AI-enabled fraud: are your controls keeping pace?

Cyber-enabled fraud remains one of the most significant risks facing organisations. As technology becomes increasingly embedded in day-to-day operations, fraudsters are using AI to exploit weaknesses in people, processes and systems. Organisations therefore need robust prevention, detection and response capabilities to keep pace with an evolving threat landscape.

How is AI changing the fraud threat?

AI is increasing both the scale and sophistication of cyber fraud. Attacks are becoming more convincing, harder to detect and easier to deliver at scale. Examples include:

• AI-enhanced phishing: AI can increase the personalisation of phishing messages by analysing publicly available information, increasing the likelihood of a response from the victim.
• Business email compromise: AI can analyse communication patterns and generate more realistic emails, making impersonation attempts more convincing and harder to identify.
• Deepfake and impersonation fraud: AI can generate realistic voice or video content to imitate trusted individuals, making fraudulent requests more convincing and increasing the likelihood of success.
• Invoice and payment fraud: AI can create convincing fake invoices and analyse payment cycles to time fraudulent requests when they are less likely to be questioned.
• Ransomware: AI can help criminals identify critical systems to target, evade detection and tailor ransom demands based on an organisation’s financial profile or digital footprint.

As these examples show, AI is making it easier to target organisations with greater efficiency and accuracy. These developments create new challenges for organisations and raise important questions about the effectiveness of existing controls, processes and response capabilities.

What should organisations be asking themselves?

Key questions include:

• Are our current fraud controls designed to address AI-enabled threats?
• Could employees identify an AI-generated phishing attempt or impersonation attack?
• Do we have robust controls and verification processes for high-risk requests, including payment approvals and changes to sensitive information?
• How quickly could we investigate and respond to a suspected fraud incident?
• Are our cyber security and fraud response capabilities aligned?

Building resilience against AI-enabled fraud

Organisations can strengthen their resilience by focusing on three connected areas: reducing exposure, improving employee awareness and verification processes, and ensuring they can detect, respond to and investigate incidents effectively.

Strengthening controls and reducing exposure

Effective fraud prevention starts with understanding where vulnerabilities exist and implementing measures to reduce the likelihood of exploitation. This may include conducting fraud risk assessments and control reviews to identify weaknesses in areas such as segregation of duties, payment approvals, procurement processes and vendor onboarding.

Data analytics can also be used to identify unusual activity or indicators of fraud that may otherwise remain hidden.

Alongside this, cyber security measures can help reduce exposure by strengthening identity and access management, implementing multi-factor authentication, improving joiner/mover/leaver processes and reducing exploitable vulnerabilities through security testing and remediation.

Strengthening awareness and verification processes

Many AI-enabled frauds rely on persuading individuals to act on seemingly legitimate requests. Organisations should therefore ensure employees are equipped to recognise phishing attempts, impersonation attacks and other forms of social engineering.

Measures such as targeted awareness training, email and collaboration security reviews, anti-impersonation controls and stronger verification processes for high-risk requests can help reduce the likelihood of fraudulent payments, unauthorised disclosures of information and other common fraud scenarios.

Detecting, responding to and investigating incidents

Even with strong preventative measures in place, organisations should ensure they can respond quickly and effectively when suspicious activity is identified.

This may include cyber incident response planning, containment activities, evidence preservation and root-cause analysis, alongside forensic investigations of financial records, communications and digital evidence.

Understanding how an incident occurred, who was involved and the resulting financial impact can help support internal disciplinary action, regulatory obligations, recovery efforts and, where required, legal proceedings.

How we can help

AI-enabled fraud increasingly sits at the intersection of technology, people and financial processes. A joined-up approach can help organisations better understand their exposure, strengthen resilience and respond more effectively to emerging threats.

Our Forensic and Risk advisory teams work together to help organisations assess fraud and cyber risk, test the effectiveness of controls, investigate suspected incidents and respond when issues arise. By combining financial, forensic and cyber expertise, we can help identify vulnerabilities, prioritise action and build resilience against AI-enabled fraud.