financial loss, leveraging the same cybersecurity capabilities that Visa uses to protect its own global network. The platform reflects a critical insight now gaining wider acceptance -that fraud is frequently a downstream outcome of earlier cyber incidents, often beginning with data compromise, credential theft, or system exploitation well before a fraudulent transaction is ever initiated.
The scale of Visa’s defensive operations underscores the magnitude of the challenge. The company blocks approximately 90 million cyberattacks and 11 million phishing emails each month across more than 200 countries. VTIP was developed by Visa’s defence operations team and production-tested internally across the firm’s global payments network before being extended to clients – a rigorous validation process that lends credibility to its real-world effectiveness.
VTIP’s capabilities span 5 integrated intelligence domains. Threat Intelligence delivers malware-based indicators of compromise tailored to the financial sector. Vulnerability Intelligence highlights exploits and exposures relevant to each organisation. Brand Intelligence helps detect and mitigate impersonation and brand abuse. Digital Identity Intelligence monitors and protects executives and employees from personal targeting – a growing concern as social engineering attacks become more refined. Financial Intelligence surfaces compromised payment credentials from the dark web and enriches them with insights drawn from VisaNet, transforming raw data into actionable intelligence for fraud and risk teams.
The platform’s early adoption is noteworthy. Abu Dhabi Islamic Bank (“ADIB”) became the first bank globally to deploy VTIP as part of its fraud prevention strategy, with Amit Malhotra, ADIB’s Global Head of Retail Banking, noting that the deployment “reflects our commitment to delivering a secure and trusted banking experience for our customers.” This kind of early-mover commitment from a major institution signals the direction of travel for the industry as a whole.
Visa’s broader investment posture reinforces the point. The company has invested over USD13 billion in technology over the past five years, including measures to reduce fraud and increase network security. Gartner Consulting awarded Visa its highest rating of 4.9 among peer companies for overall maturity of its cybersecurity programme. As Walter Lironi, Visa’s Senior Vice President and Head of Value-Added Services for CEMEA, observed: “Cyberattacks are becoming more frequent, more targeted, and more difficult for organisations to detect early. Too often, fraud is the result.”
Beyond individual platforms, collaborative initiatives are gaining traction. In the United Kingdom, the Economic Crime Committee of the UK Finance trade body has piloted secure data-sharing arrangements among member banks, enabling machine-learning models to be trained on pooled fraud signals while preserving customer privacy. Such industry-level co-operation may prove essential in an environment where fraudsters operate without jurisdictional or institutional boundaries.
Importantly, the deployment of AI in fraud detection raises its own governance questions. Regulators and auditors increasingly expect that AI-driven decisions be transparent, explainable, auditable, and free from discriminatory bias. Organisations deploying these tools must therefore invest not only in technology but also in responsible AI governance frameworks, model-risk management frameworks, documentation, and independent validation of AI systems.
What this means for risk management and corporate resilience
The dual use of AI in fraud carries profound implications for risk professionals, boards, and advisory firms. First, the traditional separation between cybersecurity and fraud prevention is no longer tenable. As the Visa example illustrates, organisations that treat cyber threats and fraud as distinct silos will find themselves perpetually on the back foot. Integrated threat intelligence connecting upstream cyber events with downstream fraud outcomes is rapidly becoming the standard of care.
Regulatory expectations are reinforcing this shift. In the United Kingdom, new rules effective from October 2024 require payment-service providers to reimburse victims of authorised push-payment fraud, placing a direct financial incentive on banks to prevent fraud upstream. In South Africa, the Conduct of Financial Institutions Act (COFI) will impose heightened duties on financial-services providers to treat customers fairly – duties that will inevitably encompass robust fraud prevention. The European Union’s Digital Operational Resilience Act (“DORA”) similarly mandates that financial entities maintain comprehensive ICT risk-management frameworks, including for AI-enabled threats. Risk professionals who anticipate these requirements will help their organisations stay ahead of compliance curves while protecting customers.
Second, the pace of AI-driven innovation demands a continuous reassessment of control frameworks. Internal auditors and risk committees can no longer rely on annual reviews of fraud controls; the threat environment is simply too dynamic. Real-time monitoring, scenario-based stress testing, and investment in AI-literate talent are all essential components of a resilient posture.
Boards and audit committees have a particular responsibility in this environment. Directors should ensure that management reports regularly on AI-related fraud risk, that control frameworks are stress-tested against emerging threat scenarios, and that investment in defensive technology is commensurate with the organisation’s risk appetite. Given the pace of change, static annual assurance cycles may no longer suffice; many organisations are moving towards continuous assurance models that provide near-real-time visibility into control effectiveness.
Third, advisory firms have a vital role to play in helping clients navigate this landscape. Many organisations, particularly those outside the financial sector or in the mid-market, lack the resources or expertise to deploy AI-powered defences independently. Consulting and advisory professionals can add significant value by assessing clients’ exposure to AI-enabled fraud, benchmarking their defences against emerging best practice, and guiding them towards the intelligence platforms and partnerships that best suit their risk profile. In practice, AI literacy for risk professionals encompasses data-science fluency (understanding how models are trained and validated), prompt-engineering awareness (recognising how generative AI can be misused), and vendor-due-diligence expertise (evaluating the robustness of third-party AI tools). Building this capability may require targeted hiring, upskilling programmes, and cross-functional collaboration with technology teams.
The AI arms race between fraudsters and defenders will only intensify. Organisations that invest in proactive, intelligence-led strategies and that recognise the inseparability of cyber risk and fraud risk will be best positioned to protect their customers, their reputations, and their bottom lines. For the risk management community, the message is clear - the time to act is not tomorrow, but today. Looking ahead, the next frontier may involve autonomous AI agents capable of orchestrating fraud campaigns with minimal human intervention - a prospect that underscores the need for equally autonomous, adaptive defences. Those who begin building those capabilities now will define the standard of care for the decade to come. DM