Fraud is now a line item, not an incident

The branch-level bill

The Italian numbers turn fraud from an incident into a budget line. A BioCatch survey of 100 Italian banking leaders found that 76 percent of institutions lose more than $10 million annually to fraud, the highest rate among the 17 countries surveyed, and 68 percent of respondents reported rising fraud losses. Most institutions are already adjusting internal policies to manage the financial liability tied to regulatory and systemic changes, which means the losses are being planned for rather than merely reacted to. m:…5506

Two changes are forcing that planning. Banks are bracing for the impact of SEPA credit transfers and upcoming PSD3 reimbursement mandates, both of which shift more of the cost of a fraudulent payment onto the institution rather than the customer. When reimbursement rules move liability, fraud stops being only a security problem and becomes a pricing and provisioning problem for the bank. m:…5506

Brazil shows the consumer-facing side of the same shift. BioCatch's report on Brazilian digital banking fraud found a 15 percent increase in social engineering attempts, driven by fake-lawyer scams in which fraudsters pose as legal counsel to solicit upfront payments via Pix. The report also noted significant increases in malware-driven payments, stolen device fraud and the use of AI-generated voice deepfakes. The scam works because it borrows the authority of a lawyer and the immediacy of an instant payment rail. m:…9878

The exchange-level theft

The Binance breach, in which attackers stole $6.34 billion from hot wallets in October 2026, shows the same industrialization at the top of the market. The attackers used a compromised developer workstation and an internal AI tool to move laterally across team boundaries, and the FBI attributes the theft to the North Korean hacking group TraderTraitor. The breach is notable not for a single failure but for the path: correct security responses to the initial compromises did not stop the attacker, because there were no boundary alerts between internal systems, and the internal AI tool acted as a bridge between teams that were supposed to be isolated. m:…3639

Anomali's analysis argues that the breach exposes a structural gap rather than a one-off lapse: a widening distance between security investment and the industrial-scale capabilities of state-sponsored adversaries, with self-insurance funds and point-in-time audits failing to cover the scale of the loss. The firm argues that exchanges need to shift toward structural supply chain integrity and automated identity governance, warning that the alternative is mounting regulatory penalties. m:…8950

The money has not stood still since. TRM Labs reported that North Korea-linked actors are laundering the proceeds through self-minted tokens and lending receipt tokens on the TRON blockchain, and through chained cross-chain swaps designed to obscure transaction links. Nearly $2.7 billion of the $6.36 billion stolen has been frozen, while the attacker's main Ethereum and Bitcoin holdings remain largely stationary and active laundering continues on TRON and Solana. Freezing less than half the haul, months on, is a measure of how hard recovery is once funds cross chains. m:…0613

The new front door: voice agents

Banks now face a subtler version of the same problem at the front door. Pindrop reported that financial institutions are seeing a surge in AI voice agent traffic and need policies that distinguish legitimate customer-authorized bots from malicious actors. The firm recommends a three-tiered routing strategy, sorting traffic into green, gray and red tiers based on the agent's identity and intent, and advises banks to establish traffic baselines and run day-after scenario planning for agent-driven errors or fraud. m:…0044

The impersonation threat is already scaling on the consumer side. KnowBe4 warned that fraudsters are impersonating prediction markets such as PolyMarket and Kalshi, with criminal groups known as traffers using AI to rapidly scale campaigns that mimic legitimate interfaces, collect identity and payment information, and prevent fund withdrawals. The pattern matches the Brazilian fake-lawyer scam and the voice deepfakes: AI lowers the cost of a convincing impersonation, and the payment rail does the rest. m:…7359

What a risk team should take from this

The common thread is that fraud costs are moving onto the institution's own books, whether through reimbursement mandates in Europe, through the sheer scale of losses in Italy, or through the need to build routing and verification for agent traffic that did not exist a year ago. A risk team that still treats fraud as a series of incidents will under-budget it; the surveys and the breach data both describe a continuous cost. m:…5506 m:…0044

The Binance aftermath adds a second lesson: internal tools are now part of the attack surface. An AI tool that legitimately crosses team boundaries for work will also cross them for an attacker unless boundary alerts exist. Banks adopting AI assistants for their own staff should read the Binance path as a warning about their own internal bridges, not just as a crypto story. m:…3639 m:…0613