#92 - AI fraud is here. So where's the loss?

"Our phone explodes, and we're like, this is a better scam than we'd usually see."

That's what David Liu, a twenty-year fraud veteran (AmEx, Socure, Trulioo), pointed out in the latest TSFS podcast episode.

And yeah, we all feel it. Everyone's phone is worse than it was a year ago. We all see fraud attempts on a weekly basis.

And then we go to the office, open our dashboards, and fraud numbers are… the same?

Here’s the thing:

Every vendor report and every industry survey has been warning about AI-powered fraud for two years now. By now, you would have expected to see these numbers rise.

But they don’t.

So where did all that new capability actually go? To our phones.

Right now, scamming people pays better ROI

Fraud has always run onthe same ROI math. Go where the return is highest for the least effort.

For years that meant businesses, whether banks, fintechs, or merchants. Why? Because you could easily scale attacks with templates, scripts, and tooling.

But at the same time, these institutions spent decades building for exactly this fight - transaction monitoring, device intelligence, EDD checks, entire teams whose only job is making that math worse for the attacker.

Consumers never built any of that. And they shouldn’t, it’s not their responsibility.

And it used to be OK.

Scams weren’t invented in 2024, but before that they took a lot of effort to scale. Each individual victim required a human fraudster to “manage”.

But now, with GenAI, scaling scams is just too cheap. 

Personalized phishing, voice cloning, a convincing text that knows your name and your bank - all of it got dramatically less expensive to produce in the last two years.

Cheap production plus a soft target is exactly the trade a rational fraudster takes. It doesn't require a genius.

The reason why fraud hits our phones and not our dashboards is the same old one - that’s what the ROI dictates.

But is that permanent?

Here's the thing I keep circling back to: ROI only holds as long as the defenses on the other side stay weak.

So the real question isn't whether scamming people is the easier trade today. It's whether it stays like that for the foreseeable future.

It’s easy to imagine that this will be the case.

After all, consumers have no budget or the capability to erect defenses on their own. Right?

Well, not exactly.

Consumers have the most powerful defense on their side - the regulator.

It might take time, it might take years, and in some countries (ehm, looking across the pond…) - it might take a different administration.

But eventually, the budding seeds we see today will likely develop fully into liability-shift programs that protect consumers from scams, just like in the eCom space.

Slowly but surely, banks will come under pressure to reimburse their customers. In turn, not only will they incur losses, but we should expect reporting rates to go up.

Side note: Take into account that traditionally, reporting rates in APP fraud and scams tend to be much lower than with 3rd-party fraud. That’s a clear indicator of the reimbursement-reporting correlation.

Is it bound to happen? I don’t think so.

But it puts institutions, especially banks, in an awkward position as there are in fact two scenarios in which they are left with the wrong end of the stick.

“Best” case, a liability shift pushes losses to banks, but keeps fraudsters’ ROI the same. The target is still consumers, but banks are going to foot the bill.

But worst case, especially in a world where education and regulatory frameworks manage to curtail scams, it might mean that the ROI would shift in favor of targeting businesses once more.

Where would you be when the pendulum shifts?

In our conversation, David outlined something that should scare any fraud fighter.

An autonomous agentic fraud campaign that can pull stolen identity data at scale, match it against compromised assets, and combine it with deepfaked biometrics.

In essence, nothing stops fraudsters from executing such an attack today.

The technology exists.

And the reason why we’re not seeing it at scale is likely twofold.

The first is that it still requires more effort and upfront investment than a “simple” scam scheme.

The second is that it takes time for fraudsters to ramp up their capabilities, be they early adopters as they are.

But we are seeing such attacks already today.

They might be 1% of the total losses we’re observing, but there’s no reason to believe it’ll stay that way.

Fraudsters are getting more proficient by the day, and the knowledge and experience they gather will not be gated for long.

Because this 1% will eventually develop products, services, and guides for the rest of the “community” to make use of.

After all, fraudsters are first and foremost in it for the money.

And for that reason, even if the data is lacking and points us elsewhere, my biggest fear is that we’re all becoming too complacent.

How would you tell you’re under an “undetectable attack”?

The big AI-powered fraud spike isn’t missing. It's just aimed at people instead of institutions.

For now.

Whether this ever changes isn’t something anyone can predict, but I wouldn’t place my money on it staying the same for long.

A better, more practical, question to ask then isn’t “will AI-powered fraud target me?” but it’s really “how would I even know?”

David and I spent a good chunk of the episode on which signals - device, contact history, behavior over time - actually hold up once the easy targets get harder.

Go give it a listen, it is live now.

What would tell you the aim had shifted back toward your institution before your loss numbers did? Hit reply, I'd like to know what you're watching.

In the meantime, that’s all for this week.

See you next Saturday.

P.S. If you feel like you're running out of time and need some expert advice with getting your fraud strategy on track, here's how I can help you:

Free Discovery Call - Unsure where to start or have a specific need? Schedule a 15-min call with me to assess if and how I can be of value.
​Schedule a Discovery Call Now »​

Consultation Call - Need expert advice on fraud? Meet with me for a 1-hour consultation call to gain the clarity you need. Guaranteed.
​Book a Consultation Call Now »​

Fraud Strategy Action Plan - Is your Fintech struggling with balancing fraud prevention and growth? Are you thinking about adding new fraud vendors or even offering your own fraud product? Sign up for this 2-week program to get your tailored, high-ROI fraud strategy action plan so that you know exactly what to do next. ​
Sign-up Now »

Enjoyed this and want to read more? Sign up to my newsletter to get fresh, practical insights weekly!

<