Fraud teams face AI deception with yesterday's defences, and the reports keep score

The preparedness gap

Only 7 percent of anti-fraud professionals report their organizations are more than moderately prepared to combat AI-driven threats, according to SAS and the Association of Fraud Examiners, while 77 percent of surveyed anti-fraud professionals reported rising deepfake social engineering. That is the headline of the industry report, and it is unusually blunt: the threat has arrived, the defenders know it, and almost none of them feel ready. m:…6249

The gap is organisational as much as technical. 77 percent of surveyed public sector leaders say fraud-fighting challenges have increased and evolved faster over the past year, 86 percent of financial institutions report missed links between fraud and money laundering, only 25 percent of organizations use AI or machine learning to fight fraud, and only 13 percent of financial institutions are aligning governance, policies and organizational structure for fraud and AML. The fraud team and the money-laundering team are still filing separately while the criminals operate as one business. m:…6249

There are bright spots, and they are specific. One western US state estimates saving more than 1.2 million dollars since deploying SAS Payment Integrity for Food Assistance in March. A large European bank uses SAS Financial Crime Analytics on SAS Viya to score transactions in milliseconds. The pattern is that the wins come from integrated data and fast scoring, not from a single clever model. m:…6249

The filings keep rising

A suspicious activity report is a document financial institutions must file with the federal government when they detect potential money laundering, fraud, or financial crime, and SARs are filed with the Financial Crime Enforcement Network, a bureau of the United States Department of the Treasury. Total SAR volume across all seven categories of institutions exceeded 4.105 million reports in 2025, and banks, savings associations, and credit unions filed more than 2.193 million SARs in 2025. Total cyber-related SAR filings rose 30 percent compared to 2024. m:…1137

The filing clock is short. Financial institutions must file a SAR within 30 calendar days of identifying a transaction meeting reporting thresholds, institutions can extend the filing window by 30 days if no suspect is identified, up to a maximum of 60 days, and ongoing suspicious activity requires a continuing report at least every 90 days. That clock is why the quality of the underlying monitoring matters so much: the report is only as good as the transaction data behind it. m:…1137

The reports are useful, and they are not accusations. 94 percent of IRS Criminal Investigation cases in 2025 were searched against Bank Act data, federal law prohibits institutions from disclosing to the subject of a SAR that a report has been filed, and the filing of a SAR does not trigger an automatic investigation but serves as a resource for law enforcement. Sift says it provides transaction and account behavior context to improve the quality of SAR filings. m:…1137

Late evidence is still evidence

Webz.io makes a related point about time, and it matters for the same reason the filing clock does. Filtering breach records by exfiltration date can cause organizations to miss critical exposure alerts, because the date an application receives evidence of a breach is distinct from the date the breach occurred. Security teams should retain both the exfiltration date and the receipt date for forensic analysis. A breach record that arrives months after the theft is not a new infection; it is new evidence of an old one. m:…1520

Repeated delivery of the same breach record should not be treated as a second infection, and a gap between theft and receipt does not demonstrate that an attacker retained access during that time. Application receipt time may be later than the crawled_date due to outages or processing delays. The fields tell the story: the device_info.exfiltration_date field indicates when data was exfiltrated in infostealer logs, the breach_info.breach_date field indicates when a data breach occurred, and the Webz.io crawled_date field represents the time the record was collected. Three dates, three different facts, and a pipeline that keeps only one of them will misread the other two. m:…1520

The example given is concrete: the Netherlands Police dismantled CastleRAT infrastructure during an international action week, and CastleRAT data was made available on the Check Your Hack platform. Data from a dismantled operation keeps surfacing after the operation ends, which is exactly when a team filtering on exfiltration date would miss it. m:…1520

What a fraud team should do

Sift's advice for building a fraud team is practical rather than visionary. Fraud teams are being asked to accomplish more with limited resources, AI can increase fraud team productivity in workflows requiring manual data collection, and high-volume, repeatable tasks are the best starting points for AI automation. AI agents can collect data, identify patterns, and summarize findings, but analysts need to direct automated workflows and evaluate AI-generated findings. m:…1138

Human oversight is required for account restrictions and sensitive investigations, fraud operations should map work by risk and value rather than volume, and initial efficiency improvements of 20 percent to 30 percent are meaningful progress for AI initiatives. Fraud leaders should compare current task performance with AI-enabled performance to quantify improvements. Training programs should develop investigative knowledge, technical fluency, and critical thinking, and AI initiatives require experimentation, testing, and ongoing quality control. The alternatives to hiring analysts include automating tasks, improving workflows, or outsourcing. None of that is glamorous. All of it is the difference between a team that files 4.105 million reports and a team that knows what the reports mean. m:…1138 m:…1137