AI-Driven Fraud: How Financial Services Can Tackle an Ever-Evolving Threat

Written by Travis DeForge, Director of Offensive Cybersecurity at Abacus Group

Financial services firms face a rapidly-expanding threat landscape as fraudsters employ artificial intelligence (AI) to launch increasingly-sophisticated attacks. According to Signicat’s 2024 "Battle Against AI-Driven Identity Fraud" report, AI-powered fraud constitutes 42.5% of all fraud attempts detected in the financial and payments sector. 

Traditional fraud schemes depended on clunky emails, which were often littered with spelling mistakes. In stark contrast, today’s AI-fueled attacks are difficult to differentiate from legitimate communications. Fraudsters can now analyze vast quantities of publicly-available data to create highly-personalized messages - free of grammatical errors and laden with familiar jargon – that effectively mimic trusted contacts. 

Where voice cloning once required lengthy audio samples, sophisticated algorithms now generate convincing voice replicas, using just a minute of clear audio. This rapid turnaround enables criminals to bypass voice-based multi-factor authentication (MFA) systems and establish trust with targeted employees by having a familiar voice; therefore, posing a significant risk for financial firms and their clients.

How AI Fuels Criminal Schemes

Fraudsters are not just exploiting generative text but also making use of advanced machine learning to automate their attacks. Phishing campaigns, for instance, are becoming a ‘numbers game’, scaling up both the volume and quality of fraudulent communications. 

We are seeing examples of hackers successfully impersonating high-ranking executives to trick employees into authorising wire transfers. Hong Kong police recently identified a multinational company scammed out of US$25 million by impersonators using deepfake tech to mimic senior executives. While incidents like this are still less common than traditional phishing, they herald a dangerous shift in how easily fraudulent messages can be tailored to bypass traditional safeguards.

Another growing threat involves synthetic identity fraud. Criminals use AI to blend real and fake personal information, creating entirely new identities that can be used for credit fraud or to infiltrate secure financial systems. This technique is especially challenging for smaller firms that may lack the resources to effectively monitor multiple entry points.

The implications of AI-driven fraud are far-reaching. The efficiency of AI means attackers can implement multiple, well-crafted fraud attempts across a network in a single day, overcoming even the most robust cybersecurity defenses. For financial services organizations, the stakes go beyond the purely economic. A successful fraud attack can also damage client trust and the firm’s reputation, two of the most critical assets in a sector where credibility is paramount.

Enhancing Security Measures in an AI-Powered Era

Given the rapid evolution of fraud tactics, firms must adopt a multilayered approach to security. Technical controls such as advanced anomaly detection and continuous penetration testing are essential. 

Yet, technology alone is not enough. The human element remains both a key asset and a potential vulnerability. Regular training on recognizing subtle signs of fraud, including checking for inconsistencies in communication styles, or unexpected changes in call protocols, is critical. 

Firms should implement verification procedures such as requiring independent callbacks or secret shared passwords for sensitive transactions. This simple step can add effective protections against a cloned voice or a carefully crafted phishing email from triggering an unauthorized transfer.

Conducting controlled simulations of AI-driven fraud can reveal weaknesses in existing defenses. Red-teaming exercises allow firms to understand how an attack might unfold and adjust their response plans. By identifying gaps in technology and processes, organizations can strengthen their defenses before a real incident occurs.

Combining traditional security measures with innovative AI-powered monitoring can create a more resilient environment. This includes using multi-factor authentication that relies on independent verification channels, continuous monitoring of transaction anomalies and robust data loss prevention practices.

Taking Action Now

The recent growth in both the sophistication and prevalence of AI-driven fraud should act as a wake-up call for financial services firms. It is a clear sign of the urgent need to take action to mitigate the threat.

Investing in a robust and scalable security architecture is key to this, of course, but so too are implementing rigorous processes, putting in place a strong security culture, and monitoring threats continuously to stay one step ahead of cybercriminals. 

At Abacus Group we understand all this, and we have the capability and expertise to help you build a defense that adapts in line with ever evolving threats. Contact us to get started.