Preparing the latest insights, services, and analytics view for you.
Please wait
AI-enabled fraud
Fraud has not changed its purpose. What has changed is that a familiar voice, a recognisable face, a professional email and a convincing document can all be generated. Controls that quietly depend on a person recognising something as genuine are the ones most exposed.
55%
of reported cybercrimes across Africa are being enabled by artificial intelligence, according to INTERPOL reporting from 36 member countries.
INTERPOL, August 2026
4.5x
more profitable than traditional methods, which is how INTERPOL describes AI-enhanced fraud in its global assessment.
INTERPOL, March 2026
77%
of anti-fraud professionals surveyed by the ACFE and SAS reported a slight to significant increase in deepfake social engineering over the past two years.
ACFE and SAS, March 2026
7%
of those same professionals said their organisation is more than moderately prepared to detect or prevent AI-fuelled fraud.
ACFE and SAS, March 2026
What AI changes
AI-enabled fraud is fraud strengthened by artificial intelligence, used to automate the work, scale it across many targets, personalise each attempt, fabricate identities, media and documents, or run parts of a campaign with little human involvement, spanning generative techniques that produce convincing content and agentic techniques that carry out sequences of actions.
Most organisations have built their fraud defences around recognition. A caller sounds like the finance director, an invoice looks like the one that arrives every month, a supplier letter carries the right logo, an applicant presents documents that appear consistent. Those judgements were reasonable while producing a convincing fake took skill, time and money.
Generative tools have removed that cost. Voice, video, correspondence and supporting documents can now be produced quickly, cheaply and at a quality that a trained person cannot reliably distinguish, and the same tooling personalises each attempt using information that is already public. INTERPOL describes this as the industrialisation of fraud, and reports AI-enhanced fraud as substantially more profitable for criminals than traditional methods.
The practical consequence for management is narrow and serious. Any control whose strength rests on someone recognising a person, a voice or a document has quietly weakened, and it has weakened without any change to your systems, your policies or your risk register.
Where it shows up
These are not exotic scenarios. Each one lands in a process most organisations already run, usually where a person is expected to make a judgement quickly.
Video and audio of a senior executive, a client or a supplier can now be generated convincingly enough to carry an instruction. SABRIC has warned South Africans specifically about cloned voices, deepfake video and impersonated institutions.
Typically lands in: Payment approvals, urgent instructions, call centres, executive assistants
INTERPOL reports criminals combining real personal data with fabricated elements to create entirely synthetic identities that are designed to pass verification, including biometric checks, and open accounts.
Typically lands in: Customer onboarding, credit and account opening, supplier registration
Invoices, bank letters, proof of payment, identity documents and supporting evidence can be produced or altered at a quality that defeats a visual check, which weakens any control that rests on a document looking right.
Typically lands in: Accounts payable, claims, procurement, onboarding evidence
INTERPOL records business email compromise becoming markedly more sophisticated where AI generates highly convincing correspondence, and the same tooling personalises messages at scale.
Typically lands in: Email, messaging, customer channels, internal approvals
Public information about your leadership, your suppliers and your processes is now cheap to assemble into a convincing pretext, so the attacker arrives already knowing how your organisation works.
Typically lands in: Finance, treasury, HR, procurement
Banking-detail changes, fake vendor onboarding and invoice manipulation become harder to challenge when the request, the documents and the follow-up call all appear legitimate.
Typically lands in: Vendor master data, payment runs, procurement
Volume is no longer a constraint. Attacks that once required a skilled operator per target can now be run against many targets at once, with each one tailored.
Typically lands in: Customer channels, digital onboarding, loyalty and rewards
AI systems that can plan and run a fraud campaign largely on their own, from researching a target through to making the demand, with far less operator time than before. This is still emerging rather than routine, and worth watching rather than worrying about.
Typically lands in: Any channel that accepts requests continuously, such as email, web forms and self-service portals
Where it belongs
It is tempting to hand AI-enabled fraud to the security function, because the tooling is technical. That reading misplaces the risk. In most of these cases nothing is hacked. An authorised person is persuaded to do something they are entitled to do: release a payment, change banking details, approve an account, accept a document as proof.
Detection technology has its place, and the market is moving: in the ACFE and SAS benchmarking study a quarter of organisations now use AI or machine learning in their anti-fraud programmes. Tools alone do not decide the outcome. The decisions that matter are governance decisions. Which actions require verification that cannot be satisfied by a convincing voice or document? Who is allowed to authorise an exception, and on what evidence? How does a junior employee challenge an instruction from someone senior without career risk? Who owns the question of what a new fraud method means for this organisation?
Those are management questions, and they sit inside the fraud programme rather than inside the security stack.
What readiness looks like
High-consequence actions are authorised through verification that does not depend on recognising a face, a voice or a writing style. Staff have a defined way to confirm an instruction that does not rely on the channel the instruction arrived in.
Onboarding, account recovery, supplier registration and payment-detail changes are protected by checks that assume documents and media can be fabricated.
Where a document or recording supports a financial decision, the organisation confirms it against an independent source rather than assessing how convincing it looks.
Frontline staff, managers and executives understand that a familiar voice, a realistic video or a professional-looking document may be generated, and they know exactly what to do when something feels wrong.
Challenging a senior instruction carries no career risk, and the route for doing so is known, quick and used.
Someone is accountable for interpreting developments in AI-enabled fraud and deciding what they mean for the organisation’s controls, systems, people and customers.
How MK helps
MK does not treat this as a separate practice. It is an evolving fraud-risk vector, addressed through the way MK already works.
Establish where AI-enabled methods could reach your organisation, which decisions currently depend on recognising a person or a document, and where that leaves you exposed.
About assessDesign verification, authorisation and escalation that hold when identity, voice and evidence can be fabricated, and place accountability for those controls with named owners.
About buildPrepare frontline staff, managers and executives to act on the possibility that what they are seeing or hearing was generated, and to confirm before they commit the organisation.
About enableInterpret developments in AI-enabled fraud as they occur and translate them into specific changes to your controls, systems, people and customer journeys.
About monitorWhere Fraud Readiness fits
We would rather be precise about this than imply more than the instrument currently does.
The Fraud Readiness Assessment examines the control environment that AI-enabled fraud has to pass through. Its digital and identity domain covers:
The current questionnaire does not yet ask about deepfakes, voice cloning or synthetic identities by name, so it should not be read as a comprehensive test of those specific exposures. Questions that name AI-enabled methods directly, including synthetic media, voice-cloned instructions, synthetic identities and AI-generated supporting documents, are being added to the instrument. AI-specific exposure is examined directly in an advisory engagement in the meantime.
How your result is produced
Your readiness result is not decided by generative AI. Fraud Readiness uses an expert-designed deterministic assessment engine: your responses are evaluated against defined fraud-risk logic, scoring rules, maturity thresholds and control criteria. Under the same methodology version, the same responses produce the same underlying result.
AI does not determine your assessment result. Where it is used, it operates downstream of the validated assessment logic.
Where generative AI is used, it is limited to drafting the plain-language interpretation of results already determined by the validated assessment logic, and its output is validated before presentation.
Speak to MK about the AI-enabled exposure specific to your organisation, or use the Fraud Readiness Assessment to understand your core fraud readiness first.