Online channels without verification face open season from agentic fraud: Incode CEO

Most of the online fraud committed by AI agents is not defeating digital defenses at all. As Incode CEO Ricardo Amper tells Biometric Update in an email interview discussing the company’s agentic AI fraud report, in typical fraud scenarios “the victim is an ordinary person on a channel with no verification layer whatsoever.”

Incode’s report sets the context for the explosive growth of agentic fraud by reviewing the rapid development of public AI tools from the introduction of ChatGPT in November 2022 to the growing adoption of agents. By the time we get to our present day in that narrative, AI is producing “native fluent scam text” for use in phishing attacks.

The company notes Nasdaq Verafin’s finding that global fraud losses reached $579.4 billion in 2025, but more worryingly shows that the rate of fraud and the use of AI in carrying it our are increasing rapidly. Incode found AI use in 44 of 66 incidents it documented for the report.

More automated and more convincing

The increase in agentic fraud is not driven by substitution, Amper says, with some categories falling as others rise.

“The data shows the opposite: nearly every major fraud category is growing simultaneously, while the human workforce behind fraud did not really increase. Human-directed fraud isn’t declining; it’s being amplified. The people haven’t left the equation, they’ve moved up, from running the scam to running the machine.”

The attacks are channel-agnostic, and can be delivered through a favorite platform or communication method as easily as the caricatured Nigerian princess used email. The common thread among romance scams, investment fraud, executive impersonation, phishing and other kinds of scams is that “strip away the labels,” Amper says, “and almost all of it is social engineering: convincing a human that they’re talking to someone they can trust.”

“What AI changed is that the convincing part, the fluent conversation, the credible persona, the patience, used to be the expensive human ingredient, and now it’s cheap.”

The result is that the indications people were previously able to rely on to tell sincere communications from scams – characteristics like broken grammar, generic scripts and unnatural pauses are gone.

Stopping the growth of scams will therefore depend on expanding “the whole identity layer, from IDV and KYC outward” to far more places, according to Amper.

4 developments coming over the next 18 months

Authorization protocols like x402 will help make AI agents more useful for completing payments, but a side-effect of that improvement could be that agents carrying out social engineering fraud can more easily pay for the services they need.

The parts of the online ecosystem where agentic fraud and social engineering thrive, meanwhile, are those that require no more proof of humanity than the submission of an email address.

Not every biometric liveness check is equal, Amper points out, and most of the internet is not protected by any liveness at all.

Amper warns that the striking fraud curves seen in the report’s charts are continuing to angle upwards as the criminal supply chain industrializes.

Over the next 18 months, the CEO is anticipating four important developments in agentic fraud.

Fraud-as-a-service will evolve into something more like agent-as-a-service offering dedicated to fraud, or “turnkey autonomous operations sold on subscription, no skill required.” Attackers will shift their focus from consumers to enterprises as primary targets, meaning more synthetic jobseekers and impersonated executives. Attacks against account recovery and customer support processes will increase. (Incode launched biometric verification for password resets to the Auth0 marketplace just weeks ago.) And agent-versus-agent engagements will begin, with autonomous defenses and attacks “iterating against each other in real time.”

The bottom line is that Incode believes “within two years, the majority of fraud losses will come from schemes planned and carried out by machines rather than people. Businesses that respond with more friction will lose twice — to the fraud and to their own funnel. The ones that treat this as an identity problem, proving the human root behind every account and every agent, are the ones that will do well.”

The internet, it seems, is going to need a lot more verification.

Article Topics

AI agents  |  AI fraud  |  biometric liveness detection  |  biometric verification  |  Incode