The future of payment fraud could be automated
Payment fraud is becoming more organized as criminal groups use fake websites, large-scale operations, and, in some cases, forced labor to steal money and personal information. Advances in agentic AI could automate many stages of payment fraud, from collecting and assembling stolen credentials to deploying password-cracking tools.
What kind of payment fraud concerns you most? (Source: Capco)
CAPCO’s “US Payment Fraud Survey” found that consumers increasingly value fraud protection when choosing payment providers. Security was one of the most important factors for 63% of respondents, and 50% selected advanced fraud protection. Both ranked ahead of customer service, transaction speed, brand reputation, and rewards.
“Payment fraud in the US is becoming more organized, automated and sophisticated, with scammers increasing their use of modern technologies and AI-enabled tools. Our US Payment Fraud survey highlights the value consumers put on security and advanced fraud protection, as well as their concerns about key defenses including some forms of biometric authentication,” said Matthew Cohn, Partner & US Head of Banking & Payments at Capco.
Account takeover fraud
Account takeover remains one of the most common payment fraud threats. Attackers use stolen credentials to gain access to bank accounts, transfer funds, open credit accounts, or create mule accounts. They obtain credentials through phishing campaigns, data breaches, dark web marketplaces, and information people share online.
35% of respondents ranked account takeover as one of their top payment fraud concerns, and 25% of those who experienced an attempted payment fraud said someone tried to take over their account.
Defenses such as passwords, security questions, and some forms of MFA are becoming less effective as criminals use AI to improve phishing campaigns and automate credential theft.
Deepfake technology is increasing the risk for voice and facial biometric authentication. Eighty-nine percent of respondents said they were concerned that personal information available online could help attackers impersonate them or answer security questions.
Why APP fraud keeps growing
Authorized push payment (APP) fraud has become one of the fastest-growing payment fraud threats because victims authorize the transaction after scammers manipulate them. Attackers impersonate bank employees, government agencies, company representatives, or family members to convince victims that their money is at risk or that an urgent payment is required.
Scams begin with a text message, email, or phone call before escalating into conversations designed to build trust and create a sense of urgency.
AI-generated audio, video, and other content are making these impersonation scams more convincing and easier to scale. Criminals are exploring ways to make fraudulent transactions appear legitimate by creating the impression that customers authorized the payment.
Card fraud moves to digital channels
Payment card fraud increasingly relies on stolen card numbers and personal information. Criminals obtain payment data through phishing campaigns, fake websites, skimming attacks, compromised payment terminals, and dark web marketplaces. They then use the stolen credentials to make online purchases or add cards to digital wallets.
More than 90% of credit card fraud involves cards that remain in the owner’s possession. The continued growth of ecommerce and online payment data storage has expanded opportunities for card fraud.
Card and card data theft was the payment fraud concern cited most often by survey respondents, with 46% selecting it. One-third of respondents who experienced an attempted payment fraud said it involved card or card data theft.
Website skimming and automated card credential testing are becoming more common. North America accounted for 51% of global website skimming detections.
“Fraudsters are selling data, services and tools to each other as they build an AI-enabled criminal industry on a global scale. To strengthen defenses and preserve consumer trust, banks and other payment institutions must adopt a coordinated stance across each enterprise, the wider financial sector and other relevant industries,” said Gregg Henzel, Managing Principal, US Financial Crime, Risk, Regulation and Finance at Capco.
Criminals create synthetic identities at scale
Identity fraud allows criminals to open bank accounts, apply for loans, and obtain credit using stolen personal information. Synthetic identity fraud goes a step further by combining real and fabricated information to create new identities.
The share of newly opened bank credit card accounts linked to synthetic identities more than doubled between mid-2021 and mid-2024. Auto lenders carried an estimated $2 billion in synthetic identity debt by mid-2024. Criminal groups are using AI to combine stolen credentials, create convincing documents, and bypass liveness checks during identity verification.
Insider fraud expands the attack surface
Insider fraud remains a significant payment fraud risk because employees and contractors can abuse their access to systems and customer data or help external attackers bypass security controls. Insiders may steal money or credentials, share sensitive information with criminal groups, override fraud controls, or expose organizations through negligence.
Third-party providers can expand the attack surface, making third-party risk management an important part of insider fraud prevention.