What is agentic fraud? Definition, techniques, and defense
Agentic fraud is fraud that an autonomous AI agent runs from start to finish. The agent finds targets, creates the fake identities, documents, voices, and media it needs, submits them, watches how the system or victim responds, and retries with adjusted inputs at scale, with no human involved. Its defining feature is this adaptive feedback loop. In identity verification, it targets the image a person shows and the route that image takes from the camera to the server.
Incode publishes the technical taxonomy behind this page openly at agenticfraud.com. The statistics come from the agentic fraud report, which compiles figures from government agencies, industry bodies, and published research. Definitions for the terms used here are in the identity glossary.
This is a living document, shaped by what Incode observes across billions of identity verifications. Incode reviews this page every quarter and whenever it documents a new technique. This page is for general information and does not constitute legal, compliance, or security advice.
Agentic fraud is fraud run by an autonomous AI agent, with no person doing the work. The agent does the work a fraud ring once needed people for: it selects targets, builds fake identities and media, submits them to onboarding flows or directly to victims, reads the result, and tries again with adjusted inputs.
None of these tools is new. Tools for voice cloning, face generation, and fake documents have all been on sale since at least 2022. What changed is how they are combined: one agent strings all three together and works through the whole sequence with no one steering each step, across hundreds of parallel sessions. Each attempt costs little more than the computing power behind it. Incode's agentic fraud report describes the result as the removal of the human-labor ceiling that always limited how many attacks could run at once.
The adaptive feedback loop
1Estimate: the agent builds a working picture of the target, including which controls are switched on and where past attempts ran into resistance.
2Choose: it selects the identity package, delivery method, and target most likely to pass.
3Submit: it sends the attempt through the verification flow.
4Observe: it reads the response, including the error type, response time, and any step-up prompt.
5Update: it revises its model and starts again.
The agentic fraud feedback loop. Source: Agentic fraud: a technical taxonomy, Incode.
Agentic fraud vs. agentic AI for fraud detection.
Some vendors use "agentic" to describe AI agents that help fraud teams investigate cases. That is fraud prevention. Agentic fraud, as defined here, is fraud committed by autonomous agents.
02 · Comparison
How is agentic fraud different from bot fraud, deepfakes, and synthetic identity fraud?
Bot fraud follows a fixed script and fails when the target changes; agentic fraud uses an AI agent that observes each rejection, changes its approach, and tries again, which makes it adaptive from one attempt to the next. Agentic fraud is a new way of running attacks with existing fakes.
Layered: media authenticity, capture-path integrity, behavioral and graph signals, KYH, and KYA
In practice an agent can assemble a synthetic identity, generate a matching deepfake, and keep adjusting both until one passes.
03 · Timeline
How did fraud become agentic?
Fraudsters have employed every major generative AI improvement since 2022 within months of release. Adapting to these new technologies requires an extremely dynamic approach to fraud prevention.
Nov 2022
ChatGPT
Any message can be written by a machine
For the fraudsterPhishing scripts that read like a native speaker wrote them
Jan 2023
ElevenLabs
Any voice can be cloned
For the fraudsterScam calls in a cloned, familiar voice
Mar 2023
Midjourney v5
Any photo can be invented
For the fraudsterInvented faces and fake "proof" for scam accounts
Aug 2024
Face-swap tools
Any live call can be faked
For the fraudsterLive video-call impersonation, where a cloned executive on camera can approve a payment
Sep 2025
OpenAI Sora 2
Any video can be generated
For the fraudsterDeepfake ads, fake endorsements, and fake news clips
2026 · We are here
Agentic AI
Any user can be an agent
For the fraudsterAgents running the full fraud workflow end to end
Four shifts make agentic fraud different
Together, these traits turn one-off scams into continuous, large-scale operations.
01
Automated attacks at machine speed
Work that took hours now takes seconds, so one operator can manage thousands of concurrent attempts.
02
Fraud tools anyone can use
Packaged kits and agents cut the skill needed to launch an attack, so almost anyone with a target list can try.
03
Industrialized fraud-as-a-service
Fraud kits, fake ID generators, and ready-made agents are rented out as services, which makes large operations cheap to start.
04
Personalized attacks at scale
Agents can tailor each attack to one victim in minutes, a level of research that once paid off only for the most lucrative targets.
04 · The evidence
How big is the AI-enabled fraud problem?
Figures below come from government agencies, industry bodies, and published research, alongside incident data from Incode's agentic fraud report. Reported losses are a floor; true totals are larger.
66
AI-fraud incidents in the US, every one independently sourced
44
Confirmed AI cases, with the method documented
$579.4B
Global fraud-scam and bank-fraud losses, 2025 (Nasdaq Verafin)
$20.9B
Reported US internet crime losses in 2025, of which the FBI tagged $893M as AI-related.
FBI IC3, 2025
$15.9B
Consumer fraud losses reported to the FTC in 2025, the highest on record.
Federal Trade Commission
$40B
US fraud losses that generative AI could enable by 2027, up from $12.3B in 2023.
Deloitte Center for Financial Services
90%
Share of surveyed anti-financial crime professionals who saw more AI-driven attacks over the past two years.
Nasdaq Verafin
4.5x
Click-through on AI-automated phishing (54%) vs. standard phishing (12%).
Microsoft Digital Defense Report, 2025
+1,900%
Compound annual growth in revenue for AI service vendors on one scam marketplace, Huione Guarantee, 2021 to 2024.
Incode's agentic fraud report scores each fraud category by how much of the scam an autonomous agent can run end to end, on a one-to-five rubric covering personalization, repeated conversation, target research, and automation readiness. Romance and confidence scams score highest because they are almost pure conversational labor.
Confidence / romance5/5$929M
Investment (incl. crypto)4/5$8.6B
Imposter scams (total)4/5$3.5B
Business email compromise4/5$3B
Employment4/5$363M
Extortion3/5$122M
Tech / customer support2/5$2.1B
Government impersonation2/5$798M
Non-payment / non-delivery2/5$503M
Phishing / spoofing2/5$216M
Identity theft2/5$186M
Automatability is a rubric that ranks fraud types by how much of each scam an agent can run. Dollar figures are 2025 reported US losses. Every bar comes from the FBI Internet Crime Complaint Center except Imposter scams (total), a Federal Trade Commission figure that already includes government impersonation. Source: The agentic fraud report.
06 · Mechanism
How does an agentic fraud attack work?
Defenders classify an attack by the fake it uses, the route it takes, and who or what runs it.
Three dimensions of any fraud attempt
The table below shows where agentic fraud breaks from earlier attack types.
Dimension
What it describes
Examples
Artifact
The fake or stolen item at the center of the attempt
A deepfake video, a forged ID, a cloned voice, or stolen credentials
Vector
The route the item takes into verification
A fake held up to a camera, a virtual camera feed, an upload straight to the API, or replayed credentials
Execution model
Who or what carries it out
Human operator, then scripted automation, then an adaptive AI agent with a feedback loop
Fraud teams have long sorted attacks by what was faked and how it got in. The execution model is what changed, so defenses have to change with it.
The four stages of an agentic fraud attack
The operation starts with stolen data and ends with the same attack running against many targets at once.
Stage 1
Collect
Gather leaked personal data, then sort targets by which stolen details would clear which financial products.
Each stage has its own tools, from data broker APIs and fine-tuned image generators to virtual camera drivers, browser automation, and OTP interception (stealing one-time passcodes). After a rejection, the agent maps the signal to a failure category and picks the next tool. By the time money moves, the attacker often holds a legitimate credential that was issued to a fake identity, and the final transaction may involve no synthetic media at all.
The cheapest-path principle.
An agentic attacker finds the weakest stage. If account opening is well-defended and account recovery is not, the operation moves to recovery.
Every rejection is training data.
Error messages ("face match failed"), response times and retry thresholds all teach the agent where the approval boundary is. Return the minimum information in rejection responses.
07 · Attack surfaces
What are the two attack surfaces for agentic fraud?
Attackers can fool the camera, or skip it and feed fake video straight into the app.
Surface 01 · Pre-agentic baseline
Presentation attacks
Physical artifact → real camera → verification system
Attackers show a printed photo or screen, a silicone or paper mask, or a video replay to a real camera. Presentation attack detection (PAD) and liveness detection were built for this surface. A person has to be at the device, which keeps these attacks from scaling the way agents do.
A typical identity verification (IDV) capture. PAD was built around this kind of capture. Source: Conference on Computer Vision and Pattern Recognition (CVPR) 2026 / Incode Mirage.
Required defense: checks that the media itself is real, including liveness, deepfake classification, and anti-spoofing.
Surface 02 · Primary agentic surface
Injection attacks
Media → bypasses capture path → injected into data stream
In identity verification, an injection attack feeds fake or altered media into the app's data stream so the physical camera is never used. Attackers do it with a virtual camera driver, by intercepting traffic between the software development kit (SDK) and the server, or with an emulated device. It is different from SQL injection or prompt injection.
Virtual camera drivers send generated video to the app in place of the real camera.
Man-in-the-middle interception alters the data in transit before the server analyzes it.
Emulated devices imitate real phones in bulk, each with a distinct hardware profile.
Required defense: a trustworthy capture path, checked through device attestation, SDK tamper checks, and emulator detection.
The critical gap
Presentation attacks and injection attacks are separate attack surfaces that need separate defenses. A strong liveness detector stops presentation attacks but provides no protection against injection; a capture-path integrity check stops injection but provides no protection against sophisticated deepfakes delivered through real hardware. Both are necessary. A program that deploys only one has left half its attack surface open, and an agent's feedback loop will find that half.
08 · Technique taxonomy
What are the 10 agentic fraud techniques (AFT-01 to AFT-10)?
Incode's open taxonomy, first published at agenticfraud.com, documents 10 attack methods seen in production. A single operation usually combines several techniques across the Collect, Create, Test, and Scale stages.
Money-flow rings become visible only across institutions
Graph analysis across accounts and institutions
Synthetic media
These attacks use generated faces and video, sometimes piped past the camera.
AFT-01Create (sourced in Collect)
AFT-01: Deepfake-as-a-service rings
What it is. Industrialized generation farms that sell synthetic faces and video. Deepfake-as-a-service (DFaaS) rings run generators fine-tuned specifically for identity verification.
Evidence. In Incode's Mirage research (CVPR 2026), a generator fine-tuned on know your customer (KYC) capture data raised its attack success rate against production detectors from 0.0000 to 0.905 APCER (attack presentation classification error rate, the share of attacks a detector misses).
Detection signals. Detectors trained on IDV-domain data; rapid retraining on new generator clusters; capture-path checks so a passing image cannot be injected.
AFT-03Create
AFT-03: Video-injection attacks
What it is. Attackers pipe pre-recorded video loops into the camera stream.
Observed scenario. A virtual camera driver feeds pre-recorded clips into the verification app in place of the live camera. The agent indexes each clip to the prompt it expects, such as blink or turn left, and scripts the playback to match.
What it is. Real-time face synthesis replaces the device camera.
Observed scenario. Real-time face-swap software runs behind a virtual camera, so the app receives a synthetic face that answers every liveness prompt as it happens. The driver can be off the shelf or custom-built at the operating system level.
Primary defense layer. Capture-path integrity: virtual camera and emulator detection.
Identity fabrication
Two techniques forge documents or stitch together people who do not exist.
AFT-02Create
AFT-02: Agentic document forgeries
What it is. Attackers start from a real credential and change one detail at a time, such as the name, birth date, or ID number, so the fonts, barcode, hologram position, and machine-readable zone (MRZ) all still look genuine and the document clears optical checks.
Evidence. One service (OnlyFake, 2024) charged $15 per document and claimed it could produce up to 20,000 a day.
Detection signals. Forensics beyond structural signals; photo-to-live-capture consistency; reuse of the same base document across sessions.
AFT-06Collect, Create
AFT-06: Synthetic identity rings
What it is. Attackers build identities from real data fragments and fabricated details.
Observed scenario. An agent pulls leaked personal data, including Social Security numbers, overnight at pennies per record. It pairs those real fragments with invented names, addresses, and employment histories, and builds each package to stay consistent under cross-reference checks.
Primary defense layer. Identity data consistency, cross-institution signals.
Automation and bypass
These techniques script onboarding at scale or replay captured data straight at the API.
AFT-05Test, Scale
AFT-05: Agentic farming attacks
What it is. Coordinated agents script onboarding at scale.
Observed scenario. Many agents run onboarding attempts at the same time, each in its own browser session with a rotated proxy and a residential IP address. They tune typing speed and mouse movement to match real users and keep volumes low enough that no rate limit fires, so every attempt looks like an unrelated person.
Primary defense layer. Behavioral and graph: device reuse, velocity.
AFT-08Test
AFT-08: KYC-bypass scripts
What it is. Automation defeats behavioral timing and flow checks.
Observed scenario. Scripts call the verification API directly and time every response. Differences in error messages, response speed, and the retry count that triggers extra verification show the agent where the approval boundary sits.
Primary defense layer. Behavioral signals; minimal information leakage.
AFT-09Collect
AFT-09: Biometric-replay
What it is. Attackers replay captured biometrics directly at the API.
Observed scenario. Agents scrape face images and other biometric data from social media, then send the captured biometrics straight to the verification API without opening a camera feed.
Primary defense layer. Capture-path and API integrity; replay detection.
Coordinated operations
Both techniques work across institutions, where no single team sees the whole pattern.
AFT-07Test, Scale
AFT-07: Impersonation chains
What it is. One operator cycles identities across institutions.
Observed scenario. One operator profiles the controls at each institution, then rotates identity packages across them. Every rejection shows which variant to try next, and because each institution sees only its own applications, the pattern stays hidden.
Primary defense layer. Graph analysis across sessions and institutions.
AFT-10Scale
AFT-10: Coordinated mule networks
What it is. Money-flow rings become visible only across institutions.
Observed scenario. Once accounts pass verification, specialized sub-agents route fund transfers through mule accounts. Each institution sees only a small slice of the money flow, so the ring stays invisible until signals are compared across institutions.
Primary defense layer. Graph analysis across accounts and institutions.
Base generator
Fine-tuned on KYC capture data
AFT-01 evidence. Fine-tuning on IDV capture data raises APCER from 0.0000 to 0.905 against production detectors. Source: Incode Mirage dataset, CVPR 2026 (Boieru, Suarez, Ganiev).
Gen 1
Gen 2
Gen 3
AFT-02 evidence. Three generations of a synthetic Texas ID test document built for research: identity fields held constant, enrolled photo substituted. Source: Incode threat intelligence.
09 · Exposure
Which industries are most exposed to agentic fraud?
Agentic fraud concentrates where an approved identity unlocks money or reusable access.
Banking and fintech
Agents target digital account opening, account recovery, and mule activation. An approved bank account is the most valuable output of an agentic fraud pipeline because it can receive and move money.
No single check stops an adaptive agent. Defense against agentic fraud is multi-layered, and it starts by keeping three trust questions separate.
Deterministic01
Does this actor have permission to do this?
A yes-or-no permissions check that cryptography can settle.
Failure mode: stolen credentials, hijacked sessions, and forged authorization tokens.
Probabilistic02
Can we trust the evidence this identity was built on?
This looks back at how strong the proof was at signup or at the last re-check.
Failure mode: synthetic identities, deepfakes at signup, and injection attacks during KYC checks.
Probabilistic03
Does this action fit the person's overall behavior?
This one looks at patterns across sessions, accounts, and institutions.
Failure mode:account takeover after a customer has passed verification, and activity from mule networks.
Know Your Agent (KYA) is how organizations answer the first question for AI agents. Know Your Human (KYH) strengthens the second question at the moments that matter.
The conflation exploit.
A passed liveness check settles one small piece of the second question: a real person was probably there, on a trustworthy camera feed, at that moment. It says nothing about whether that person is who they claim, whether the documents are genuine, whether an agent acting for them has permission, or whether the transaction fits their history. Treating it as the answer to all three questions is the gap AFT-03, AFT-04, AFT-09, and mule operations use.
Mitigation principles by question
Questions 1 + 2
Test the camera feed and the media separately, because each fails to a different attack. Checking only the media misses AFT-03 and AFT-04, while checking only the device misses AFT-01 and AFT-02.
Reveal as little as possible in rejection messages.
Re-verify when risk jumps: a new payee, a larger transfer, an account recovery, a new device, or a step that cannot be undone.
Question 3
Link signals across sessions and accounts. Graph analysis exposes impersonation chains (AFT-07) and mule networks (AFT-10) that account-by-account review misses.
Judge defenses as a whole. A control that only moves fraud from account opening to account recovery leaves total losses unchanged.
20 to 30 samples
Incode research (CVPR 2026) found a detector can be adapted to a new generation tool with only 20 to 30 labeled samples.
Detector embedding space (a map of how the detector groups images): a new tool forms its own cluster. Source: CVPR 2026 / Incode, Efim Boieru et al.
11 · Two-sided trust
What are Know Your Human (KYH) and Know Your Agent (KYA)?
Agentic fraud breaks a simple assumption in identity verification: that the party in front of the system is a person. Organizations now need to prove that whoever is acting is either an approved human or an approved agent. Know Your Human (KYH) and Know Your Agent (KYA) are the two sides of that proof, connected by delegation.
Know Your Human (KYH) is the practice of confirming that a real, live person is present and in control at a specific moment, such as onboarding, account recovery, or a high-risk transaction. KYC proves who a customer is; KYH proves that a live person is acting right now.
KYC was designed for a world where submitting a document and a selfie required a person. Agentic fraud breaks that assumption because an agent can generate both. KYH adds the signals an agent cannot easily fake at the moment of action: liveness, injection and emulator detection, device integrity, and a face match against government records of the person.
Know Your Agent (KYA) is the process of verifying an AI agent and tying it to an accountable human or business, so trusted agents can transact while rogue agents are blocked.
Many agents are legitimate. Customers increasingly send AI agents to shop, book, and pay on their behalf, and blocking every agent blocks those customers too. KYA is how a platform tells a delegated agent from an attacking one, and it answers the first of the three trust questions: does this actor have permission to do this?
1IdentifyGive the agent a verifiable, revocable credential of its own.
2BindTie it to a verified, accountable human or business.
3ScopeSet a spend limit or a list of allowed actions.
4Monitor and auditCheck every action against scope, from login through the end of the session.
5RevokeWithdraw access immediately when trust is withdrawn.
Payment networks are moving the same way: Visa's Trusted Agent Protocol helps merchants recognize trusted agents, and Mastercard Agent Pay requires agents to be registered and verified before they pay.
14 · How Incode helps
How does Incode stop agentic fraud?
Incode's defense answers the three trust questions.
Prove the human (KYH)
Incode Deepsight detects deepfakes, synthetic media, and AI-generated documents, and checks that media came from a real camera rather than a virtual camera, emulator, or injected stream. GovFaceMatch matches a live selfie against government systems of record.
Trust the agent (KYA)
Incode Know Your Agent verifies, tokenizes, and audits AI agents, binding each one to an accountable human or business.
See across institutions
Incode TrustGraph detects AI-driven repeat fraud and recognizes legitimate customers across a privacy-preserving trust network, without exposing customer data.
Agentic fraud is fraud that an autonomous AI agent runs from start to finish. The agent finds targets, creates the fake identities, documents, voices, and media it needs, submits them, watches how the system or victim responds, and retries with adjusted inputs at scale, with no human involved. Its defining feature is this adaptive feedback loop. It is different from using agentic AI to detect fraud.
02How is agentic fraud different from bot fraud?+
Bot fraud follows a fixed script and fails when the target changes; agentic fraud uses an AI agent that observes each rejection, changes its approach, and tries again, which makes it adaptive from one attempt to the next. That makes agentic fraud high in variety as well as volume, and much harder to stop with rate limits or bot detection alone.
03How is agentic fraud different from deepfake fraud and synthetic identity fraud?+
Deepfakes and synthetic identities are artifacts: fake media and fake identity data. Agentic fraud is an execution model in which an AI agent creates and submits those artifacts, learns from the result, and retries. A single agentic attack often uses both.
04Can AI agents pass KYC and identity verification checks?+
AI agents can pass checks that only inspect the document or selfie, especially when media is injected straight into the data stream and never shown to a camera. In Incode research presented at CVPR 2026, fine-tuning an image generator on identity verification capture data raised its attack success rate (APCER) against production detectors from 0.0000 to 0.905. Checking the capture path as well as the media closes much of that gap.
05What is an injection attack in identity verification?+
In identity verification, an injection attack feeds fake or altered media into the app's data stream so the physical camera is never used. Attackers do it with a virtual camera driver, by intercepting traffic between the SDK and the server, or with an emulated device. It is different from SQL injection or prompt injection. Liveness detection alone does not stop it, because nothing is ever presented to the camera.
06How much fraud is AI-driven today?+
The FBI's Internet Crime Complaint Center recorded $20.9 billion in reported US losses in 2025, of which the FBI tagged $893 million as AI-related. Reported figures are a floor: the FTC notes that not every consumer who loses money to a scam reports it. Deloitte projects that generative AI could enable US fraud losses of $40 billion by 2027.
07Which fraud types are most exposed to AI agents?+
Romance and confidence scams are the most exposed: Incode's agentic fraud report scores them five out of five for how much of the scam an agent can run alone. Investment fraud, imposter scams, business email compromise, and employment scams follow at four out of five.
08How do you detect agentic fraud?+
Detecting agentic fraud takes a multi-layered approach that keeps three questions separate: is the actor authorized, was the identity evidence trustworthy, and does the action fit the full behavioral context. In practice that means media authenticity and capture-path checks at verification, behavioral and graph signals across sessions, rejection messages that leak as little as possible, and re-verification at material risk events.
09Does liveness detection stop agentic fraud?+
Liveness detection stops presentation attacks but covers only one layer of defense against agentic fraud. A passed liveness check shows that a real person was probably there, on a trustworthy camera feed, at that moment. It does not prove who the person is, whether the documents are genuine, or whether an agent acting for them has permission.
10What is Know Your Agent (KYA)?+
Know Your Agent (KYA) is the process of verifying an AI agent and tying it to an accountable human or business, so trusted agents can transact while rogue agents are blocked.
11What is Know Your Human (KYH), and how is it different from KYC?+
Know Your Human (KYH) is the practice of confirming that a real, live person is present and in control at a specific moment, such as onboarding, account recovery, or a high-risk transaction. KYC proves who a customer is; KYH proves that a live person is acting right now.
12Is all AI agent traffic fraudulent?+
No. Many AI agents act legitimately for customers, for example to shop, book travel, or pay bills. Know Your Agent (KYA) lets a platform verify those agents and bind them to an accountable person, so trusted agents get through and rogue agents are blocked.
13Who is liable when an AI agent commits fraud?+
Liability for fraud committed through an AI agent is not settled and depends on the jurisdiction, payment network rules, and the contracts involved. Payment networks are building agent verification programs so that agent transactions can be attributed to an accountable party. This is general information, not legal advice.
14What is fraud-as-a-service?+
Fraud-as-a-service sells ready-made fraud tools, such as fake ID generators and deepfake-as-a-service (DFaaS), to anyone who pays. In 2024 the OnlyFake service sold fake IDs at $15 per document and claimed it could generate up to 20,000 a day. AI agents can consume these services automatically, which lowers the cost and skill needed to run agentic fraud.
Know the human, trust the AI agent.
See how Incode lets your customers' agents in and keeps attackers' out.
