For decades, financial institutions have tended to treat fraud where an accountholder is tricked into voluntarily making a transaction as a different problem than third-party unauthorized transactions and similar activities. Traditionally, the latter involves a third party other than the validated accountholder accessing an account or initiating a transaction, whereas the former occurs when accountholders approve transactions after being deceived or manipulated by the third party. While this distinction may seem trivial, it has major implications for institutions on everything from liability to regulatory treatment and compliance obligations.

The rise of generative AI has shifted this divide even further, with more fraudsters now using this technology to create convincing communications, impersonate trusted individuals, automate social engineering, and influence customers at a much larger scale. On the surface, a transaction may look completely legitimate: properly authenticated, initiated from an authorized, recognized device, and consistent with a customer’s historical behavior. And despite all of this, it could still be fraudulent.

The crux of the problem is that authorization and intent are not necessarily the same. A customer may legitimately authorize a payment believing that they are investing in a real opportunity, without realizing it was fabricated by a fraudster. Despite the customer’s transaction approval, the authorization was based on deception and does not reflect the customer’s true intent.

This creates a particularly complex challenge for financial institutions since most methods of fraud detection traditionally rely on identifying anomalies. Activities like unusual transaction amounts, unfamiliar devices, new beneficiaries, changes in location, or other deviations from established customer behavior have typically served as important fraud indicators, but they now only tell part of the story.

Source link