AI Will Transform Fraud Risk for Financial Institutions, but Good Governance Remains Central to Resilience
By Ingo Trede, European Head of Underwriting - FinPro & Cyber at Alta Signa
Recent fraud risk trends are a stark reminder of the threat to financial institutions from cyber criminals. Globally, cyber-enabled fraud incidents nearly tripled in the decade to 2023, but the true scale of the threat is unclear, due to under-reporting and data gaps across jurisdictions.
Separately, the Federal Bureau of Investigation’s annual Internet Crime Report for 2025 revealed that 85% of losses reported were due to online enabled fraud, predominantly social engineering attacks. The 2025 report is the first in which the FBI tracked AI as a threat vector for cyber crime.
Financial institutions also face significant penalties for non-compliance with regulations governing resilience to cyber attacks. The European Union’s Digital Operational Resilience Act, which came into force on 1 January 2025, comes with administrative penalties for non-compliance of between 5% and 10% of annual turnover, with ceilings of between EUR 2 million and EUR 20 million.
For insurers supporting financial institutions across Europe, resilience also has to be understood in its local context. Regulatory expectations, operational practices and fraud typologies can differ significantly between jurisdictions, making close-to-source local underwriting expertise increasingly valuable when assessing risk.
More Sophisticated Attacks
Business email compromise (BEC) remains the most prevalent form of social engineering attack, and institutions are increasingly being targeted through vendor email compromise, a type of BEC attack where hackers impersonate third-party vendors in the digital supply chain to access company systems.
Attacks are also becoming more sophisticated, with BEC attempts incorporating AI-generated deep-fake audio and video to trick target company employees. And the scalability of attacks has dramatically increased, with hackers now able to deploy AI agents to run brute force attacks on passwords across hundreds of thousands of accounts at once.
In addition, the phenomenon of “agent jacking”, where hackers use AI agents to gain access to systems, came to global attention recently when Meta’s AI chatbot was tricked into giving access to user accounts, and when a cyber security firm used its own AI agent to access McKinsey’s internal AI tool Lilli.
Maintaining strong controls
While the hacker’s tool box has expanded, successful fraud attempts are still reliant on weak governance and security protocols at target organisations – with human
operatives remaining the weakest link.
Fraudulent wire transfers rely on manual changes to banking details by individuals targeted by scammers. With proper controls around access to bank details even the
best deepfakes in the world are unlikely to succeed. Good governance, which
prevents a single employee from making significant fund transfers, will continue to frustrate the majority of fraud attempts against financial institutions.
Effective governance should also prevent more sophisticated forms of attack, where hackers stay in a company’s systems once they have gained entry, to monitor communications and payment flows and understand how the target company’s processes work.
The fraud insurance market
For the crime insurance market, which covers financial institutions for financial loss and expenses caused by theft and fraud, risk selection has become more challenging.
Carriers face a highly competitive market, where establishing the extent of fraud controls implemented by insureds can be difficult, and the extent of uninsured losses often flies under the radar.
In addition to purchasing protection against the significant costs incurred in recovery and forensics following a sophisticated attack, financial institutions can also reduce fraud losses by addressing more common risks.
Cheque fraud is still the second most common fraud risk, and the second highest source of losses by institutions. Older, less secure methods of payment inevitably attract less investment for anti-fraud measures, making them an easier entry point for fraudsters.
Meanwhile, the challenge of assessing emerging fraud risk demands a cross-functional approach, involving risk management, IT, cyber security professionals and risk and insurance advisors, to surface potential vulnerabilities and effective mitigations.
By mapping digital supply chain risks, uncovering vulnerabilities in vendor contracts and IT infrastructure, and reviewing governance procedures, organizations can ensure fraud resilience is updated and maintained to meet the evolving threat.
For insurers, that also means avoiding one-size-fits-all assumptions. Effective underwriting increasingly depends on understanding how governance, regulation and operational controls work within individual markets, combining technical expertise with local knowledge.
Sources:
