Today’s enterprise executives are navigating a complex landscape of AI-driven challenges, but none is more urgent than the rapid escalation of AI-generated fraud.

Fraudsters are weaponizing generative AI to automate impersonation and mass-produce synthetic identities at a scale and pace that is rendering enterprises’ long-standing defenses obsolete. This is no longer a slow-moving game of cat and mouse; it is a high-velocity arms race.

To protect the integrity of their platforms, enterprise leaders — particularly in critical infrastructure sectors — must move beyond periodic risk assessments and begin leveraging a new generation of tools that enable defenses to iterate in days rather than months.

Generative AI as a fraud multiplier

While legitimate businesses use generative AI for efficiency, fraudsters exploit it to scale their attacks. We are witnessing a 100-fold increase in synthetic identities and a sevenfold rise in deepfake-driven impersonations over the past 24 months. Deloitte’s Center for Financial Services predicts AI-enabled fraud losses could reach $40 billion in the U.S. by 2027, up from $12.3 billion in 2023.

This is no longer just a back-office technical issue; it has become a top concern for leadership across banks, fintechs, and telcos. Three-quarters (72%) of business leaders anticipate AI-generated fraud, including deepfakes, will be a top operational challenge in 2026, according to an Experian report. Nearly half (46%) of businesses surveyed by Incode in 2025 reported an annual increase in deepfake and generative AI fraud.

Bad actors can now perpetrate fraud at scale by targeting multiple victims at the same time using the same or fewer resources. Consequently, the stakes have escalated rapidly. Enterprises must now find more effective ways to distinguish between reality and fiction before these attacks compromise trust, revenue, and operational continuity.

The new arms race

Fraud prevention has always been a constant game of leapfrog. Now, however, enterprises must adopt highly advanced defenses as they work to thwart fraudsters who have access to the same AI tools and no legal guardrails.

By some estimates, 80% of fraud is easily detectable, while the remaining 20% requires high-level expertise. That’s where most vendors’ performance fails. Sophisticated fraudsters are not only more capable of impersonating identities but are also increasingly networked, sharing intelligence on how to bypass specific company defenses.

Agility as the primary security metric

In this environment, the “7-Day Benchmark” is essential. A defense model must be able to identify a new attack vector, retrain its data sets, and deploy an updated mitigation model within 7 to 10 days. 

One reason so many organizations remain vulnerable to this new generation of attacks is that they rely on third-party vendors whose update cycles can take months to test and deploy. Modern defense requires an approach like Deepsight: a combination of machine learning, behavior checks, and device checks that identify camera injections and synthetic document fraud and verify that the user is a real person.

Defense checklist: 4 questions for every vendor

To narrow this “velocity gap,” executives need to take a closer look at how well equipped their providers are to address this new generation of threats.  Here are four pointed questions to explore:

1. “How accurate is your facial recognition capability? And what third-party certifications do you hold for mobile environments?” Executives should look for solutions that have been independently validated against the most rigorous international standards for biometric spoof testing—such as iBeta Level 3 compliance on both iOS and Android—that simulate well-resourced attackers using professional-grade, hyper-realistic masks.
   • While many providers struggle with consistency across various devices, a top-tier solution will achieve a 0% error rate. (In a 2024 National Institute for Standards and Technology (NIST) evaluation of 158 different developers, using galleries of mugshot, Visa, and Border images, Incode ranked #1 out of all full solution identity verification providers.) 
   • Also, assess the accuracy and performance of algorithms used in facial analysis across a range of use cases, including age estimation, ensuring the technology is unbiased and highly accurate across diverse user populations. (Once again, Incode scored top marks in NIST’s Face Analysis Technology Evaluation for achieving the lowest error and false-positive rates.)
2. “How do you measure and report your own error rates?” Demand a rigorous, audited approach that provides clear metrics on false positives and false negatives for every session.
3. “Do you own your technology or license it?” This determines the speed of iteration. Updates should happen internally in days, not over months-long development cycles dictated by a third party.
4. “How does your network share intelligence to flag repeat offenders?” Inquire whether the vendor can cross-share biometric, VPN, and network data across their entire client base to proactively block known fraudsters before they hit your system.

(For a more complete guide on selecting an identity verification vendor, we recommend getting a complimentary copy of the Gartner Magic Quadrant for Identity Verification.)

Secure your defenses against AI-enabled fraudsters

The era of treating identity verification as a static compliance checkbox is over. As the internet makes identity spoofing easier than ever before, the burden is on leadership to ensure their defenses can evolve at the speed of the adversary.

Audit your vendor ecosystem today: Demand proprietary technology that iterates in days, insist on top-tier independent certifications for mobile environments, and prioritize networks that share real-time intelligence. Organizations that treat trust as a core strategic capability will thrive; those that remain reactive will find themselves increasingly vulnerable in a world where reality is becoming ever more malleable.

Fernanda Sottil is Senior Director of Strategy at Incode Technologies, a leading identity verification company.

Learn more: Find out how Incode helps leading organizations eliminate fraud before it happens.

The post Weaponized AI: The new frontier of fraud and identity spoofing appeared first on CyberScoop.

Our nation has entered a new fraud arms race fueled by AI.

With billions of dollars in fraud losses mounting in both the private and public sectors, it’s clear the old ways of deterring fraud aren’t working. That’s why we need a new playbook that starts with understanding how fraudsters operate, evolving our defenses, and shifting to a proactive posture that doesn’t just fight fraud but actively hunts it down. 

In the AI era, treating fraud as just a front-door problem won’t work. This moment requires industry, government, and consumers to work together, reduce silos, and share real-time intelligence. The goal is to move beyond reactive detection by understanding the lifecycle of a threat—from its formation to its spread—so we can intervene before it establishes a foothold.

For decades, fraud has been treated like a series of isolated incidents. This false assumption has underpinned nearly every past effort to crack down on it. Those efforts, while well-intentioned, have missed the mark. 

Now, in light of the Trump Administration’s Cyber Strategy for America and accompanying executive order, it’s critical to understand the modern fraud landscape and the central role that digital identity exploitation plays within it.

New research from Socure reveals just how dramatically the landscape is evolving. 

Fraud has become industrialized, with organized crime syndicates running operations that are global, systemic, automated, and powered by AI. No organization, service, or program is safe. Fraudsters target government programs, banks, fintech platforms, telecom companies, and more, blurring the lines between public sector fraud, financial crime, and cybercrime.

It used to be that fraud could be detected through the reuse of identity elements across multiple applications: the same email, device, phone number, or IP address used over and over. 

But the data is clear: these links are declining fast. Today’s sophisticated fraudsters are now engineering their attacks to avoid traditional fraud detection patterns. Our research demonstrates that emails will be completely unique within fraud populations as soon as 2027, so we won’t be able to rely on email to identify patterns.

Speed is another defining feature of modern identity fraud. Fraudsters use AI to create clean, durable, synthetic and stolen identities at scale. In one observed campaign, 24,148 synthetic identities were built and launched in under a month, with many attacks occurring within 48 hours. What once took weeks or even months can now be completed in days. 

The rapid rise of identity farms is another indicator of the industrialization of fraud. Identity farms are operated by crime rings to systematically create synthetic or stolen identities over time in order to closely resemble legitimate identities. Matured identities are used to open bank, credit, and money-movement accounts, siphon government benefits, launder funds, and more. These identity farms focus on durable identities that can bypass traditional verification controls.

So what should we do? Simply put, we must go on offense. 

This means treating identity as critical infrastructure and implementing strategies that track how identities were created before the moment of application; expanding signals monitoring to include elements like residential proxies, ISP behavior, and domain registration activity; evaluating velocity and orchestration in real-time; and treating continuous measurement, rapid model iteration, and cross-industry intelligence as core capabilities.

Additionally, given the rapid scaling of fraud, we need more analysis of the complete ecosystem, including dynamic factors like device information, digital footprints, and behavioral biometrics so organizations can effectively distinguish genuine humans from machines. Ultimately, this layered and interconnected approach makes it significantly harder for malicious actors to recreate or steal identities at scale.

Fraud is no longer a series of isolated acts. It is a coordinated, global enterprise built on the exploitation of identity. Until our efforts reflect this new reality, we will continue to fight an imminent and ongoing threat with outdated tools and fall further behind. 

Now is the time to make this strategic shift and finally put fraudsters on their heels. 

Mike Cook serves as head of fraud insights at Socure, the identity and risk platform for the AI age.

The post Don’t just fight fraud, hunt it appeared first on CyberScoop.