The New Fraud Challenge: When Fraud Looks Like Normal Customer Behavior

Igor Ermak

International Expert

Cybersecurity, Anti-Fraud, and Business Continuity for Financial Institutions

Artificial intelligence is usually discussed in terms of productivity, process automation and new business opportunities. But technology is available not only to companies. It is also available to those looking for ways around the rules. Almost everything AI can offer a legitimate business, it can also offer a fraudster.

From an anti-fraud perspective, it is important to recognise that AI has not created fundamentally new types of fraud. Most of the underlying schemes existed before. What has changed is the cost, speed and scale at which they can be executed.

Igor Yermak, an international expert in cybersecurity, anti-fraud and business continuity, suggests looking at the problem from an attacker’s perspective. Drawing on real cases, he explains how AI supports more sophisticated fraud schemes, why identity verification alone no longer provides sufficient protection and which tools can help uncover an attack.

Intelligent Bots Are Becoming Standard Fraud Tools

One of the clearest consequences of generative AI has been the spread of increasingly intelligent bots.

Until recently, large-scale fraud operations depended on teams of human operators. Those teams had to be trained, equipped with the necessary infrastructure and continuously monitored for performance and quality.

Many of those tasks can now be automated. Generative models can produce interaction scripts, adapt messages for different languages and markets, assist with programming and help configure automated workflows. This lowers the barrier to entry for new fraudsters and makes existing schemes much easier to scale.

Modern bots also look less and less like conventional bots. They can imitate real users, move through customer journeys and adapt to existing controls. As a result, bot detection is no longer purely a security problem. It increasingly affects product design, customer experience and risk management.

Identity Verification Is No Longer Enough

For many years, security systems were built around verifying identity. They checked documents, telephone numbers, payment cards and customer photographs. Modern fraud schemes, however, often rely on genuine data. Criminals may have access to real accounts, personal information and even active customer profiles.

The system sees valid information and successfully completes all the required checks, yet the person using the data is not its legitimate owner.

This is why anti-fraud is shifting away from relying primarily on identity checks. More attention is now paid to behaviour, the customer’s digital environment and the context in which they interact with the service.

Behaviour Can Reveal More Than a Customer Profile

Behavioural and transactional analysis has become one of the foundations of modern anti-fraud.

Money obtained through fraud must be received somewhere and eventually used. That means the behaviour of a fraudster will, sooner or later, differ from that of an ordinary customer.

Genuine customers use financial services as part of established patterns in their lives. They receive income, pay for goods and services, and make recurring transactions.

Fraudulent accounts and cards behave differently. Even when criminals try to imitate normal activity, statistical patterns begin to emerge over time.

The most useful models therefore look beyond a single transaction. They analyse a customer’s activity over a longer period. This allows companies to identify segments with a very low probability of fraud and concentrate additional checks where the risk is materially higher.

When Successful Models Begin to Undermine Themselves

A few years ago, social graph analysis was widely seen as a promising source of fraud signals. The assumption was that a person’s digital history could provide credible evidence of legitimacy. A genuine user would have friends, contacts, a history of interaction and a long-standing presence on social media. Fraudsters often had none of these.

That assumption has become less reliable. Criminals have learned to create large numbers of fake accounts and build artificial networks around them. Many of the signals that once appeared dependable no longer provide the same level of assurance.

The lesson is broader than social graph analysis. Every anti-fraud control that works well will eventually attract the attention of attackers, who will adapt their behaviour around it.

Device Fingerprinting: Fraud Detection in the Detail

Device fingerprinting is one of the most revealing areas of modern anti-fraud analytics.

A device fingerprint combines the technical and behavioural characteristics associated with each interaction between a user and a digital service.

These may include:

• browser configuration;
• device characteristics;
• screen resolution;
• network settings;
• signs of VPN use;
• geolocation;
• patterns of interaction with the interface;
• behavioural characteristics of the user.

Many of these attributes appear insignificant on their own. In practice, small details can expose an unusual pattern of activity.

Selfie capture provides a useful example. Most customers take selfies in a way that is natural to them. A departure from common patterns does not prove fraud, but it can provide an additional risk signal. When combined with other factors, these details can make a meaningful contribution to reducing exposure.

Even the way a customer takes a selfie can provide an additional risk signal

Anti-fraud systems rarely rely on one attribute. Their effectiveness comes from combining many weak signals. Each may look harmless in isolation, but together they can form a consistent and revealing picture.

Anomalies Matter More Than Averages

Most management systems focus on averages. Anti-fraud teams are more interested in deviations: unusual concentrations of events, sudden increases in activity, atypical combinations of attributes and recurring patterns.

Geographical monitoring of applications is one example. In one case, the territory was divided into a grid and specialists tracked how application volumes were distributed across different areas and how they changed over time. The analysis could reveal unusual concentrations of activity or an unexpected decline in areas where volumes would normally be higher.

Mapping the geographical distribution of applications can reveal anomalous areas of activity and help assess traffic quality

Traffic-source monitoring provides another example. If applications from one channel begin to default in large numbers, the cause may be fraud. But it could also indicate a problem with a partner, intermediary or contractor. A series of consecutive defaults may therefore justify a closer investigation.

Another useful approach is to identify concentrations and repeated events. When the same unusual action occurs five or more times in succession, the likelihood of coincidence falls considerably. Repeated sequences of this kind are often the first visible sign of an organised scheme.

The Real Investigation Begins After the First Transaction

Fraud investigations need to examine entire chains of activity.

Traditional security tends to focus on the moment of attack. Anti-fraud looks more broadly at the sequence of actions that led to it.

In one case, fraudsters first gained access to a customer’s account. They then changed the passport details, created a new profile using the customer’s correct identity data and submitted an application through that profile using different contact details and payment information. Once the transaction was complete, the original account was deleted.

Each action appeared permissible when viewed on its own. The full sequence, however, revealed an organised fraud scheme.

Sequence analysis can expose a fraud scheme that remains invisible when individual actions are reviewed separately

Another case involved a large number of requests to delete customer accounts. At first, these appeared to be routine customer service requests. Analysis later found dozens of requests from the same telephone number relating to different accounts.

Further investigation uncovered links between account deletions, changes to telephone numbers, replacement bank details and subsequent attempts to apply for loans.

Across these cases, investigators connected attacks through recurring IP addresses, telephone numbers, payment cards and customer service requests. None appeared suspicious in isolation. The links between them revealed that apparently separate incidents were the work of an organised group.

GEO and New Points of Influence

Anti-fraud teams are also beginning to consider the implications of generative search and Generative Engine Optimisation, commonly known as GEO.

Users increasingly receive answers directly from AI systems instead of visiting websites and comparing multiple sources themselves. This creates new opportunities for manipulation and new questions about trust.

It is still too early to speak of established fraud models built around GEO. But as AI search becomes more widely used, the integrity of automatically generated answers will become an increasingly important risk issue.

Deepfakes and the Changing Role of Biometrics

Advances in image and video synthesis are creating new challenges for remote identity verification.

Previously, the main threats were forged photographs and copied identity documents. Fraudsters can now use much more sophisticated techniques, including video stream injection, virtual cameras and various forms of deepfake technology.

Modern technology can replace a face in a video or generate a completely synthetic human image

This does not mean that biometrics no longer work. It means that biometrics alone are no longer enough. Identity matching has become one layer within a broader control framework.

Liveness detection provides an additional line of defence. It checks not only whether the face matches a stored template, but also whether the system is interacting with a real person at that moment.

Some liveness checks ask the user to perform simple actions in front of the camera, such as turning their head or moving a hand. These actions are more difficult to reproduce using a pre-recorded image or video.

What This Means for Business

Artificial intelligence is expanding the capabilities available to fraudsters. The central challenge for risk management is not simply to deploy more technology, but to change the way suspicious activity is analysed.

In the past, anti-fraud systems looked for suspicious customers. Increasingly, they need to look for suspicious behaviour.

But as fraudsters become better at imitating genuine users, the obvious warning signs are disappearing.

The most serious risk over the next few years may not be that criminals learn to bypass every control. It may be that businesses can no longer tell the difference between an attack and normal customer behaviour.