Voice clones, deepfake video, AI-generated documents and selfies, and AI-scaled lures. GenAI lowers the cost and raises the credibility of identity and social-engineering attacks that end in transaction losses.
What it is
GenAI makes existing fraud types cheaper to run and more convincing. For a transaction-fraud team, the practical question is which controls depended on something being hard to fake.
Control assumption
What GenAI changes
"A photo ID plus a selfie proves a real, present person"
AI-generated or altered documents and deepfake selfies; FinCEN's 2024 alert and FINRA's 2026 report both describe them defeating verification checks
"A voice on the phone that matches the customer is the customer"
Voice clones that persuade firms to change account access (FINRA 2026), and "distress" calls to relatives (IC3 2025)
"Seeing a known executive on video means the instruction is real"
Generated or edited receipts and claim images (Receipt Fraud (Cashback), Buyer Protection Claim Abuse (INR and SNAD))
"Scam messages are clumsy"
Fluent, personalized, multilingual lures at scale; AI-written chat for long-con scams
"Celebrity endorsements are rare and checkable"
Deepfaked public figures promoting investment schemes
Measured scale. The FBI's IC3 2025 report added its first dedicated AI section: 22,364 complaints with an AI nexus and about $893M in losses. That figure is a floor, because victims often can't tell that AI was involved. Its breakdown:
Investment: AI-generated celebrity and executive videos and voices, plus AI-driven chats. Over $632M.
Business email compromise: AI-written executive emails and voice-cloned payment requests. Over $30M (corporate; out of scope here except as a pattern).
Confidence/romance: AI-written profiles and scripts, plus voice-cloned "distress" and grandparent calls. Over $19M, of which over $5M is distress scams.
Employment: voice-spoofed or deepfaked job interviews. About $13M, with network access apparently the main aim.
How it works
Transaction footprint
Entry point
What you see in the data
Decision point
Onboarding
Clean-looking documents with subtle inconsistencies; face images that reverse-match AI-generated galleries; "technical glitches" or a channel switch during liveness; device or geo inconsistent with the document
Voice-channel requests for contact or MFA changes, especially from a caller who refuses callback or pushes urgency; followed by a new-device login and payout
Neobanks and Consumer Fintech, Brokerage and Investing: onboarding (deepfake KYC) and recovery (voice clones). FINRA's 2026 report names both for broker-dealers.
Payments and P2P: authorized payments driven by cloned voices and deepfaked personas.
Cashback, Coupons and Rewards: generated and edited receipts. Exact-match duplicate detection loses power when every submission can be uniquely rendered.
Direct: IC3 2025 attributes about $893M to AI-nexus complaints. Investment scams dominate.
Control erosion: onboarding and recovery controls that relied on media evidence lose precision, which forces either more friction for everyone or investment in layered signals.
Detection pace: detection vendors and fraudsters iterate quickly. The IC3 report warns that AI-generated content is getting harder to detect and easier to produce.
Regulatory: FinCEN asks institutions to use SAR key term FIN-2024-DEEPFAKEFRAUD and to report the underlying typology too. See BSA-AML and SAR Filing.
Red flags
Document or photo inconsistencies; a reverse-image match to AI-generated faces; detection tools flagging media → Identity Verification Outcomes, Receipt and Document Image Forensics
Confirms the purchase from data instead of trusting the image
Respond
Re-verification campaigns when a deepfake vector is found; SAR with the key term
Contains the cohort onboarded through the gap
Emerging variants and adversary adaptation
Shift to provenance. Artifact detection on its own loses ground as generators improve. Defenses shift toward provenance (capture-device attestation, verified data sources), behavior and network signals, and removing media from high-risk decisions altogether (passkeys, data-based purchase verification).
Real-time interactive deepfakes. Live voice and video conversion makes conversational impersonation possible, where earlier attacks relied on prerecorded clips. The FBI's September 2026 PSA notes AI-enabled video calls in government-impersonation scams.
Recovery and support. These channels are the soft spot. FINRA's 2026 report highlights voice clones persuading firms to change account access. Expect pressure to move toward support channels without strong customer-side confirmation.
First-party adoption. Consumer AI image tools make receipt and claim editing trivial for ordinary customers as well as organized rings. Expect volume growth in low-dollar, high-frequency claims abuse.
Synthetic workforce. Deepfaked or proxy candidates in remote hiring aim to become insiders. See Insider Fraud.
Case Study - Arup Deepfake Video Call (2024): an employee in Arup's Hong Kong finance team received a message in January 2024 that appeared to come from the UK-based CFO. After a video conference with digitally recreated colleagues, the employee transferred HK$200M (about US$25.6M). Hong Kong police reported the case in February 2024, and Arup confirmed it was the victim in May 2024.
FBI IC3 PSA I-120324-PSA (December 3, 2024) catalogs GenAI use across text, images, cloned audio and real-time video. Its examples include cloned relatives' voices demanding emergency payments, AI audio used to get into bank accounts, deepfaked executives on live video calls, and AI-made IDs. Its consumer advice includes a family "secret word" for verification.
FinCEN (November 2024) reported a rise, starting in 2023 and continuing into 2024, in suspicious-activity reports describing deepfake media used in fraud schemes against financial institutions. Among best practices it recommended phishing-resistant MFA.
Case Study - AI-Generated Fake Receipts (2025-2026): image models made fabricated receipts common in under 18 months, from 0% to about 71% of one platform's flagged fakes
FBI IC3 2025 Internet Crime Report: first AI section (22,364 complaints, about $893M); category breakdown; FBI and ABA Foundation deepfake infographic (September 2025)
