AI fraud drives banks toward biometric identity defenses

New survey data from KPMG shows a majority of banking executives preparing for AI to cause major disruptions to established business models. The 2026 Banking Technology Survey says 80 percent of respondents anticipate “significant shifts” over the next three-to-five years, and are making adjustments accordingly.

“What we’re seeing across the banking sector is a convergence of priorities – AI, payments modernization, cybersecurity, and tech-driven M&A are no longer separate agendas,” says Peter Torrente, who leads KPMG’s U.S. Banking Sector activity, in a release. “That shift exposes the challenge to keep pace across technology, risk, and growth simultaneously.”

Headline numbers show a cascade effect: 76 percent of banking executives say they have seen an increase in the number of cybersecurity attacks on their banks in the last year. In response, 92 percent are increasing their budgets to address the risk. And 84 percent are increasing cybersecurity investment specifically to address risks introduced by AI.

Operational efficiency and automation is receiving the most investment in the next 12 months, but security and fraud prevention is a close second.

Among top threats are AI-introduced vulnerabilities in code, deepfakes and securing agentic technologies. Eighty percent of banks are implementing regular audits to ensure data security, privacy and compliance.

Notably, uptake in adoption of biometric tools is set to increase; 32 percent of banking leaders say they are already using AI-enabled biometrics to secure payments and access management  – but 72 percent plan to integrate the technology over the next three years.

Defense tools must evolve at speed of fraud

An article from J.P.Morgan dives into fraud in the age of AI. Insights from authors Vincent Meluzio from J.P. Morgan Payments and Douglas Wilbert from Accenture are consistent with the larger industry view: “fraud risk is on the rise, yet 60 percent of surveyed financial institutions do not have a dedicated response plan with forensic tools to investigate agent-driven fraud.”

Defense technologies “must evolve as fast as the threats they’re designed to counter.”

“A static defense posture is a losing one. But technology is only part of the equation. It works best when complemented by fundamentals: knowing where to verify against an authoritative source, knowing what questions to ask and recognizing when something doesn’t feel right.”

The authors advocate for a culture of vigilance that includes training and clear escalation protocols, and note the importance of collaboration: “no single organization can solve the problem of deepfake fraud alone. By sharing intelligence, best practices and technology innovation, organizations can strengthen collective defenses in ways no one can achieve independently.”

Synthetic identities become banking’s next fraud battle

Proof’s latest post in its Fraud Files series looks at “Stolen Credentials, Fake Biometrics, and the Synthetic Identity Wave.” The piece says core assumptions about identity verification – “that some information stays secret, that documents can be trusted, and that a face in a camera is a real face” – are under “sustained, commercial-scale attack.”

It cites analysis from Shattered.io, drawing on research from Flashpoint and DeepStrike, which shows that infostealer malware exfiltrated more than 1.8 billion credentials from 5.8 million infected devices in 2025 alone. “DeepStrike found that stolen passwords and session cookies now appear in 86 percent of data breaches. Stolen logs are bought, repackaged, and resold through dark web marketplaces that operate like subscription services.”

Stolen identity data can be used to create synthetic identities. Proof says synthetic identity fraud is “the defining threat of 2026.”

“Fraudsters combine real SSNs, addresses, and birth dates with fabricated names and manufactured credit histories to create identities that have never existed, yet can pass onboarding checks.” These fake identities can accumulate credit histories over time; “by the time a synthetic identity executes fraud, it may have a year or more of clean transaction history behind it.” U.S. unsecured credit losses tied to synthetic identity fraud are projected to exceed $3.1 billion in 2026, and the threat is growing at roughly 16 percent annually.

A major vector for synthetic identity attacks is injection. Injection attacks bypass the camera to work on the software or hardware level, “injecting pre-generated synthetic media directly into the video stream before verification occurs, so the system processes a manufactured image from the start.”

No longer the domain of technical specialists, these fraud tactics are available on the commercial market. “The Deepfake-as-a-Service market has a customer support channel, subscription tiers, and repeat buyers. Biometric injection attacks are straightforward commercial transactions.”

A takeaway is that layered defenses combining biometric verification, device analysis and behavioral risk scoring are now a baseline requirement. “Static attributes can’t anchor identity.

Each of these attack patterns works because it targets a system built on the wrong foundation.”

Entrust adds biometric risk-based authentication

Entrust has launched “a new approach to preventing account takeover in the age of AI.” According to a release, the Entrust Biometric Authentication product combines biometric identity verification with adaptive risk-based authentication to protect critical and high-risk interactions. It takes the verified identity established at enrollment and “extends it across every access point and interaction,” anchoring it to a biometric check, providing defense against presentation, injection, and deepfake attacks by requiring identity assurance at key moments.

“Too many organizations are treating authentication as a login problem, but attackers have already moved beyond access,” says Mike Baxter, chief technology and product officer at Entrust. “Preventing account takeover in the age of AI requires confirming the person behind every interaction. Entrust helps organizations apply the right level of assurance at the right moments while delivering secure, low-friction experiences.”

Per the release, the solution uses three authentication methods, designed for different levels of risk. A biometric passkey provides biometric authentication at high-risk moments by binding authentication to a verified human identity. Face authentication speeds up everyday verification and step-up authentication. And motion authentication helps defend against deepfake, replay, and injection attacks in high-assurance use cases with ISO/IEC 30107-3 PAD Level 1 & 2 conformant liveness detection, independently tested by iBeta Quality Assurance.

Banks accelerate fraud technology spending

A new survey commissioned by behavioral biometrics firm BioCatch notes the “disconnect between detection and investigation” at play in the Benelux market.

“While banking leaders in the region report relatively strong confidence in their fraud controls, 82 percent say their bank still spends more than a day investigating fraud cases, which is significantly above the global average,” says BioCatch Director of Global Fraud Intelligence Thomas Peacock, in a release.

However, investment is coming. “Benelux respondents overwhelmingly say their bank plans to upgrade its fraud prevention technologies, with 92 percent reporting planned investments and 59 percent saying their organization is either already implementing new solutions or actively evaluating vendors.”

Voice biometrics joins layered defenses

Voice security products provider Illuma is partnering with UK Credit Union to bring advanced authentication and fraud prevention capabilities to the credit union’s contact center and self-service channels, according to a release.

UK Credit Union will implement Illuma’s IllumaSHIELD platform, which offers real-time voice authentication technology as the core offering, with options to add advanced fraud prevention, adaptive multi-factor authentication (MFA), deepfake detection, and human-AI collaborative intelligence. The platform continuously evaluates risk, allowing the credit union to step up authentication when needed.

“AI-driven fraud is forcing financial institutions to rethink how they secure the voice channel,” said Milind Borkar, CEO of Illuma. “UK Credit Union is taking a forward-looking approach by adopting voice security that continuously verifies identity, blocks threats in real time, and improves both the member and agent experience – while eliminating friction from every interaction.”

Article Topics

adaptive authentication  |  AI fraud  |  BioCatch  |  biometrics  |  Entrust  |  financial services  |  Illuma Labs  |  Proof