Security Brief: "AI Makes Business Fraud Harder to Detect, Warn Experts"

The following article was originally published by Security Brief.

‍

"Security and fraud specialists have warned that artificial intelligence is making business fraud harder to detect, as organisations review fraud risks during International Fraud Awareness Week.

Executives and advisers said AI is being used to create more credible scams, impersonate staff and set up fake companies that can pass onboarding checks. Businesses therefore need stronger controls, closer oversight and more frequent verification of business customers.

One concern is the speed at which fraudsters can assemble convincing digital identities, including websites, email domains and social media profiles that resemble legitimate corporate activity.

Another is the use of AI in direct attacks on staff and customers. Security professionals said cloned voices, fabricated documents and realistic written messages can increase the chances of a successful fraud attempt.

"AI is now central to daily business, with research showing 97% of UK and US organisations using it. While offering massive potential, it elevates security risks. Fraudsters use AI to create convincing messages and impersonations, obscuring authentic interactions. AI-assisted attacks also lower the barrier to entry for threat actors while accelerating attack cycles," said Michael Machado, Chief Information Security Officer, RingCentral.

Machado said businesses should not rely on technology alone when introducing AI into their operations. Governance, staff awareness and regular reviews of controls remain essential, he said.

"Just as technology by itself cannot eliminate fraud, technology in isolation does not achieve security in any domain. When adopting AI, publishing clear usage guidelines, training staff to identify anomalies, implementing human oversight and evaluating control effectiveness on an ongoing basis all play important roles, much as they do in fraud prevention," Machado said.

"Key considerations when deploying AI include assessing both how fundamental security practices are addressed and what is new, so existing practices can be extended where they apply and new safeguards can be put in place for genuinely new risks," he added.

"The goal is not to eliminate all risk, but to make informed decisions to manage it effectively," Machado said.

‍

Identity Checks

Rebekah Johnson, Founder and Chief Executive Officer of Numeracle, argued that fraud prevention still places too much responsibility on consumers. She said the bigger weakness sits earlier in the chain, with businesses that issue accounts, phone numbers or storefront access to other businesses.

AI has made it easier for criminals to present themselves as legitimate companies during know-your-business checks, Johnson said. In her view, a one-off approval process leaves gaps that can persist long after onboarding.

"We've all gotten a call or text that looked real but wasn't: a fake alert about a charge on your card, a delivery notice for a package that doesn't exist, a company offering to fix a problem you never had. Most fraud awareness focuses on teaching people to recognize scams like these. But asking everyone to spot every scam puts the burden on the wrong people. Scammers study human vulnerabilities and exploit them for a living.

"The better question is how the scammer reached you in the first place. Scammers need a way in: a phone number to call from, a bank account to collect money, a storefront to sell from. More and more, they get it by posing as a business. AI makes that easy. In an afternoon, a bad actor can build a convincing fake company: a website, polished emails, employees with active social media profiles who like your posts. All of it fake.

"It can fill out every form correctly and get approved. The paperwork checks out. The business isn't real. Checking once isn't enough, either. A company approved on day one that nobody looks at again has a free pass. We verify the businesses behind more than 4,000 brands. Identity is the foundation. Whoever gives a business a way in has to know who they're letting in and keep checking. Fraud thrives in anonymity. Verified business identity has to be a requirement, not an option. People deserve to know who's on the other end. Real businesses can prove who they are. Fake ones can only pretend," Johnson said.

‍

Control Testing

Pete Chapman, Partner and Head of Web3 and Digital Assets at Richardson Lissack, said AI-related fraud is exposing weaknesses in corporate controls as well as customer-facing processes. He pointed in particular to crypto markets, where speed and cross-border activity can make intervention harder once an attack is under way.

"Artificial intelligence is moving faster than the safeguards surrounding it. We have fought, and won, cases where fraudsters have used AI to clone voices and fake documents, targeting the speed and cross-border openness of crypto markets. For businesses, Fraud Awareness Week should be a prompt to test controls, train staff and plan responses before an incident occurs; a simulated incident is a great test. Likewise, examine employee and internal fraud. It is financially costly, a significant regulatory risk and a growing third-party litigation and criminal risk, potentially attracting liability across the organisation," Chapman said."