Fraud Is Moving Beyond Transactions to Attack Identity
The fraud landscape has shifted from isolated payment events to persistent identity-based attacks that span channels, devices and customer relationships.
AI is accelerating both the scale and the sophistication of fraud.
Fraud is no longer simply becoming more common. With the help of AI, it is becoming more intelligent, more convincing and more capable of impersonating legitimate customers at scale. A 2026 Bankrate survey revealed that 40% of adults had encountered some form of financial scam during the previous 12 months, while 73% had experienced one at some point in their lives. Those figures were up significantly from a year ago, when they stood at 34% and 68%, respectively. Bankrate identified AI as a factor fueling the increase. “Fraudsters are getting more sophisticated, thanks to artificial intelligence, and they’re reaching more people than ever,” said Bankrate U.S. economic analyst Sarah Foster.
40%
of consumers have fallen victim to financial fraud over the past 12 months.
Similarly, UK Finance concluded that criminals are using AI to personalize, automate and scale social engineering and identity-based attacks. Its 2026 annual fraud report found that scam attempts surged 62% across more than 100 million accounts at nine financial institutions in the United Kingdom in 2025. Phishing attempts skyrocketed 140% during the same period.
This trajectory is also showing up in amounts lost to fraud. According to a 2026 FICO survey of more than 200 financial professionals, 26% of organizations witnessed a rise in fraud attempts of more than 51% over the previous two years. Twenty-two percent reported equivalent increases in fraud losses during the period. FICO’s analysis points to AI as an accelerant. Contributor Carl Slabicki, Head of Commercial, Global Payments & Trade at BNY, commented that “AI is changing the fraud landscape, amplifying social engineering, making deepfakes convincing, and scaling synthetic identity and account takeover.”
PYMNTS Intelligence has tracked the same evolution. Its 2025 State of Fraud and Financial Crime study found that 46% of financial institutions said fraud schemes in the United States had become sharply more sophisticated, compared with 35% in 2024. That growing sophistication puts pressure on issuers to look beyond traditional transaction monitoring.
Together, these trends point to an operating environment in which the distinction between a genuine customer and a sophisticated impostor is becoming harder to discern.
Today’s biggest fraud threats can begin long before payment authorization.
Many of today’s fastest-growing fraud schemes begin well before a payment is initiated, targeting identities, credentials and customer trust rather than the transaction itself.
Unauthorized-party schemes illustrate one dimension of the shift. According to PYMNTS Intelligence research, these schemes accounted for a staggering 71% of total fraud incidents and dollar losses in 2025, up dramatically from 48% the prior year. Credential theft and account takeover have consequently become major fraud threats, allowing criminals to impersonate legitimate customers before even attempting fraudulent payments.
Authorized push payment (APP) fraud goes a step further by exploiting customer trust directly. These elaborate schemes persuade victims to authorize fraudulent payments themselves. UK Finance reported 248,070 confirmed APP fraud cases in 2025, up 7% year over year, while losses climbed 19% to £576.4 million.
Synthetic identity fraud presents an especially sinister identity challenge. Criminals can combine legitimate and fabricated personal information to construct identities that appear credible during traditional verification. Those identities can remain undetected until they are used for fraudulent activity.
Card-not-present (CNP) fraud reflects this identity-based dynamic as well. According to UK Finance, CNP fraud cases rose 13% in 2025, with losses up 3% to £423.5 million. The analysis linked the rise specifically to criminals using social engineering techniques to obtain one-time passcodes and bypass authentication. In other words, even a long-established transaction-fraud category can mask an identity attack.
Viewed together, these attack methods illustrate a broader trend: More and more often, fraud succeeds by becoming the customer before it ever reaches the payment. This raises a key question: What happens when the signals issuers use to spot the difference start failing too?
‘Fake Normal’ Is Breaking the Old Rules of Authentication
Voice checks, selfies and behavioral biometrics were built to catch machines pretending to be human. Now that AI can imitate normal human behavior itself, issuers need a fundamentally different way to establish trust.
The authentication signals issuers trusted most are the ones failing first.
In recent years, fraud detection has relied on a familiar set of signals, including voice, video and behavioral biometrics, to distinguish legitimate customers from impostors. AI is now capable of simulating all three, severely compromising their authentication value. Tim Joslyn, Chief Technology Officer of Paymentology, told PYMNTS Intelligence that voice authentication has already reached the point of vulnerability. In his view, financial institutions that continue to rely heavily on this method could already be exposed. “I think voice has already failed,” he said. “If you’re a bank and you’re aligned on voice, then potentially you’re already in trouble.”
The same challenge is emerging with visual authentication. Joslyn said selfies and videos encounter similar pressures as AI improves its ability to generate convincing imagery. Techniques designed to establish that a person is physically present can become less reliable when artificial systems can reproduce those visual cues. “Even with holding up a copy of today’s newspaper or time-stamping a video, all of this now can be easily faked,” he noted.
Behavioral biometrics face an even more fundamental challenge. Systems that analyze typing patterns, session duration or other behavioral characteristics depend on the assumption that automated attacks will behave differently from people. AI systems are beginning to erode that distinction. Joslyn highlighted the risk of automated systems that maintain long sessions and type with human-like timing and cadence. The concern is not simply that a machine can imitate a person. It is that the machine can imitate what a financial institution has learned to recognize as normal behavior. “That’s where the real fraud starts to come in,” he said. “Fake-normal behavior worries me the most.”
That changes the role of authentication. Rather than asking whether a customer looks or sounds genuine at a particular moment, issuers need to expand their focus. One approach is to look for repetitive behavior patterns that span multiple customer journeys. A single interaction may appear legitimate. A pattern that repeats across hundreds or thousands of interactions can reveal something very different. “Something might look human, but if you see it a thousand times, it’s probably not human,” Joslyn observed.
The fix relies on continuous trust rather than a single improved check.
Binary authentication makes a determination at one moment: A customer is considered authentic or not authentic. That approach becomes harder to sustain when the signals supporting the determination can themselves be manipulated. The alternative is a trust model that develops over time and adjusts as risk changes. Rather than treating every interaction as a fresh authentication event, issuers can build a body of evidence to assess transactions in real time.
Joslyn described this approach. “Over time, it builds up an authentication profile of you,” he said. “So, when you make payments, it knows that actually is you because it’s building real-time trust scoring.” The method can be implemented gradually by changing how issuers apply friction. Low-risk activity can move through the payment process with minimal interruption, while higher-risk activity can trigger additional authentication. Joslyn noted that many institutions already have pieces of the required infrastructure, including in-app authentication and 3-D Secure.
FICO’s findings reinforce that the reliance on brittle, single-signal checks carries a real cost. One-third of organizations reported high or very high false-positive rates in their fraud detection systems, meaning legitimate customers can face unnecessary declines, delays or additional verification steps because systems incorrectly identify their behavior as risky.
Customer experience is therefore an integral part of the fraud equation. PYMNTS Intelligence found that half of financial institutions said fraud had damaged customer loyalty, while 44% reported harm to their brands and reputations. For issuers, continuous trust scoring offers a way to strengthen fraud protection without treating every customer interaction as equally risky. By applying greater scrutiny where risk is elevated while allowing familiar, low-risk activity to proceed with less friction, issuers can protect customers without unnecessarily disrupting their experience.
Tokenization: The New Trust Boundary
As authentication shifts from static checks to continuous trust, tokenization is emerging as the mechanism that makes trust portable, controllable and safe to extend to AI agents acting on a customer’s behalf.
Tokenization may be fraud prevention’s most underrated control.
Payment tokenization could become a critical pillar of AI-era fraud prevention. Processing a payment using a programmable digital token in place of sensitive card information changes the security equation. By reducing the amount of exploitable data exposed during a transaction, tokenization gives issuers a level of control that static card numbers cannot provide.
Joslyn described tokenization as “one of the most underappreciated fraud controls.” A token can not only substitute for a card number but also carry attributes and restrictions that determine how the credential may be used. “Using a token is like giving someone a five-dollar bill,” he explained. “Not using tokenization is like giving them your card, your PIN number and access to your entire bank account.” That distinction becomes important during a breach. A compromised card number can expose broad payment capability, but a token with defined controls can draw strict guardrails around its use.
Tokenization therefore represents more than just another security layer. It provides a way to make payment credentials more controlled and adaptable. That becomes particularly important as the definition of a payment user expands beyond the person holding a card.
Tokenization can make agentic commerce more trustworthy.
As AI agents begin transacting on customers’ behalf, the question stops being merely “Is this person real?” and becomes “What is this agent actually allowed to do?” Tokenization is the mechanism that answers it.
Instead of giving an AI agent unrestricted access to a customer’s account or full payment credentials, issuers can use scoped tokens that specify what the agent can purchase, how much it can spend or where the credential can be used. Joslyn argued that tightly scoped AI agents using tokens with controls can be easier to trust because the agent does not need broad access to a customer’s financial relationship.
Issuers already recognize the need for that control. PYMNTS Intelligence found that 68% of high-customer-lifetime-value (CLTV) card issuers said stronger security and fraud prevention are necessary for agentic commerce. The same research found that 42% of card issuers ranked fraud and disputes among their top two platform-related operating costs. The findings suggest that leading issuers treat fraud management as an investment in cardholder trust and customer lifetime value, not just loss avoidance.
As commerce becomes more automated, the ability to control credentials becomes paramount. Fraud prevention is no longer measured only by losses avoided. It is also measured by customer confidence and an issuer’s ability to determine precisely what a legitimate customer, an AI agent or an impostor is permitted to do.
In an era when fraud more often begins with a convincing identity rather than a suspicious transaction, issuers must shift from static authentication toward continuous, risk-based trust. Modern issuer infrastructure gives financial institutions the flexibility to integrate new fraud capabilities, extend programmable, scoped trust through tokenization, and protect customers without sacrificing speed.
PYMNTS Intelligence offers the following actionable roadmap for issuers considering how to build stronger defenses against AI-enabled fraud:
- Move from point-in-time authentication to continuous trust scoring. Build a more complete view of customers across transactions and interactions so that trust can be assessed as behavior evolves.
- Apply friction selectively based on risk. Allow low-risk activity to proceed smoothly while using step-up authentication for higher-risk transactions and unusual behavior.
- Strengthen tokenization and scoped payment controls. Use programmable tokens to limit what payment credentials and AI agents can access and do.
- Build platforms that can adapt as threats change. Integrate new fraud controls and intelligence without waiting for a major technology overhaul.
The next fraud frontier will test whether issuers can distinguish genuine customers from increasingly convincing impostors. Platforms built for continuous verification, adaptive controls and precisely defined trust can help issuers protect cardholders while preserving the seamless experiences customers expect.
