Global fraud losses hit $442 billion in 2025: How AI is changing the economics of financial crime

Global fraud losses reached $442 billion in 2025, according to the Bureau Global Fraud Intelligence Report 2026, released at the Global Fintech Fest (GFF) 2026 earlier this week.

The report highlighted the figures mentioned in the 2026 INTERPOL Global Financial Fraud Threat Assessment earlier this year.

Bureau, a global unified risk decisioning platform, launched “The Bureau Global Fraud Intelligence Report 2026: AI, Identity, and the Future of Fraud Defense” at the Global Fintech Fest (GFF) 2026.

The 7th edition of GFF was held in Mumbai from 8 to 11 September 2026.

The report examined fraud dynamics across North America, Europe, the UK, Southeast Asia, APAC and MENA, combining primary data from INTERPOL, FATF, Europol and the FBI with signals observed across Bureau’s global network.

It revealed how AI, synthetic identities, fraud-as-a-service, and interconnected networks are reshaping fraud at scale, and what institutions must do to stay ahead.

Key findings of Bureau's report

The Bureau’s Global Fraud Report claimed that AI has fundamentally altered the economics of fraud, making capabilities, that once required advanced technical skills, increasingly accessible and attacks repeatable across institutions at near-zero marginal cost.

"Capabilities that once required advanced technical skills are now commoditised, allowing attacks to be repeated across institutions at near-zero marginal cost," the report stated.

1. 'AI made the expensive part of fraud cheap'

Creating a convincing fake identity used to take real time, skill, and money. According to the report, generative document synthesis, deepfakes, and voice cloning have eliminated this barrier.

"Synthetic profiles are now cultivated across multiple lenders for months before coordinated bust-outs. Consequently, synthetic-linked account takeover (ATO) events tripled in a single quarter," the report claimed.

This simply means that, because it costs them practically nothing, scammers can throw the exact same fake profile at bank after bank until someone falls for it.

2. Attacks are repeated, not invented

Bureau’s network identified nearly 14,000 organised fraud rings in H1 2026. One in three rings involved identities that resurfaced in subsequent attacks, and one in four spanned multiple industries. The largest network linked over 45,000 identities.

3. Real-time rails eliminate intervention windows

When you transferred money in the past, there was a delay before the payment officially went through, giving banks time to spot suspicious activity and freeze the transfer.

But now, as FedNow, UPI, and Faster Payments scale (instant payment systems), the delay between authorisation and irreversible settlement has effectively reached zero.

The report revealed that ATO (Authorization to Operate) risk surged nearly 70 percent between April and June 2026, with over 1 in 8 ATO sessions exhibiting social engineering signals.

AI agents as an emerging attack surface/ AI is shopping for us—and posing as us

As autonomous AI agents begin to browse, authenticate, and pay on behalf of consumers, institutions face traffic that is automated by design.

Legitimate agentic activity frequently triggers the same signals as malicious botnets.

Distinguishing an authorised AI agent from an adversarial one will become a critical risk decision within the next 24 months.

4. Mule infrastructure remains the primary bottleneck

The report claimed that approximately 1 in 170 global onboarding applications was flagged as a suspected mule account.

Geographic concentration remained stable over five consecutive quarters, pointing to permanent, organised recruitment infrastructure exposed to coordinated disruption.

5. 'Visibility gap'

RanjanR. Reddy, Founder and CEO of Bureau, was quoted as saying in the report, "Every institution is looking at a fraction of the same attack. An identity that gets declined at one bank is approved at the next within the hour, and neither ever finds out."

"That is not a technology gap, it is a visibility gap. AI has made attacks cheap to repeat, so the advantage sits with whoever recognizes the second attempt. Today, that is the attacker."

"Verification at onboarding tells you who opened the account," Reddy added. "It does not tell you who is using it in month six, or whether the entity logging in is even human. A large share of global fraud losses occurs directly in that gap."

India's ‘Robust, Trusted Regulatory Ecosystem’

As India's FinTech sector has scaled, the Government and the Reserve Bank of India have continuously strengthened the regulatory and consumer -protection architecture that underpins public trust in digital finance.

Here are some of the key points shared by the government:

Self-Regulation and Standards: The Reserve Bank of India (RBI) introduced the Framework for Self-Regulatory Organisation(s) in the FinTech Sector (SRO-FT, May 2024) to promote ethical conduct, market integrity, and dispute resolution within the fintech industry

Payment Security: The RBI issued the Master Directions on Digital Payment Security Controls (2021) to enforce minimum-security standards across mobile and internet banking channels

In parallel, the National Payments Corporation of India (NPCI) deployed AI/ML-based fraud monitoring for UPI transactions

Data Protection: To safeguard individual privacy, the Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Act in 2023 and the Digital Personal Data Protection Rules in 2025

Safe Innovation Testing: In August 2019, the RBI launched a Regulatory Sandbox framework, allowing fintechs to test innovative financial products and services in a controlled environment with or without regulatory relaxations

Consumer Protection in Digital Lending: Citizens are protected against fraudulent lending apps through a strengthened regulatory framework, a Digital Lending Apps (DLA) directory, and cybercrime reporting channels (the National Cybercrime Reporting Portal at cybercrime.gov.in and Helpline 1930)

Additionally, the public-facing SACHET portal handles complaints regarding illegal deposit collection

Proactive Governance: Rather than reacting to innovations after they enter the market, the ecosystem creates institutional mechanisms to test, assess, and support responsible innovation before widespread rollout