Is the FCA underestimating the AI fraud threat?

Date:
Tue, 15 Sep 2026 09:15:22 +0000

Description:
Banks must actively test AI-enabled fraud before criminals expose weaknesses.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter There is a lot of optimism around what AI could do for financial services. It can make processes faster, spot suspicious activity earlier and help banks deal with fraud at a scale that would be impossible for human teams alone.

All of that is true. But it risks obscuring a more immediate problem. The
same technology is improving the economics of fraud, and criminals do not
have the same constraints as the organizations trying to stop them. Bharat Mistry Social Links Navigation

Technical Director UK & Ireland at Trend Micro. They do not have lengthy procurement cycles, legacy technology to integrate or regulatory processes to work through. They can experiment, fail and try again. That creates a growing gap between the speed at which AI-enabled fraud is developing and the speed
at which financial institutions can adapt their defenses. Latest Videos From TechRadar Watch full video here:

The question for the FCA, and for the industry more broadly, is whether we
are paying enough attention to that gap. Identity checks were built for a different problem Many of the identity verification controls used today were designed around a fairly simple assumption: somewhere in the process, a human being is pretending to be somebody else. You may like How AI fraud rings are taking on retail Why traditional security checks are failing in the age of AI-driven fraud How identity fraud became the threat that never sleeps

That is why firms have become comfortable with measures such as video
liveness checks, voice callbacks and one-off document verification. Each creates another hurdle for the fraudster.

Generative AI changes the nature of that challenge because the person, voice or document being presented may never have existed in the first place. A convincing voice can be generated. Faces can be created or manipulated. Identity documents and supporting paperwork can be produced quickly and consistently. What used to require specialist skills and considerable effort is becoming cheaper and easier. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news
and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

That does not make existing identity controls useless. But it does mean firms need to stop assuming that passing them proves what it once did. A liveness check, for example, is only valuable if it can reliably distinguish between a real person and whatever the latest generation of synthetic media can
produce. That is now a moving target. The bigger concern is the person who doesn't exist This is why synthetic identity fraud deserves much more attention.

Traditional identity theft usually has a real victim. Someone discovers an account they did not open, a transaction they did not make or a credit application they know nothing about. Eventually, there is a human being who can raise the alarm. What to read next The surge in AI-driven fraud requires coordinated global defense Why proving personhood is the new standard for identity verification AI image tools: a game changer for creativity and retails multi-billion-dollar abuse problem

Synthetic identities are different.

Fraudsters can combine genuine information with invented details to create an apparently legitimate individual. A real identifier might be paired with a false name, fabricated employment history or invented address. AI can then help create the documentation and digital footprint needed to make that identity appear credible.

The worrying part is that there may be nobody to complain because the person does not exist.

That makes synthetic identity fraud particularly difficult to identify early. A synthetic customer can behave normally, establish a financial history and build trust before committing fraud much later.

We should think about this risk in roughly the same way the industry viewed account takeover a decade ago. Today, account takeover is well understood and there are mature systems, shared intelligence and established behavioral indicators designed to detect it. That maturity took time.

Synthetic identity fraud is not there yet.

AI risks accelerating the problem before the industry's collective ability to recognize it has caught up. Banks need to attack their own controls The
answer cannot simply be to buy another AI-powered fraud product.

Financial institutions need to start using the same technology offensively against their own systems. If criminals are using generative AI tools to test what gets through, banks should be doing exactly the same thing.

Security teams have red-teamed networks and applications for years. Identity and onboarding processes now need similar treatment. Can an AI-generated
voice pass the callback process? Can a synthetic face beat the liveness
check? Can fabricated documentation survive onboarding? Can a convincing synthetic identity be created across several data points without triggering
an alert?

These are questions firms should be answering themselves, rather than waiting for a fraudster to provide the answer. Every successful attempt should become a lesson. If a synthetic document passes, understand why. If a generated
voice fools a control, change the control. Then test it again.

It also means moving away from excessive reliance on one-off verification. Proving someone's identity once, at the point of onboarding, becomes less reassuring when that moment can be convincingly fabricated.

Behavior over time matters more. How an account is used, how a customer interacts with services and whether activity is consistent with what the organization knows about them can provide signals that are much harder to manufacture with a single deepfake or forged document. Regulation will always be chasing the technology The FCA clearly has an important role to play, but regulation alone will not solve this problem. AI is developing too quickly
for rules written today to anticipate every fraud technique that will emerge tomorrow.

That puts more responsibility on financial institutions themselves.

Trust and accountability need to be built into AI systems from the beginning. Firms should deliberately test how their systems can be deceived or misused. They need clear senior ownership when automated decisions go wrong, rather than allowing responsibility to disappear behind "the algorithm". And they need to understand, and be able to explain, why important decisions were
made.

This cannot become another compliance exercise.

The institutions that treat AI governance as paperwork to satisfy a regulator may technically meet today's requirements while remaining exposed to tomorrow's fraud. Those that continuously test their assumptions, challenge their own controls and build accountability into the technology will be in a far stronger position. We've featured the best AI chatbot for business. This article was produced as part of TechRadar Pro Perspectives , our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit



======================================================================
Link to news story: https://www.techradar.com/pro/is-the-fca-underestimating-the-ai-fraud-threat


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)