Providers need ongoing identity checks to counter AI fraud

Fraud prevention starts with the providers granting access

A false card-charge alert reaches a customer through a communication service that a provider has made available to the sender. A delivery text about a nonexistent package and an unsolicited company offering to solve an invented problem depend on similar access. Teaching people to recognise deception helps, but recipients encounter these approaches after a provider has already admitted the sender. That earlier decision gives providers a responsibility to establish who is using their services.

International Fraud Awareness Week offers a chance to examine how providers meet that responsibility. Alongside asking whether customers can spot a suspicious message, organisations should ask whether the business behind a phone number, account or storefront is genuine. Identity checks inform the decision to grant access, while supervision and repeated checks inform the decision to maintain it. Providers control these decisions before a customer faces a fraudulent approach.

AI makes those decisions harder because it can improve both the message and the identity behind it. A convincing communication may lead back to an equally convincing digital presence, even when both are fabricated. Providers therefore have their own identity problem to solve. Understanding how AI changes deception helps explain where their checks need to work.

AI makes impersonation easier to produce and harder to detect

AI affects both the quality of an attempted fraud and the work needed to prepare it. Michael Machado, Chief Information Security Officer, RingCentral, cites research showing “97% of UK and US organisations” using AI. He warns that technology available for ordinary business tasks also helps attackers create persuasive messages and impersonations. RingCentral benefits commercially from customers’ confidence in its services’ security, so his recommendations carry a business stake as well as a security purpose.

For employees and customers, Machado says, this can mean natural-sounding messages, familiar-sounding voices and credible-looking documents. Better impersonation makes deceptive interactions harder to distinguish from legitimate ones, while easier production reduces the effort needed to attempt fraud. The risks he describes include staff impersonation, cloned voices, fabricated documents and realistic written approaches. In his assessment, AI lowers the skill needed to begin and shortens the time between preparing and launching attacks.

These methods also appear in legal disputes involving cryptocurrency. Pete Chapman, Partner and Head of Web3 and Digital Assets at Richardson Lissack, describes his firm’s experience: “We have fought, and won, cases where fraudsters have used AI to clone voices and fake documents, targeting the speed and cross-border openness of crypto markets,” he says. Richardson Lissack has a commercial interest in demand for fraud-related legal advice and representation. Chapman describes attackers exploiting fast transactions and activity across national borders, which can leave less time to intervene.

Voice impersonation can target a victim directly, but fabricated documents also matter earlier, when a business applies for services. An applicant can use credible-looking material to persuade a provider that an invented company is genuine. The provider must therefore assess the identity behind the application as well as the information entered on its forms. At this stage, AI-assisted deception can turn an administrative approval into access for a fraudulent business.

Business verification must establish who is behind the application

To assess an applicant, providers use know-your-business checks to establish a business customer’s identity when it first applies for services. Rebekah Johnson, Founder and Chief Executive Officer of Numeracle, argues that AI makes this task harder by helping criminals assemble the outward signs of a legitimate company. Her company sells business-verification services, so it benefits commercially when providers give these checks greater importance. Johnson says Numeracle verifies the businesses behind “more than 4,000 brands.”

Johnson’s fabricated-company example begins before the application reaches a provider. “In an afternoon,” she says, an attacker can build a persuasive business presence. A plausible website gives a reviewer somewhere to look, while email domains and polished correspondence make the applicant’s communications fit the same identity. Each element appears to support the others, even though they were created together to sustain a deception.

The supposed staff can make that presence look more credible. Johnson describes invented employees with active social-media profiles, including people who like the target’s posts. This activity gives reviewers the impression that the company employs people who take part in ordinary professional exchanges. What looks like several independent signs of legitimacy may therefore be parts of the same fabrication.

Once the identity is assembled, the applicant can complete the provider’s forms accurately. Johnson warns: “It can fill out every form correctly and get approved. The paperwork checks out. The business isn’t real.” Her point is that an approval procedure can accept the submitted information while failing to establish whether the applicant is genuine. Completing the paperwork and verifying an identity answer different questions.

The consequences extend beyond the application because approval gives the applicant something to use. Johnson identifies a telephone number for contacting people, a bank account for receiving money and a storefront for selling. These facilities support different stages of a fraudulent operation: reaching a target, collecting funds and presenting a transaction as ordinary commerce. Approval has value because of what it enables.

Recipients encounter that activity only after the provider has made its decision. A deceptive caller uses a number already supplied; a payment reaches an account already opened; a buyer visits a storefront already made available. The providers of those facilities can examine the business before these encounters occur. They have an earlier opportunity to prevent a fabricated company from gaining access.

Johnson uses this opportunity to question the weight placed on consumer awareness. Scammers study how to exploit people’s vulnerabilities, so a system that depends chiefly on recipients recognising each attempt leaves a major prevention task with the target. Education can help recipients respond, while providers can examine the identity of the business seeking access. Their responsibility follows from their control over the facilities that make contact and transactions possible.

That responsibility continues after approval because an initial mistake can remain useful to the applicant. Johnson describes a business admitted on its first day and then receiving no further review. If the first assessment accepted a fabricated identity, continued service preserves the fraudster’s use of the number, account or storefront. An inaccurate record can therefore become a continuing means of reaching people or collecting money.

To address this exposure, Johnson calls for providers to revisit the identity behind the relationship. “Whoever gives a business a way in has to know who they’re letting in and keep checking,” she says. Under this approach, approval starts a relationship in which identity remains a condition of service. The provider keeps deciding whether the business should retain access as the relationship develops.

Johnson bases this requirement on her argument that anonymity helps fraudulent businesses operate, while genuine companies can demonstrate who they are. Establishing business identity would therefore become a condition of receiving and retaining access. For someone answering a call or entering a transaction, the intended benefit is greater confidence about the organisation on the other side. The provider’s checks support that confidence before the recipient has to judge the approach.

Identity checks sit within a wider fraud-control programme

Business verification addresses the fabricated applicant, but other attacks require controls elsewhere in the organisation. An attacker impersonating an employee may approach a target directly, and an insider may already have legitimate access. These risks call for decisions about employees’ use of AI, their ability to recognise suspicious activity and the organisation’s response when fraud occurs. Continuing customer checks address one part of that broader programme.

For these wider risks, Machado recommends starting with the security measures an organisation already uses. Teams should assess which risks those measures can handle and which new ones need additional safeguards. When introducing AI, they need to examine how it changes the organisation’s exposure and adjust controls accordingly. AI can make an existing threat easier to carry out or make deceptive material more convincing, so familiar safeguards need to be tested against those changes.

Machado also connects technical safeguards to organisational decisions. Clear guidance on AI use gives employees expectations to follow, training helps them recognise unusual activity, and human supervision provides a way to review what happens. He recommends continuing to assess whether these measures work as AI becomes part of everyday operations. The focus is whether safeguards remain effective as working practices change.

Employee training serves a different purpose from asking consumers to identify every scam. Employees work within organisations that can control systems, approve actions and respond to incidents, so recognising suspicious activity can lead directly to an organisational decision. Johnson’s concern is the burden placed on people receiving fraudulent approaches. An organisation can strengthen its employees’ ability to act while taking more responsibility for the businesses it enables to contact customers.

Training becomes more useful when an organisation has practised responding to a warning. Chapman urges businesses to use “Fraud Awareness Week” to examine controls, train staff and prepare their response before an incident occurs. He recommends a simulated incident to test readiness under conditions resembling an actual event. The exercise lets a business examine how its people and controls work together when an attempted fraud demands action.

These preparations support the risk-management objective Machado describes: “The goal is not to eliminate all risk, but to make informed decisions to manage it effectively,” he says. Verification, training, supervision and response preparation each address particular risks, so their usefulness depends on the decisions they enable. A team assessing a control needs to understand which risk it should manage and whether it helps the organisation act.

That assessment must also cover people who already work inside the business. Chapman warns that employee and internal fraud can cause financial damage and regulatory exposure, alongside growing risks of third-party litigation and criminal proceedings. He says these risks can potentially create liability across the organisation. Internal controls therefore remain necessary even when external business customers’ identities have been established.

Key highlights

• Prevention starts with access: Providers of phone numbers, accounts and storefronts control an early opportunity to stop fraud. Business identity checks belong in the decision to grant access, before customers encounter a deceptive approach.
• AI strengthens fabricated identities: Convincing websites, employee profiles and documents can support an invented company. Provider verification teams need to establish whether the business is genuine, because accurate forms can still support a false identity.
• Verification continues after approval: A fabricated business can retain useful access when its identity receives no further review. Providers need repeated identity checks throughout the customer relationship to inform decisions about continued service.
• Fraud controls need practical testing: Security teams need to assess existing safeguards against AI-assisted impersonation, document fabrication and internal fraud. Clear AI-use rules, staff training, human supervision and simulated incidents help test whether the organisation can recognise and respond to an attack.