How financial services firms can protect against AI fraud

When OpenAI CEO Sam Altman warned of the looming AI Fraud Crisis, it served as a wake-up call to banks and other financial institutions increasingly using or considering digital voice ID to authenticate customers – an approach that could open the door for fraudulent money transfers and significant account losses.

At the banking regulatory conference hosted by the Federal Reserve, Altman stated, "I am very nervous that we have an impending, significant fraud crisis”, before underscoring the urgency of the crisis, “…some bad actor is going to release it – this is not a super difficult thing to do. This is coming very, very soon”.

AI fraud crisis, a multi-faceted challenge

AI isn’t solely a risk to bank customers’ personal and business account funds. It is also negatively impacting the ability of financial institutions to engage with customers, protect their brand reputation, and maintain trust in the critical voice channel.

Engagement challenge

Seventy-two percent of Americans refuse to answer phone calls from numbers they don’t recognize.

This is a very real problem for banks and other financial organizations, not only to engage with customers efficiently but also to protect them from scammers spoofing legitimate brands.

Despite the widening trust gap and value of delivering an omnichannel experience, consumers still want to engage via the voice channel.

64% of adults still prefer to engage with their financial services provider via a phone call over any other method (text messaging, apps, website).

Financial services firms are ‘high-touch’ organizations that depend on outbound communications to engage customers, verify identities, complete applications, share policy and account updates, and confirm appointments.

But with more customers screening and declining unidentified calls, these crucial updates often don’t reach the intended target, leading to delays in customer service.

Technology challenge

There is a direct correlation between the erosion of bank customer trust in the voice channel and the threat of scams.

Our own recent survey finds nearly three-quarters (74%) of Americans feel there has been a rise in robocall scams posing as trusted banks and credit unions.

In some cases, empowered by AI, bad actors are creating more sophisticated scams by generating realistic voices or spoofing phone numbers to impersonate financial institutions, making it difficult for Americans to distinguish legitimate calls and texts from fraudulent ones.

The proliferation of AI-generated robocalls has not only increased the volume of scams but also made it easier for bad actors to make these scams more convincing. 63% of US adults have either experienced or know someone who received an AI-generated deepfake robocall.

Brand protection challenge

Financial institutions often leverage real-time outreach via the voice channel to communicate potential fraud attempts, verify identities, and better serve their customers.

Robocall bad actors are aware of this routine and exploit it, ultimately making it difficult for customers to discern legitimate calls from nefarious ones.

Placing the call authentication burden on the customer exposes them to financial fraud and also poses a significant risk to the bank’s reputation if scams are successful.

In one high-profile case, a Chase Bank customer lost over $120,000 from his checking account. He received a call from an 800 number that matched Chase’s customer service, asking to verify a suspicious transaction.

He was prompted to log in to his account through a secure link sent via text message. From there, the bad actors captured his login information and stole funds.

Regulators and policymakers dial in

The Federal Trade Commission (FTC) has taken several preventative measures to address AI scam risks, such as finalizing a rule in 2024 to combat impersonation of governments and businesses.

It also launched a voice cloning challenge aimed at developing ideas to protect consumers by detecting and halting the misuse of voice cloning software by unauthorized users, according to the FTC.

The FTC is not the only regulatory body to take action against AI voice and text robocalls.

Following a a highly publicized deepfake impersonation of President Biden during the 2024 primary season, the Federal Communications Commission (FCC) immediately ruled that AI-generated voices in robocalls were illegal under the Telephone Consumer Protection Act.

The ruling authorized the FCC and state attorneys general to pursue legal action under TCPA if AI was detected in scam calls.

Emerging alternatives to voice authentication

As bad actors become more sophisticated with AI tools and spoofing technologies, digital voice identification is no longer a sufficient line of defense.

Banks and other financial services firms must shift towards a more holistic authentication strategy that incorporates:

Deliver inbound call transparency

By including more critical call information – the institution’s name, logo, and reason for calling – directly on the recipient’s phone screen, banks can ease the burden on customers to play private investigator on whether or not the call is legitimate.

It also increases their likelihood that customers will confidently engage with the call: nearly two-thirds (66%) of Americans will answer a branded call from their financial services provider, and 58% would be more comfortable sharing personal information over such a call.

Invest in call authentication and spoof protection

Call authentication ensures that only verified, branded calls are delivered to customers, blocking any unauthenticated or spoofed calls in real-time.

Finally, by identifying and stopping spoofed calls before they reach their customers, financial institutions eliminate the risks of brand impersonation, shield their customers and maintain the integrity of their communications.

Proactively protecting against inbound risks

Scammers are not focusing exclusively on using fraudulent calls to target customers. Increasingly, they are attempting to trick and manipulate IVRs and call agents into releasing personal customer account information.

Banks should therefore focus on a zero trust policy that includes three lines of defense to eliminate inbound threats:

Voice firewalls to manage inbound calls by blocking or redirecting spam and spoofed calls as well as protecting against Telephone Denial of Service (TDoS) attacks;
Risk assessment for each call, providing enhanced security screening to verify customer identity;
Detection of synthetic and cloned voices to eliminate any AI-based voice call from reaching the intended end-user.

As consumers grow more aware of scams, they expect financial services firms to do more to protect them.

Nearly 70% of Americans say they would pay more for services that offer stronger protections, and 83% believe financial institutions should be doing everything possible to protect them from fraud.

Securing the voice channel from AI threats is the foundational step forward for financial services firms to enhance their customer experience and grow their bottom line.

Author bio

Greg Bohl is the Chief Data Officer for TNS’ Communications Market business and is responsible for leading its data science and analytics strategy.

In this role, he ensures the company is maximizing the value of the data assets associated with its trusted services, including its voice spam filtering and mobile call authentication, branded calling, mobile roaming and inter-carrier connectivity.

Join our network of finance professionals to get advice and share your thoughts, make new connections and expand your network, and find your next career opportunity.

Dialing back in: How financial services firms can protect against AI fraud crisis