“TRUST STARTS & ENDS WITH THE TRUTH”
“TRUST STARTS & ENDS WITH THE TRUTH”
Matt is both the company founder and a nationally renowned private investigator. Matt is an intelligence specialist who excels in detecting and preventing the illegal interception of communications and in providing high-tech covert surveillance. Matt has years of hands on experience in the investigation industry and has developed a reputation for incorporating state of the art technology and innovative ideas to provide effective solutions for his clients. Matt also serves as Treasurer for the Executive Board of Directors of FALI, The Florida Association of Licensed Investigators.
AI fraud prevention for financial institutions is the use of machine learning to score transactions, logins, and identity documents for fraud as they happen. We work the cases that follow those scores. The same phrase also covers a second problem, which is fraud that criminals build with AI, and this guide addresses both for banks and credit unions.
Financial institutions use AI to prevent fraud by having machine learning models score payments, logins, and new account applications for risk, then sending the highest scores to a reviewer or an automatic hold.
The US Treasury runs the same approach on its own payments. In fiscal year 2024, Treasury reported more than $4 billion in fraud and improper payments prevented or recovered, up from $652.7 million in fiscal year 2023. Machine learning AI accounted for $1 billion of that total by speeding up the identification of Treasury check fraud, and prioritizing high-risk transactions prevented another $2.5 billion.
Vendors sell that capability to banks and credit unions as “AI fraud prevention.” The phrase gets used loosely, and the table below separates the common assumptions from what federal sources say.
| What people assume | What is true |
|---|---|
| AI fraud prevention means one thing | The phrase covers using AI as a defense and stopping fraud that criminals make with AI |
| A fraud score settles the case | A score starts a review that still needs evidence and a written record |
| Only the largest banks can use it | Smaller institutions often lack the data to train their own models, according to a 2024 Treasury report |
| Deepfake detection software is enough | FinCEN lists a detection software flag as one red flag among nine |
| Federal model risk guidance covers generative AI | Guidance issued on April 17, 2026 leaves generative and agentic AI models out of its scope |
AI fraud detection works by training a model on past account activity so the model can score new activity for risk. A payment, login, or application that departs from a customer’s usual pattern receives a higher score. Staff review the highest scores, and the outcomes of those reviews feed the next round of training.
Federal alerts and complaint data point to three kinds of AI-enabled fraud at banks and credit unions: deepfake identity documents at account opening, impersonation behind payment requests, and synthetic identities.
Deepfake identity documents. The Financial Crimes Enforcement Network (FinCEN) issued alert FIN-2024-Alert004 in November 2024. Starting in 2023, the bureau saw more suspicious activity reports describing deepfake media, with fraudulent identity documents used to get around identity verification.
Red flags:
Impersonation behind payment requests. The FBI’s Internet Crime Complaint Center recorded 24,768 business email compromise complaints and $3,046,598,558 in losses in 2025. Complaints flagged as AI-related made up $30,256,592 of that amount, and AI-related complaints across every crime type reached 22,364 with $893,346,472 in losses. When a forged request has already moved money, our investigators handle AI-driven business email compromise cases by identifying how the message was built and tracing the attack to its source.
Synthetic identities. A synthetic identity pairs real personal details with invented ones to create an applicant who does not exist. Generated documents make those applicants harder to catch at onboarding, and our guide to how synthetic identity fraud works covers the bust-out pattern and the Social Security Administration’s eCBSV check.
Generative AI is used in fraud to produce fake identity documents, photos, video, and text that can pass for real during an identity check. FinCEN’s 2024 alert describes criminals altering or creating identity documents with these tools to open accounts, then using those accounts to receive and move money from other fraud schemes.
Federal agencies and the ACH rule-making body expect financial institutions to report deepfake-related suspicious activity, monitor ACH payments for fraud, and manage the risk of the models they rely on.
Suspicious activity reporting. FinCEN’s alert asks institutions to include the key term FIN-2024-DEEPFAKEFRAUD in suspicious activity reports tied to suspected deepfake media, and it reminds them of their reporting duties under the Bank Secrecy Act.
ACH fraud monitoring. Nacha writes the rules for the ACH network. Phase 1 of its fraud monitoring rules took effect on March 20, 2026 for the highest-volume participants, and Phase 2 extended the requirement to every receiving institution on June 19, 2026. Covered institutions need risk-based processes and procedures for identifying entries that are unauthorized or “authorized under False Pretenses.”
Model risk management. The Federal Reserve, the OCC, and the FDIC issued revised model risk management guidance on April 17, 2026, replacing the 2011 guidance known as SR 11-7. The agencies call the new guidance most relevant to banking organizations with over $30 billion in total assets. Generative and agentic AI models are “not within the scope of this guidance”, so banks using those tools in a fraud program have to look to their wider risk management practices.
Credit unions. In May 2025, the Government Accountability Office recommended that the National Credit Union Administration update its model risk management guidance to cover a broader variety of models used by credit unions.
The points above are general information about US federal rules. How they apply to one institution is a question for its compliance officer or counsel.
AI fraud detection stops working at two points: when the real customer authorizes the payment, and when the institution lacks the data to train a model.
Payments the customer approved. A customer talked into sending money by an impersonator logs in from the usual device and approves the transfer personally. Nacha’s rules give the category a name. False Pretenses, in Nacha’s definition, covers a payment induced by a person who misrepresents an identity, an authority to act for someone else, or the ownership of the account being credited.
The data gap. Treasury interviewed 42 companies for a March 2024 report on AI in financial services. Smaller institutions, the report found, generally lack sufficient internal data and expertise to build their own anti-fraud AI models, while larger competitors hold far more historical data. Treasury also found too little fraud data sharing among firms.
A fraud model works like a smoke alarm. The alarm tells you which room to check, and someone still has to find out how the fire started and who was in the house.
AI-based fraud systems have three main limitations. A payment approved by the real customer can look normal to a model. Smaller institutions often lack the historical data to train one, according to Treasury. A fraud score is also a probability, so a person still has to confirm what happened and put the findings in writing.
After the model flags a transaction, a person has to act on the money, confirm what is real, and document the evidence.
Example (illustrative, not a client case): A credit union in Central Florida opens an account online after a live video check. Three weeks later the account receives four incoming wires in two days and sends the money back out. The fraud model flags the outflow, and two questions remain that the score cannot answer: whether the face on the onboarding video was generated, and where the funds went next.
Results depend on how much of the trail still exists and how quickly the work starts.
Has a flagged account left you with a video, a voice recording, or a wire you can’t explain?
Our AI investigation work for banks and financial institutions includes Deepfake & Voice Clone Detection and Synthetic Identity & Behavior Mapping. We examine the file and the transaction trail directly and report what the evidence shows.
See how an AI investigation works
Confidential and handled by a licensed Florida investigator.
A smaller bank or credit union can start with the verification practices FinCEN describes, the steps Federal Reserve Governor Michael Barr laid out for banks in 2025, and a tested plan for what happens after an alert.
Governor Barr told an audience at the Federal Reserve Bank of New York in April 2025 that banks should add facial recognition, voice analysis, and behavioral biometrics to identity verification. He also called for staff training that stays current and for banks to work with other financial institutions on defining threats and controls.
Recommended:
The last item on that list is our own advice, drawn from fraud cases where the first hours went to deciding who was responsible for what.
For banks, credit unions, and financial platforms, our consultants offer Risk & Vulnerability Assessments and Employee Cybersecurity Awareness Training, and most engagements open with a security assessment for banks and credit unions.
Southern Recon Agency is a Florida licensed private investigation agency, License A1400197, based in Orlando and serving Tampa, Sarasota, and Osceola County. Private investigation licensing is set state by state, so ask us about availability for matters outside Florida.
AI tools can flag signs of a generated photo or video at account opening, and FinCEN treats a detection software flag as one red flag among nine. FinCEN also names phishing-resistant multifactor authentication and live verification checks as practices that reduce exposure. A flag calls for a closer look at the applicant’s other documents and data.
Nacha’s rules have required every receiving institution, credit unions included, to maintain risk-based processes for identifying ACH credits that may involve fraud since June 19, 2026. The rules call for risk-based processes and leave the technology unnamed, so the method is each institution’s decision. Machine learning is one option among several.
Contact the receiving institution to request a hold or recall, then file a complaint at ic3.gov with the full transaction details. The FBI’s Recovery Asset Team froze $679,013,183 in 2025, which was 58% of the attempted theft in the incidents it handled. Keep the original emails, recordings, and login records untouched for the investigation.
FinCEN asks financial institutions to include the key term FIN-2024-DEEPFAKEFRAUD in a suspicious activity report when the activity involves suspected deepfake media. The request comes from alert FIN-2024-Alert004, issued in November 2024. Reporting duties under the Bank Secrecy Act are a compliance matter, so confirm filing decisions with your BSA officer or counsel.
A licensed investigator can examine suspect video, audio, and documents for signs of AI generation, trace where funds went, and document the findings for a report, an attorney, or police. Southern Recon Agency lists banks and financial institutions among the clients of its AI investigation work. Results depend on how much of the trail remains.
AI fraud prevention for financial institutions means two things: using machine learning to score transactions and identity checks for fraud, and stopping the fraud that criminals now build with AI. Treasury credited machine learning with $1 billion in recovered check fraud in fiscal year 2024, and FinCEN has warned banks about deepfake identity documents since November 2024. Models miss payments the real customer approved, and smaller institutions often lack the data to train them. After an alert, act on the money, preserve the original files, verify the media, trace the funds, and document the findings.
If a model flagged the fraud, the remaining questions are who built the fake and where the money went.
We verify suspect media, trace the funds, and document the findings for your fraud team, your counsel, and law enforcement.
Request a confidential case review
Call (844) 307-7771. Florida licensed agency A1400197.
Matt Aubin, CDFE, is the founder and managing partner of Southern Recon Agency, a Florida-licensed private investigation agency (License A1400197) that he started in 2010. He is a Certified Digital Forensics Examiner, a Certified TSCM Technician, and a Florida Board Certified Investigator, and a court-qualified expert witness in cyber intelligence and cyber forensics. He is a member of the U.S. Secret Service Miami Electronic Crimes Task Force and FBI InfraGard Tampa.
Everything in this article is general information and is not legal or financial advice. For guidance on a specific situation, consult a licensed attorney or compliance professional.