Artificial intelligence is becoming indispensable to financial institutions at the same moment it is making fraud faster, cheaper and harder to identify. Experian’s 2026 Future of Fraud Forecast captures that contradiction: banks and lenders need AI to defend transactions, yet increasingly face autonomous systems that can resemble legitimate customers and agents.
The scale makes a manual response unrealistic. The report cites US Federal Trade Commission data showing consumer fraud losses above $12.5 billion in 2024. Experian says nearly 60% of companies recorded higher fraud losses between 2024 and 2025, while its own prevention products helped clients avoid an estimated $19 billion globally in 2025.
Those figures describe an arms race in which speed is no longer enough. Institutions must also decide what counts as a trusted machine, who is accountable when an agent acts incorrectly and how to preserve convenient services without opening new paths for attackers.
Legitimate agents and criminal bots begin to converge
Experian calls one emerging risk “machine-to-machine mayhem.” AI agents will increasingly shop, apply, negotiate and transact for people. From a bank’s perspective, however, a helpful agent and a malicious automated bot may generate remarkably similar signals.
That ambiguity complicates both identity checks and liability. If an authorised agent makes a harmful purchase, responsibility might sit with the consumer, the agent provider, the merchant or the financial institution. Fraud controls designed around a person clicking a button are poorly suited to a chain of software decisions executed in seconds.
The forecast also points to deepfake job applicants, cloned websites, emotionally persuasive scam bots and vulnerable smart-home devices. Each expands the attack surface beyond a conventional payment screen. Criminals can manufacture credible identities, relationships and digital environments rather than merely steal a password.
Defenders therefore need context across identities, devices, behaviour and transactions. Blocking every unfamiliar automated action would create intolerable friction. Allowing agents to act without strong, continuous verification would invite abuse.
Financial firms want AI but struggle with its foundations
The appetite for AI is not in doubt. Experian reports that 84% of financial organisations consider it a high or critical priority, and 89% expect it to play a role in lending. Yet 73% cite regulatory concerns, while 65% identify AI-ready data as a challenge.
That gap matters because fraud models are only as reliable as the information and controls surrounding them. Fragmented customer records can hide coordinated behaviour. Poorly documented models can leave institutions unable to explain why an application was rejected or a transaction stopped. Data quality consequently ranks as the leading criterion when firms evaluate AI vendors.
Regulation adds an operational burden. Experian says 67% of firms struggle with regulatory requirements, 79% have received more supervisory communications and 60% still rely on manual compliance work. Some larger organisations assign more than 50 people to model documentation alone.
Experian’s model-risk assistant is intended to automate part of that documentation. The important point is broader: defensive AI cannot remain separate from governance, audit and reporting. A model that catches fraud but cannot be monitored or justified may create a different category of risk.
Trust becomes a system rather than a checkpoint
The most effective response is unlikely to be one perfect detection model. Financial institutions need layered trust that evaluates a transaction’s origin, delegated authority, behavioural history and purpose throughout its lifecycle.
That means designing explicit permissions for agents, preserving evidence of their actions and making escalation possible when confidence falls. It also means treating model documentation as part of production infrastructure, not paperwork assembled after deployment.
The paradox in Experian’s forecast is not a reason to slow every AI project. It is a warning that adoption and protection must advance together. Institutions already depend on automation to handle the volume and sophistication of attacks. Their next challenge is distinguishing beneficial autonomy from hostile autonomy without making digital finance unusable.
As machines transact with machines, identity will no longer answer only who a customer is. It must also establish which software may act for that customer, under what conditions and with whose accountability. Financial firms that build those rules early will be better placed to benefit from AI without letting the same technology erase the trust on which their services depend.
