In the UK, fraud losses reached £1.3billion, showcasing how fraud operates at a growing scale. One of the factors driving this growth is the increasing use of technologies, such as AI, which are becoming dangerous and effective weapons in the hands of a new generation of criminals
As they continue to evolve, criminal networks are becoming faster and more sophisticated in their operations, and financial institutions face the challenge of adapting to a new era of cybersecurity and fraud prevention powered by the same force threatening the system and customers’ trust.
Fraud and Identity SME at Feedzai.
AI is reinventing cybercrime
Fraudsters are already using advanced technologies including generative AI to industrialize social engineering. As the marginal cost of a sophisticated attack approaches zero, criminal networks are undergoing a measurable structural shift in how they operate. Skills that previously lived inside a small number of highly specialized criminal groups are now commoditized.
Latest Videos FromTechRadar
Generative AI and synthetic identity creation can now produce composite identities that pass Know Your Customer (KYC) checks, build believable credit histories and operate undetected for months before the fraud is executed. Deepfake-enabled authorization fraud produces voices and videos convincing enough to trick humans into authorizing transactions or transferring access credentials.
These examples all reveal a common pattern: they attack the trust layer, the moment where a system or a human decides something is legitimate. Even with incredibly sophisticated models, the tactics will target the system and subsequent operations. AI can now manufacture trust at a speed and quality that was simply not possible before.
Why traditional security is falling behind
Such technologies now have the upper-hand as they are largely defeating the customer, not the bank’s systems. Fraudsters are using AI to manipulate people into authorizing transactions themselves with more convincing scam calls, more realistic impersonation, more personalized social engineering that erodes the skepticism that used to protect people. The fraud arrives at the bank’s systems looking entirely legitimate, because in a technical sense it is.
That is where the battle is being fought today. As banks continue to invest in AI-driven detection and the customer manipulation route becomes harder to exploit at scale, the incentive to attack the banks’ systems directly increases.
We are in a transitional phase, where technology is helping fraudsters to defeat people, this could evolve toward AI directly probing and attacking the institutions themselves. The financial sector should be preparing for that second phase now.
Against an adversary that probes, adapts and iterates continuously, the current static nature of traditional security controls are not sufficient. In financial fraud and cybersecurity, AI-driven attacks are not just evading controls, they are mapping them. They behave almost as if they understand the shape of the detection system and are deliberately staying outside its boundaries.
A symbiotic relationship between workforce and technology
In banks and financial institutions, fraud prevention teams are increasingly struggling to keep up with the constant technological evolution of the threats, mostly because they have been trained to think in terms of incidents: if something happens, you detect it, you respond, you close the case.
The ones making the most progress are those treating detection as a research function rather than an operational one. They are looking at shifts in behaviors that might suggest something is being tested against us. This different analytical posture ultimately aids in prevention over detection.
The professionals who will matter most in five years are the ones who can reason about systems rather than just operate them. There is a need to move from expertise in specific tools to expertise in the underlying principles that make tools work. Principles, such as statistical reasoning, adversarial thinking, systems design, feedback loop analysis, compound over time and remain relevant regardless of what the technology stack looks like in years to come.
Not all organizations are equipped to operate this way, and while hiring to fill this gap might be the obvious solution, the reality is that, thanks to advancements and widespread adoption, today we have cutting-edge AI tools that can be easily integrated within existing infrastructure and operations.
The way forward is to invest in the work of external providers that make these tools accessible and easy to deploy, combining statistical analysis, reasoning and full explainability.
Deploying new technologies without fueling risks
You don’t need to be technically sophisticated to deploy a technically sophisticated attack, and this democratization of capability is what makes the next wave genuinely different. The questions practitioners are working through now are not whether new technologies work, but how to leverage the next generation of capabilities to stay ahead of increasingly automated attacks.
The most important principle is to treat your systems as attack surfaces from day one rather than as an afterthought once they are in production. Every model you deploy has assumptions baked into it, and adversarial actors will probe those assumptions systematically. If you have not done that probing yourself first, you are outsourcing your red team function to people with very different intentions.
To be effective, AI-driven defenses must work in milliseconds – fast enough to spot risk without disrupting the customer experience. Every transaction is assessed in real time, analyzing hundreds of signals and comparing them against historical patterns to identify any signs of anomalous activity.
We’ve featured the best endpoint protection software.
This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.
The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit
