Weaponized AI: The new frontier of fraud and identity spoofing

Today’s enterprise executives are navigating a complex landscape of AI-driven challenges, but none is more urgent than the rapid escalation of AI-generated fraud.

Fraudsters are weaponizing generative AI to automate impersonation and mass-produce synthetic identities at a scale and pace that is rendering enterprises’ long-standing defenses obsolete. This is no longer a slow-moving game of cat and mouse; it is a high-velocity arms race.

To protect the integrity of their platforms, enterprise leaders — particularly in critical infrastructure sectors — must move beyond periodic risk assessments and begin leveraging a new generation of tools that enable defenses to iterate in days rather than months.

Generative AI as a fraud multiplier

While legitimate businesses use generative AI for efficiency, fraudsters exploit it to scale their attacks. We are witnessing a 100-fold increase in synthetic identities and a sevenfold rise in deepfake-driven impersonations over the past 24 months. Deloitte’s Center for Financial Services predicts AI-enabled fraud losses could reach $40 billion in the U.S. by 2027, up from $12.3 billion in 2023.

This is no longer just a back-office technical issue; it has become a top concern for leadership across banks, fintechs, and telcos. Three-quarters (72%) of business leaders anticipate AI-generated fraud, including deepfakes, will be a top operational challenge in 2026, according to an Experian report. Nearly half (46%) of businesses surveyed by Incode in 2025 reported an annual increase in deepfake and generative AI fraud.

Bad actors can now perpetrate fraud at scale by targeting multiple victims at the same time using the same or fewer resources. Consequently, the stakes have escalated rapidly. Enterprises must now find more effective ways to distinguish between reality and fiction before these attacks compromise trust, revenue, and operational continuity.

The new arms race

Fraud prevention has always been a constant game of leapfrog. Now, however, enterprises must adopt highly advanced defenses as they work to thwart fraudsters who have access to the same AI tools and no legal guardrails.

By some estimates, 80% of fraud is easily detectable, while the remaining 20% requires high-level expertise. That’s where most vendors’ performance fails. Sophisticated fraudsters are not only more capable of impersonating identities but are also increasingly networked, sharing intelligence on how to bypass specific company defenses.

Agility as the primary security metric

In this environment, the “7-Day Benchmark” is essential. A defense model must be able to identify a new attack vector, retrain its data sets, and deploy an updated mitigation model within 7 to 10 days. 

One reason so many organizations remain vulnerable to this new generation of attacks is that they rely on third-party vendors whose update cycles can take months to test and deploy. Modern defense requires an approach like Deepsight: a combination of machine learning, behavior checks, and device checks that identify camera injections and synthetic document fraud and verify that the user is a real person.

Defense checklist: 4 questions for every vendor

To narrow this “velocity gap,” executives need to take a closer look at how well equipped their providers are to address this new generation of threats.  Here are four pointed questions to explore:

1. “How accurate is your facial recognition capability? And what third-party certifications do you hold for mobile environments?” Executives should look for solutions that have been independently validated against the most rigorous international standards for biometric spoof testing—such as iBeta Level 3 compliance on both iOS and Android—that simulate well-resourced attackers using professional-grade, hyper-realistic masks.
   • While many providers struggle with consistency across various devices, a top-tier solution will achieve a 0% error rate. (In a 2024 National Institute for Standards and Technology (NIST) evaluation of 158 different developers, using galleries of mugshot, Visa, and Border images, Incode ranked #1 out of all full solution identity verification providers.) 
   • Also, assess the accuracy and performance of algorithms used in facial analysis across a range of use cases, including age estimation, ensuring the technology is unbiased and highly accurate across diverse user populations. (Once again, Incode scored top marks in NIST’s Face Analysis Technology Evaluation for achieving the lowest error and false-positive rates.)
2. “How do you measure and report your own error rates?” Demand a rigorous, audited approach that provides clear metrics on false positives and false negatives for every session.
3. “Do you own your technology or license it?” This determines the speed of iteration. Updates should happen internally in days, not over months-long development cycles dictated by a third party.
4. “How does your network share intelligence to flag repeat offenders?” Inquire whether the vendor can cross-share biometric, VPN, and network data across their entire client base to proactively block known fraudsters before they hit your system.

(For a more complete guide on selecting an identity verification vendor, we recommend getting a complimentary copy of the Gartner Magic Quadrant for Identity Verification.)

Secure your defenses against AI-enabled fraudsters

The era of treating identity verification as a static compliance checkbox is over. As the internet makes identity spoofing easier than ever before, the burden is on leadership to ensure their defenses can evolve at the speed of the adversary.

Audit your vendor ecosystem today: Demand proprietary technology that iterates in days, insist on top-tier independent certifications for mobile environments, and prioritize networks that share real-time intelligence. Organizations that treat trust as a core strategic capability will thrive; those that remain reactive will find themselves increasingly vulnerable in a world where reality is becoming ever more malleable.

Fernanda Sottil is Senior Director of Strategy at Incode Technologies, a leading identity verification company.

Learn more: Find out how Incode helps leading organizations eliminate fraud before it happens.