Fraud has entered a new operating era. Criminal networks have access to ready-made attack infrastructure, AI can automate increasingly complex campaigns, and real-time payment systems can move funds before traditional controls have time to respond.

The scale reflects that shift. Global fraud losses reached an estimated $442 billion in 2025. Bureau’s fraud intelligence network identified approximately 14,000 organized fraud rings in H1 2026. One in three contained identities that resurfaced across fraud activity, while roughly one in four spanned multiple industries. The largest connected more than 45,000 identities.

The report examines what these changes mean across the connected dimensions, namely: the threat landscape, the economic and regulatory impact, industry exposure, regional risk intelligence, and the capabilities needed to build fraud resilience.

The Threat Landscape

The current fraud environment is being shaped by three forces operating together: industrialized fraud services, generative and agentic AI, and real-time payments.

Fraud-as-a-service has created a supply chain in which phishing kits, synthetic identity packages, mule networks and deepfake capabilities can be purchased and deployed at scale. Bureau’s network data found roughly one in every 170 onboarding applications was a suspected mule over the last five quarters, highlighting how identity-based fraud can persist and reappear across the ecosystem.

AI is accelerating that model further. The FATF has documented AI agents executing complete fraud campaigns without human intervention at each stage. The FBI recorded 22,364 complaints involving AI-facilitated fraud in 2025, with $893 million in reported losses. Document synthesis, deepfake KYC attacks and voice cloning are making sophisticated deception accessible to a much wider pool of fraudsters.

At the same time, real-time payment rails are compressing the window available for intervention. UPI, FedNow, PayNow, FPS and PromptPay can move funds within seconds, while many fraud systems still operate through batch processing or post-transaction investigation.

The result is a broader identity and session-level challenge. In H1 2026, Bureau detected more than 21.7 million account takeover attempts across 5.4 billion login sessions, or approximately one in every 250 attempts.

Together, these trends show why fraud can no longer be understood as a sequence of isolated events. The financial impact follows directly from this expanding and interconnected attack surface.

The Economic and Regulatory Impact

The cost of fraud extends well beyond the loss recorded on a balance sheet. In practice it is a six-layer exposure spanning direct fraud losses, prevention and operational response, customer friction, brand and trust erosion, regulatory liabilities, and the opportunity cost of reactive investment.

Customer friction is particularly significant because fraud controls can affect legitimate revenue. False declines, abandoned journeys and additional verification steps can reduce conversion while remaining outside traditional fraud-loss reporting.

Regulation is adding another measurable layer of exposure. In the UK, payment service providers returned £243 million to APP fraud victims during the first 15 months of the mandatory reimbursement regime. Across Europe, the PSD3/PSR framework and DORA are raising expectations for payment security and operational resilience, while the EU AI Act introduces penalties of up to €15 million or 3% of global annual turnover for certain violations. Australia’s Scams Prevention Framework Act introduces civil penalties of up to AUD $50 million per contravention across banks, telecommunications providers and digital platforms.

The direction is clear: fraud is becoming a quantifiable financial, operational and regulatory exposure. That makes the question of where and how fraud is evolving equally important. The answer varies considerably by market.

An Expanding Attack Surface Across Industries

Fraud exposure differs by how industries acquire customers, move money, fulfill transactions and manage trust.

Financial services face BEC, synthetic identity, KYC bypass, ATO and real-time payment fraud. NBFCs and digital lenders are particularly exposed to application fraud, synthetic identity and income misrepresentation.

E-commerce and quick commerce face promotional abuse, account farming, card testing, return fraud and delivery manipulation. Bureau data shows nearly 82M high-risk quick-commerce sessions across five quarters, with more than 1 in 23 sessions high risk by Q2 2026.

Gig and marketplace platforms face fake worker identities, payment diversion, seller fraud, counterfeit goods and escrow abuse. These attacks exploit onboarding, ratings, delivery and dispute processes.

Across industries, fraud increasingly relies on the reuse of identities, devices, accounts and behavioral patterns. Connecting these signals across the lifecycle helps expose coordinated fraud earlier.

Regional Risk Intelligence

The regional picture shows how fraud adapts to local payment infrastructure, regulation and digital adoption while remaining fundamentally interconnected.

In the United States, internet crime losses reached ~$21 billion in 2025, the highest figure in the FBI IC3’s 25-year history. FedNow expanded to more than 1,500 participating institutions, while its transaction limit increased from $1 million to $10 million. That combination of faster payments and higher transaction values is increasing the importance of pre-authorization risk assessment, particularly for community banks, corporate treasury teams and emerging financial services such as BNPL.

In the UK and Europe, APP fraud remains a defining threat. UK APP losses reached £576.4 million in 2025, up 19% even as case volumes fell 8%. Across the EU, fraud losses reached $64.1 billion. AI-assisted social engineering, voice cloning, investment fraud, BEC and cross-border crypto activity are increasing the value and reach of individual attacks.

Southeast Asia presents a different structural challenge. Digital adoption is advancing alongside fragmented regulatory frameworks, creating opportunities for transnational networks to move across jurisdictions. Singapore has established a strong regulatory benchmark, while the Philippines, Indonesia, Thailand and Vietnam continue to strengthen their respective frameworks. INTERPOL’s I-GRIP demonstrates the value of coordinated intervention: Operation First Light 2026 used the mechanism to block a $6.6 million transfer in real time.

Across Asia-Pacific, combined fraud losses in India, Japan, Australia and South Korea reached an estimated $9.4 billion in 2025. India is seeing fraud migrate toward digital lending as payment controls mature, while Australia has introduced shared obligations across financial institutions, telecommunications providers and platforms. Japan provides a clear example of the impact of decisive technical controls: mandatory advanced authentication reduced unauthorized securities access by 97% in early 2026.

In MENA, rapid digital financial adoption is driving a parallel need for stronger fraud infrastructure. Saudi Arabia has introduced binding counter-fraud requirements across financial services, while the UAE has moved to eliminate SMS and email OTPs from financial services. The region’s larger challenge remains cross-border coordination, particularly as fraud networks operate across multiple jurisdictions.

Across these markets, one pattern stands out: the strongest response combines speed, connected intelligence and continuous adaptation. 

The Fraud-Resilient Playbook

The report outlines a new playbook for risk leaders, and it starts with a simple principle: fraud defense must operate at the speed and complexity of the threat.

For real-time payments, risk decisions need to happen in under 100 milliseconds, before authorization. Achieving that speed requires more than a faster model. Signals from devices, behavior, identity, networks and transactions need to feed a decisioning layer that can assess risk continuously and translate it into action. A feedback layer then uses outcomes to retrain and improve the system.

Multi-modal signal fusion is central to this architecture. A device signal can identify anomalies, while behavioral, biometric, identity, network and transaction signals reveal different dimensions of the same interaction. Connecting these signals makes coordinated manipulation significantly harder and exposes patterns that individual controls cannot see.

The architecture must also learn continuously. This is because fraudsters can probe static models with low-value attacks, identify decision boundaries and adapt subsequent campaigns. Continuous feedback, model monitoring and retraining, therefore, become core operating capabilities rather than periodic maintenance tasks. Every decision must be explainable and auditable. A complete trail of signals, scores, rules and outcomes supports regulatory evidence, model improvement and appropriate human oversight.

Fraud resilience is now an operating model that must be built around connected data, real-time decisioning, adaptive intelligence and coordinated execution. Institutions using Bureau’s unified identity network are already seeing 30% faster onboarding, 83% faster sign-ups and 65% fewer drop-offs.

To learn more, read the full report. Download your copy now.