Is the FCA underestimating the AI fraud threat?
There is a lot of optimism around what AI could do for financial services. It can make processes faster, spot suspicious activity earlier and help banks deal with fraud at a scale that would be impossible for human teams alone.
All of that is true. But it risks obscuring a more immediate problem. The same technology is improving the economics of fraud, and criminals do not have the same constraints as the organizations trying to stop them.
Technical Director UK & Ireland at Trend Micro.
They do not have lengthy procurement cycles, legacy technology to integrate or regulatory processes to work through. They can experiment, fail and try again. That creates a growing gap between the speed at which AI-enabled fraud is developing and the speed at which financial institutions can adapt their defenses.
Latest Videos FromTechRadar
The question for the FCA, and for the industry more broadly, is whether we are paying enough attention to that gap.
Identity checks were built for a different problem
That is why firms have become comfortable with measures such as video liveness checks, voice callbacks and one-off document verification. Each creates another hurdle for the fraudster.
Generative AI changes the nature of that challenge because the person, voice or document being presented may never have existed in the first place. A convincing voice can be generated. Faces can be created or manipulated. Identity documents and supporting paperwork can be produced quickly and consistently. What used to require specialist skills and considerable effort is becoming cheaper and easier.
That does not make existing identity controls useless. But it does mean firms need to stop assuming that passing them proves what it once did. A liveness check, for example, is only valuable if it can reliably distinguish between a real person and whatever the latest generation of synthetic media can produce. That is now a moving target.
The bigger concern is the person who doesn’t exist
This is why synthetic identity fraud deserves much more attention.
Traditional identity theft usually has a real victim. Someone discovers an account they did not open, a transaction they did not make or a credit application they know nothing about. Eventually, there is a human being who can raise the alarm.
Synthetic identities are different.
Fraudsters can combine genuine information with invented details to create an apparently legitimate individual. A real identifier might be paired with a false name, fabricated employment history or invented address. AI can then help create the documentation and digital footprint needed to make that identity appear credible.
The worrying part is that there may be nobody to complain because the person does not exist.
That makes synthetic identity fraud particularly difficult to identify early. A synthetic customer can behave normally, establish a financial history and build trust before committing fraud much later.
We should think about this risk in roughly the same way the industry viewed account takeover a decade ago. Today, account takeover is well understood and there are mature systems, shared intelligence and established behavioral indicators designed to detect it. That maturity took time.
Synthetic identity fraud is not there yet.
AI risks accelerating the problem before the industry’s collective ability to recognize it has caught up.
Banks need to attack their own controls
The answer cannot simply be to buy another AI-powered fraud product.
Financial institutions need to start using the same technology offensively against their own systems. If criminals are using generative AI tools to test what gets through, banks should be doing exactly the same thing.
Security teams have red-teamed networks and applications for years. Identity and onboarding processes now need similar treatment. Can an AI-generated voice pass the callback process? Can a synthetic face beat the liveness check? Can fabricated documentation survive onboarding? Can a convincing synthetic identity be created across several data points without triggering an alert?
These are questions firms should be answering themselves, rather than waiting for a fraudster to provide the answer. Every successful attempt should become a lesson. If a synthetic document passes, understand why. If a generated voice fools a control, change the control. Then test it again.
It also means moving away from excessive reliance on one-off verification. Proving someone’s identity once, at the point of onboarding, becomes less reassuring when that moment can be convincingly fabricated.
Behavior over time matters more. How an account is used, how a customer interacts with services and whether activity is consistent with what the organization knows about them can provide signals that are much harder to manufacture with a single deepfake or forged document.
Regulation will always be chasing the technology
The FCA clearly has an important role to play, but regulation alone will not solve this problem. AI is developing too quickly for rules written today to anticipate every fraud technique that will emerge tomorrow.
That puts more responsibility on financial institutions themselves.
Trust and accountability need to be built into AI systems from the beginning. Firms should deliberately test how their systems can be deceived or misused. They need clear senior ownership when automated decisions go wrong, rather than allowing responsibility to disappear behind “the algorithm”. And they need to understand, and be able to explain, why important decisions were made.
This cannot become another compliance exercise.
The institutions that treat AI governance as paperwork to satisfy a regulator may technically meet today’s requirements while remaining exposed to tomorrow’s fraud. Those that continuously test their assumptions, challenge their own controls and build accountability into the technology will be in a far stronger position.
We’ve featured the best AI chatbot for business.
This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.
The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here:
