AI Fraud Arms Race: Synthetic IDs, Takeovers, and Risk Shifts – Emerj Artificial Intelligence Research

The modern fraud landscape presents financial institutions and money-movement platforms with a perpetually moving target. As digital transaction volumes soar globally, malicious actors continually refine their methods, adapting faster than traditional, static controls can keep pace. Rules designed around historical attack patterns frequently fail to capture sophisticated account takeovers (ATOs), while overly rigid controls often result in the wrongful blocking of legitimate customers, eroding revenue and damaging brand loyalty.

Recent data underscores the urgency of this challenge. According to a comprehensive study by the Association for Financial Professionals (AFP), payments fraud affected the vast majority of U.S. organizations recently, with 76% reporting either attempted or actual payments fraud. Among enterprises generating more than $1 billion in revenue, two-thirds suffered direct financial losses. Despite the growing sophistication of these threats, the same survey revealed a stark vulnerability: only 17% of organizations currently deploy artificial intelligence (AI) to combat fraudulent activities.

To dissect how modern enterprises can mitigate financial crime without sacrificing approval rates, industry leaders recently convened for an on-demand webinar hosted by Emerj. Daniel Faggella, CEO and Head of Research at Emerj, was joined by Debjit Saha, Vice President of Engineering and Product, Risk and Compliance at MoneyGram, and Jeff Otto, Chief Marketing Officer at Riskified. Together, the panel examined how money-movement businesses are leveraging advanced identity intelligence, rail-specific controls, and adaptive friction to outpace evolving threats.

The Evolution of Financial Crime: A Historical and Regulatory Perspective

The mechanics of financial fraud have shifted dramatically over the past decade. Historically, fraud detection relied heavily on rudimentary rule-based systems that flagged transactions based on basic criteria, such as geographic location or sudden spikes in transaction size. However, as financial transactions migrated rapidly to mobile applications, web portals, and digital wallets, criminal syndicates evolved from isolated actors into highly organized global networks.

Regulatory bodies have tracked this alarming evolution closely. An extensive analysis conducted by the Financial Crimes Enforcement Network (FinCEN), examining Bank Secrecy Act filings, highlighted the staggering scale of identity-related financial crime. FinCEN linked 42% of all reviewed suspicious activity reports (SARs) to identity-related fraud, totaling an astonishing $212 billion. The analysis revealed that bad actors systematically exploit identity processes across three critical stages: account creation, account access, and ongoing transaction processing.

Crucially, FinCEN’s findings demonstrated that compromised credentials carried a disproportionate financial impact compared to other forms of identity exploitation. Furthermore, the circumvention of identity verification protocols was cited as the single most frequently reported exploitation method among money services businesses.

These regulatory insights align closely with the daily operational realities faced by compliance executives. Debjit Saha, whose extensive background includes advising large global financial institutions as a senior management consultant at EY and managing complex risk frameworks at MoneyGram, notes that modern fraud patterns span an omnichannel spectrum. Attackers seamlessly transition between web channels, mobile applications, and physical walk-in locations.

According to Saha, the threat matrix now encompasses synthetic identities—which ingeniously blend genuine personal data with fabricated details—cross-channel account takeovers, compromised physical and digital documents, mule accounts, and social engineering schemes targeting call centers to force unauthorized password resets.

"You cannot identify fraud from a single signal," Saha explains. "You have to bring all the signals together to understand behavioral drift. The older rule-based approaches are no longer very effective, because fraudsters have become far more sophisticated. They know the rules and the patterns, and they use that to their advantage."

Unmasking the Dark Web Economy and Behavioral Drift

The sophistication of modern fraud rings is further evidenced by underground marketplaces. Jeff Otto, CMO at Riskified and former marketing leader at Marqeta and Salesforce, oversees analyst teams that continuously monitor fraud forums across both the dark web and the clear web. Recent observations from these intelligence teams indicate that aged, established user accounts command significantly higher prices on illicit forums than newly created ones.

Saha explains the strategic rationale behind this underground trade from a defender’s perspective. Traditional fraud controls are heavily front-loaded; they tend to scrutinize new customers intensely because their behavioral baseline is largely unknown. Conversely, established accounts that boast a lengthy history of legitimate activity often receive significantly less scrutiny from static monitoring systems. Fraudsters ruthlessly exploit this inherent institutional trust. By deploying social engineering tactics to steal legitimate credentials, bad actors execute illicit transactions that easily slip past legacy rules designed to spot anomalous behavior on fresh accounts.

To combat this, modern risk platforms utilize advanced machine learning and identity graphs to look beyond internal transaction histories. A first-time customer attempting a transaction on a platform with no internal historical record may nonetheless possess an extensive, well-documented track record—positive or negative—across a much broader, cross-merchant network.

Otto notes that risk analysis frequently traces a disproportionate share of total platform losses to a minuscule fraction of the user base—often around 20 basis points. Identifying and isolating these specific identities is akin to locating a few drops of poison in a vast lake. Identity graphs enable risk systems to recognize these malicious entities instantly, even when they attempt to conceal themselves behind newly registered accounts.

Rail-Specific Risk Controls: The Hidden Dangers of ACH Transfers

As money-movement businesses strive to offer maximum flexibility to their customers, they must navigate the distinct economic and risk profiles of various payment rails. Cards and Automated Clearing House (ACH) bank transfers represent two primary payment methods with vastly divergent operational characteristics.

While ACH transfers offer immense appeal due to low transaction fees and high conversion rates, those same economic advantages frequently attract sophisticated fraud rings. Otto highlights a stark contrast in industry metrics: Riskified’s analysis places typical ACH decline rates between 1% and 2%, compared to 10% to 15% in certain card verticals. Moreover, the average ACH transaction processed by these platforms is roughly 3.6 times larger than the average card transaction.

"ACH is a low-cost rail with high-cost surprises," Otto observes. "Depending on what you negotiate with your bank, transaction fees can be as low as 20 cents, which makes it very economically attractive for a good transaction. The problem is the risk profile; our analysis found that fraud attempts on ACH were 2.3 times higher than on credit cards. And unlike the card networks, you don’t have a dispute representment process. The bank just sends a return code, so there’s a real risk of losing the entire value of the transaction if you get it wrong."

Debjit Saha points out a fundamental ownership gap inherent to the ACH network. A malicious actor can successfully pass standard Know-Your-Customer (KYC) onboarding checks yet still fund an ACH transfer using a bank account that legally belongs to an entirely different individual.

In contrast, card fraud typically manifests through the use of a physically or digitally stolen card to purchase goods or services. Over decades, card networks and issuing banks have matured their defenses, establishing rigorous scrutiny around anomalies such as unusually large first-time transactions. Because card fraud defenses have tightened considerably, fraudsters have increasingly shifted their attention toward ACH rails, exploiting the looser historical controls surrounding bank account ownership.

Although modern solution providers now offer real-time verification tools to confirm bank account ownership, Saha emphasizes that verifying ownership remains a continuous, high-stakes engineering challenge. Consequently, executive leaders must architect rail-specific risk controls tailored to the unique vulnerabilities of each payment mechanism, ensuring that broader business profitability is maintained without compromising instant remittance expectations.

Balancing Security and Experience Through Value-Based Adaptive Friction

In an intensely competitive fintech and remittance market, customer experience is a primary differentiator determining whether a user completes a transaction or abandons the platform permanently. Overburdening customers with excessive identity verification challenges at every step creates friction that destroys conversion funnels.

To resolve this tension, industry leaders advocate for "adaptive friction"—a dynamic verification model that introduces friction and authentication steps only when concrete risk signals appear. The overarching objective is to allow the vast majority of legitimate, trusted customers to move seamlessly through the transaction funnel with minimal interference, reserving heightened security interventions strictly for anomalous behavior.

This strategic philosophy directly challenges traditional key performance indicators (KPIs) that measure fraud teams exclusively on fraud reduction. Otto warns against the dangers of myopic metric-setting: "You tell your fraud team to drive zero fraud, and then all of a sudden you’ve lost $100 million in legitimate business." Saha echoes a well-known industry axiom: "We can have zero fraud if we do zero transactions."

The solution requires adopting an enterprise-wide perspective on total conversion, where business stakeholders collaborate closely with risk engineering teams to determine precisely where protective measures add value rather than hinder growth. In ecommerce and high-volume financial services, businesses routinely calculate Customer Lifetime Value (CLV) to design tailored user experiences. Otto argues that this exact commercial logic must govern modern fraud decisioning, particularly when a high-value customer triggers an automated risk alert.

"Maybe in the old way of doing it, the rule would say decline, and now you have a high-net-worth customer with a high customer lifetime value that just got a really bad experience," Otto explains. "The numbers always show that if you give somebody a bad experience, one-third of the time they may never come back. So you really have to be careful, balance the risk with the experience, and segment your populations so you understand who the highest-value cohort is."

Rather than automatically declining transactions from valued cohorts, advanced platforms utilize concierge-level protocols. When a trusted customer triggers a risk threshold, the system can route the case to manual review, initiate direct communication to verify account integrity, or, where appropriate, couple the verification step with a loyalty incentive. This approach transforms a potential friction point into an opportunity to deepen customer relationships.

Data Enrichment as the Foundation of Future Risk Intelligence

Underpinning these sophisticated decision-making models is an absolute reliance on high-quality, enriched data. While customers experience a frictionless interface requiring minimal input, backend engineering teams ingest thousands of real-time data points. By synthesizing these signals into dynamic identity and behavioral graphs, platforms can accurately isolate subtle drift, identify synthetic profiles, and neutralize account takeovers before financial losses occur.

As financial institutions and money-movement platforms continue to modernize their compliance infrastructure, the strategic deployment of AI-driven identity intelligence and rail-specific controls offers a clear pathway forward. By treating risk management not merely as a defensive cost center, but as a sophisticated driver of total conversion and customer trust, enterprises can successfully safeguard their operations while capturing substantial growth in an increasingly digital global economy.