How artificial intelligence is transforming both financial-crime defence and the economics of fraud
Artificial intelligence has become one of the financial sector’s most promising weapons against fraud, money laundering and other forms of illicit finance. It can analyse millions of transactions, connect behaviours across accounts, rank alerts, identify hidden networks and help investigators focus on activity that deserves attention. Yet the same capabilities that make AI attractive to banks are also becoming available to criminals.
That creates an uncomfortable possibility for the industry: AI may make individual financial-crime controls more effective while simultaneously making the overall threat environment harder to police. The result is not a straightforward technology upgrade. It is an arms race in which detection, deception and adaptation are all becoming faster.
The latest evidence shows why the distinction matters. The Financial Action Task Force said in February 2026 that cyber-enabled fraud had become one of the most widespread and damaging profit-motivated forms of crime, with 156 jurisdictions—90% of those assessed by FATF—identifying fraud as a major money-laundering risk. Its assessment specifically points to phishing, AI-enabled deepfakes and messaging platforms as tools increasingly used by fraudsters. (FATF, Cyber-Enabled Fraud (2026))
AI Is Already Improving the Defender’s Field of View
Traditional transaction-monitoring systems were largely built around rules: flag a transfer above a threshold, identify an unusual jurisdiction, detect a sudden change in account activity, or trigger an alert when a predefined scenario occurs. These rules remain important, but they struggle with criminal behaviour that is deliberately fragmented across accounts, institutions and payment channels.
Machine learning changes the problem from asking whether one transaction looks suspicious to asking whether a pattern of relationships looks abnormal. The Bank for International Settlements has highlighted how machine-learning models can combine transaction behaviour, know-your-customer information and investigator-labelled data to detect patterns that narrower rule-based systems may miss. (BIS Annual Economic Report 2025)
The most striking recent test is Project Hertha, a collaboration between the BIS Innovation Hub and the Bank of England. Using a synthetic dataset representing 1.8 million accounts and 308 million transactions, the project tested modern AI techniques against complex and coordinated financial-crime patterns. When payment-system analytics were added to banks’ own detection methods, participating institutions identified 12% more illicit accounts. For previously unseen behaviours, the improvement reached 26%. (BIS Innovation Hub, Project Hertha)
Those results matter because sophisticated financial crime is rarely contained within a single institution. A mule network can distribute funds across dozens or hundreds of accounts. Individual banks see only their own fragment of the activity; a payment infrastructure or appropriately designed shared-analytics layer can potentially see the network.
The False-Positive Problem Is One of AI’s Strongest Arguments
Financial-crime controls have long suffered from an operational paradox. Banks must cast a wide enough net to avoid missing suspicious activity, but a wider net can produce huge volumes of alerts that turn out to be legitimate. Investigators then spend time clearing false positives rather than examining genuinely risky behaviour.
AI can improve prioritisation by learning from historical cases, identifying combinations of behaviours that matter, and ranking alerts according to risk. It can also assist with the investigative process itself: summarising account activity, linking entities, extracting information from documents and preparing case narratives for human review.
That is one reason regulators are experimenting with the data foundations required for more advanced AML models. In April 2026, the UK Financial Conduct Authority published work with the Alan Turing Institute and industry partners on a synthetic anti-money-laundering dataset created from patterns in UK retail-banking data. The project is designed to make financial-crime innovation easier where privacy and legal restrictions limit access to real customer information. (FCA, Synthetic Data and Anti-Money Laundering)
The direction is clear: better models require better data, better labels and better feedback from investigators. AI cannot compensate indefinitely for fragmented customer records, inconsistent risk classifications or poor case outcomes. In financial crime, the quality of the learning loop may ultimately matter more than the sophistication of the algorithm.
But Criminals Are Receiving the Same Productivity Upgrade
The defensive case for AI would be easier if criminals were standing still. They are not.
INTERPOL’s 2026 Global Financial Fraud Threat Assessment describes financial fraud as one of the world’s most severe and rapidly evolving transnational crime threats. It reports that AI-enhanced fraud is 4.5 times more profitable than traditional methods and warns that agentic AI can be used to automate parts of a fraud campaign, from reconnaissance through to execution. INTERPOL also links the growth of scams to organised criminal networks, specialist money-laundering groups and industrial-scale scam centres. (INTERPOL Global Financial Fraud Threat Assessment 2026)
Generative AI alters the economics of deception. A criminal no longer needs fluent language skills to produce credible phishing messages in multiple languages. Voice-cloning can imitate executives, relatives or officials. Image and video generation can create synthetic identities, fake evidence and deepfake calls. Large language models can help tailor scripts to the target, maintain long conversations and remove the spelling and grammatical errors that once acted as warning signals.
The FBI has repeatedly warned that criminals are using generative AI to support romance scams, investment fraud, impersonation, fraudulent identity documents and social engineering. Its 2025 Internet Crime Complaint Center annual report recorded more than 22,000 complaints containing AI-related information, illustrating how quickly AI has moved from an emerging concern into everyday fraud reporting. (FBI IC3, 2025 Internet Crime Report)
Deepfakes Attack the Assumptions Behind Identity Verification
Modern digital banking rests on a series of trust signals. A face is assumed to correspond to a real person. A voice is assumed to belong to the person speaking. A government document is assumed to represent a legitimate identity. A video call can provide additional assurance when an unusual payment is requested.
Generative AI weakens every one of those assumptions. FATF’s December 2025 horizon scan on AI and deepfakes examines precisely this emerging AML/CFT risk: systems that can create convincing synthetic identities or impersonate real people at increasing scale. The problem is not merely that one fake may pass one check. Criminals can continuously test onboarding and verification processes, learn which combinations work and automate attempts. (FATF, Horizon Scan: AI and Deepfakes)
The US Federal Trade Commission provides a sense of the wider impersonation problem. It reported that consumers lost $3.5 billion to imposter scams in 2025, up nearly 20% from the previous year. Not all of those losses involved AI, but AI makes the underlying model more scalable by improving the realism, localisation and persistence of impersonation attempts. (FTC, 2025 Imposter Scam Losses)
Fraud Detection Can Become Fraud Adaptation
There is another structural challenge. Machine-learning systems improve when they receive feedback. Criminal networks can also learn from feedback—sometimes faster.
When a transfer is blocked, an account is closed or an onboarding attempt fails, the criminal receives information about the institution’s controls. At scale, repeated attempts can reveal which transaction sizes, timing patterns, devices, identity characteristics or behavioural sequences are more likely to succeed. AI can help attackers process that feedback and modify tactics.
This turns fraud into an optimisation problem. The attacker does not need to understand the bank’s model. It needs only to discover a path through it. As defensive systems become more dynamic, adversaries can become more dynamic too.
That creates a risk familiar from cybersecurity: defenders must secure an entire process, while an attacker needs to find only one exploitable weakness. Financial institutions therefore need to think beyond model accuracy and consider adversarial testing, model drift, synthetic-identity attacks, data poisoning and attempts to manipulate automated decision systems.
AI Cannot Solve the Information-Sharing Problem by Itself
Financial crime often succeeds because information is divided among organisations. One bank sees a suspicious beneficiary. Another sees a newly opened mule account. A telecommunications company sees SIM activity. A social-media platform sees the original fraudulent advertisement. A cryptocurrency exchange sees funds converted into digital assets. Law enforcement may hold intelligence connecting the individuals behind the network.
No individual AI system can identify what its organisation cannot see. This is why the most promising anti-financial-crime use cases increasingly depend on network analytics, shared intelligence and public-private cooperation rather than simply installing a better model inside each bank.
FATF’s 2026 cyber-enabled-fraud paper emphasises rapid information sharing, international cooperation and asset recovery. INTERPOL’s response similarly focuses on cross-border coordination and stop-payment mechanisms. The implication is important: artificial intelligence can improve detection, but institutional fragmentation remains a human and legal problem. (FATF, Cyber-Enabled Fraud) (INTERPOL, Global Financial Fraud Threat Assessment)
Explainability Still Matters When the Stakes Are High
There is a temptation to treat a more accurate model as automatically superior. In financial crime, that is not sufficient.
A suspicious-activity decision can affect whether an account is investigated, restricted or exited. It can create regulatory reporting obligations and trigger costly investigations. Investigators therefore need enough transparency to understand why a system has identified a relationship as suspicious and what evidence supports the conclusion.
Project Hertha explicitly identified labelled training data, robust feedback loops and explainable AI as important conditions for effectiveness. The FCA’s broader 2026 review of AI in retail financial services likewise highlighted the simultaneous operational opportunities and amplified fraud and cyber risks created by more capable AI systems. (BIS Innovation Hub, Project Hertha) (FCA, Mills Review on AI in Retail Financial Services)
The goal should not be to make every model mathematically simple. It should be to ensure that consequential alerts can be investigated, challenged and audited. A financial-crime system that produces excellent risk scores but cannot tell investigators what changed, which data mattered or how the alert relates to known typologies may create a different kind of operational risk.
The Weakest Link May Move From Detection to Identity and Social Engineering
As banks improve transaction monitoring, criminals have an incentive to move earlier in the chain. Instead of laundering clearly stolen money through a compromised account, they can persuade the legitimate customer to authorise the payment. Instead of breaking an authentication mechanism, they can manipulate the person who possesses the credentials.
This is why authorised push-payment fraud, romance scams, investment scams and impersonation attacks are so important to the AI debate. The transaction itself may look legitimate because the genuine customer initiated it.
The FCA’s work on romance fraud illustrates the challenge. Its review found that 85% of romance-fraud cases started online and highlighted the importance of detection systems, trained staff, vulnerability identification and interventions before payments are completed. AI can help recognise behavioural signals, but the control environment must still be designed around how people are manipulated. (FCA, Combating Romance Fraud)
The future fraud-control stack will therefore need to combine transaction analytics with behavioural biometrics, device intelligence, identity verification, network analysis and well-designed customer interventions. No single model can cover the entire attack surface.
The Human Investigator Becomes More Important, Not Less
AI is often described as a route to reducing compliance headcount. That framing risks missing where the technology creates value.
The strongest use of AI is to remove low-value investigative work: gathering information from multiple systems, summarising transactions, identifying connected parties, prioritising alerts and drafting routine documentation. That allows specialist investigators to spend more time on judgment, escalation and complex cases.
Human expertise remains particularly important when criminal behaviour is novel. Models learn from prior data; investigators interpret emerging typologies, contextual clues and behaviour that has not yet produced a large labelled dataset. If organisations allow automation to weaken investigator capability, they may become less resilient precisely when criminals change tactics.
Regulators Will Judge Outcomes, Not the Sophistication of the Model
Banks should also resist the idea that deploying AI provides a regulatory defence when controls fail. Supervisors continue to focus on the effectiveness of customer due diligence, monitoring, governance and escalation regardless of whether the underlying technology is conventional or AI-driven.
The FCA’s 2026 review of customer due-diligence controls reinforces this principle. Its findings centre on policies and procedures, CDD and enhanced due diligence, compliance monitoring and audit. AI may improve each layer, but it does not remove the institution’s responsibility to understand customers, manage risk and test whether controls work. (FCA, Customer Due Diligence Processes and Controls)
For boards and senior management, the relevant questions are therefore practical. Where is AI making a decision? What data is it using? How is performance measured? What happens when criminals change behaviour? How are false positives and false negatives reviewed? Can investigators override the model? Can the institution reconstruct why a case was closed? And can the system be manipulated by hostile inputs?
The Winning Architecture Will Be Collective
The most important lesson from the emerging evidence is that no institution can automate its way out of financial crime alone.
AI gives banks better pattern recognition. It gives payment systems a wider network view. It can help regulators analyse larger datasets and help investigators connect previously separate cases. But criminals benefit from the same falling cost of intelligence. They can generate content, imitate people, coordinate campaigns and adapt their methods more quickly.
The institutions best positioned for this environment will combine four capabilities: high-quality internal data; AI models that can be tested and explained; experienced investigators who understand how criminals adapt; and rapid information sharing across banks, payment providers, technology platforms, regulators and law enforcement.
The strategic objective should not be the elimination of alerts or the replacement of investigators. It should be a financial-crime system that learns faster than the criminals attacking it.
Conclusion: AI Will Change the Balance, Not End the Crime
Artificial intelligence can materially improve the fight against financial crime. Project Hertha provides concrete evidence that network-level analytics can uncover illicit accounts that institution-level controls miss. Synthetic data and improved machine learning can strengthen training and detection. Generative systems can accelerate investigations and make compliance teams more productive.
But the same technological curve is lowering the cost of deception. Deepfakes make impersonation more convincing. Generative AI makes scams more scalable and multilingual. Agentic systems may allow criminals to automate larger parts of a fraud campaign. As detection improves, criminals can shift toward social engineering, synthetic identity and other techniques designed to make fraudulent transactions appear legitimate.
AI is therefore unlikely to eliminate financial crime. The more realistic outcome is continuous competition between increasingly automated attackers and defenders.
For banks, the decisive advantage will not come from possessing the most sophisticated model. It will come from combining technology with data, governance, intelligence sharing and human judgment—and doing so quickly enough that criminals cannot turn innovation into a permanent advantage.
References
2. Financial Action Task Force (FATF) — Horizon Scan: AI and Deepfakes (2025)
5. INTERPOL — Global Financial Fraud Threat Assessment 2026
6. FBI Internet Crime Complaint Center — 2025 Internet Crime Report
8. Financial Conduct Authority — Synthetic Data and Anti-Money Laundering: Project Report (2026)
9. Financial Conduct Authority — Mills Review: Impact of AI on Retail Financial Services (2026)
12. FBI IC3 — Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud