What is agentic fraud? How it works and how to stop it

For as long as fraud has existed, a criminal operation could only grow as fast as it could hire and train people. Agentic fraud has removed that ceiling.

An autonomous AI agent can now probe a company's onboarding, login, and account recovery flows, learn from every rejection, and try again, across thousands of organizations at once. The FBI's Internet Crime Complaint Center logged 20.9 billion dollars in reported US cyber-enabled losses in 2025, a staggering growth in pace that headcount alone cannot explain.

This guide covers what agentic fraud is, how the attack loop works, what Incode's Agentic Fraud Report found in 2026, and how businesses can defend themselves, including how Know Your Agent (KYA) separates a customer's AI agent from an attacker's.

What is agentic fraud?

Agentic fraud is any fraud that is AI-generated, AI-assisted, or agent-operated.

AI-generated fraud uses AI to create the fake material, such as a forged document, a cloned voice, or a synthetic face, while a person handles everything else. AI-assisted fraud has a person running the attack with AI tools that speed up parts of it, such as drafting messages or researching targets.

Agent-operated fraud hands the whole attack to an AI agent. The agent steals the identity, builds the evidence, makes an attempt, reads the response, adjusts, and retries, often at many organizations simultaneously. This is the fastest evolving type of agentic fraud.

Traditional fraud vs. AI-assisted fraud vs. agent-operated fraud

Agentic fraud comes in three forms, and each works differently from traditional fraud:

• Traditional fraud: A human operator runs the attack, using no AI or only simple scripts. A person rewrites the approach by hand, and headcount and working hours limit its scale.
• AI-generated fraud: A human operator uses AI to create the fake material, such as a cloned voice or a forged document, and handles everything else by hand. Headcount still limits scale, though AI makes each fake cheaper to produce.
• AI-assisted fraud: A human operator uses AI tools along the way, such as drafting convincing phishing emails or researching targets. A person reviews the results and tries again, so headcount still limits scale, though each person produces more.
• Agent-operated fraud: An autonomous AI agent plans, runs, and adjusts the whole attack. It learns from each rejection and retries on its own, so scale depends on compute budget and the strength of the defense.

Voice cloning, deepfake video, and AI-written phishing all appear in agentic attacks. A defense tuned to spot any one of them misses the bigger pattern, which is an attacker that learns.

How agentic fraud works

At the agent-operated end, an attack follows a repeating loop that the agent can run without a person watching:

1. Assess the current state of the target system, such as which checks it runs.
2. Choose an action, such as which fake identity or document to try.
3. Submit it through an entry point, such as the camera, a file upload, or an API.
4. Observe what comes back, including approvals, rejections, error messages, and delays.
5. Update the approach, then retry, escalate, or move on to a new target.

The loop repeats until the attack succeeds, the attacker's budget runs out, or an institution’s defenses flag the AI agent as fraudulent.

It’s step four that makes agent-operated fraud so dangerous. Systems supply fraudulent agents with more than a simple “yes” or “no”; reason codes, response times, retry limits, and error wording all tell an adaptive attacker where the line between approve and reject sits. Every rejection strengthens an AI agent’s understanding of how to succeed next time.

Incode's fraud analysis groups the many observed techniques into four cooperating roles that any one AI agent can take on at scale:

• Collect: gather leaked identity data, public profile details, and social context.
• Create: build synthetic identities (identities assembled from real and invented details), documents, media, and account histories that hold together as a package.
• Test: submit variants, watch the outcomes, and learn which stages create friction.
• Scale: repeat winning patterns across accounts, channels, devices, and countries, and regenerate whatever gets blocked.

Attackers go after the cheapest stage in the chain, which is often the one a team measures least. A business with strong onboarding checks and soft account recovery will see the attack move to recovery. A strong deepfake detector (a tool that spots AI-generated faces, voices, and video) paired with a permissive transaction layer invites an attacker to pass with a real face and abuse a valid session later.

Agentic fraud statistics for 2026

Incode's Agentic Fraud Report tracked 66 independently sourced, cross-checked cases of AI-enabled fraud in the US, and 44 of them are confirmed through documented methods. These are the headline findings:

• Documented AI-enabled fraud in the US grew more than fivefold between 2023 and 2025, after years near zero.
• Reported losses across the catalogued cases approach 900 million dollars. That total is a floor, since an estimated 93% of scam losses never reach official statistics, according to the Global Anti-Scam Alliance.
• Voice cloning appears in over half of the cases, and AI chatbots and agents running scams end to end are the fastest-growing method.
• Nine in ten catalogued incidents fall into fraud categories that an autonomous agent can already run on its own, and FBI and FTC data show those same categories growing fastest.
• Payments to AI scam-service vendors have surged roughly 1,900% since 2021, AI-generated phishing converts 4.5x better than human-written attempts, and 90% of fraud professionals report facing more AI-driven attacks.

Global scam losses are also growing at nearly 20% a year, according to Nasdaq Verafin, while the workforce behind scams stays roughly fixed. In the report's projection model, US fraud losses could multiply by up to 25x if automation deepens.

Examples of agentic fraud

These four publicly documented cases show how the three forms of agentic fraud play out in practice.

Arup deepfake video call scam

In early 2024, a finance employee at engineering firm Arup's Hong Kong office was invited to a video call in a message that appeared to come from the company's UK-based CFO. But every participant on the call, including the CFO, was a deepfake. The employee made 15 transfers totaling about $25 million before checking with headquarters and learning the meeting never happened. Because people ran this attack and AI produced the fake faces and voices, this constitutes AI-generated fraud.

$129 million AI executive impersonation case

In November 2026, federal prosecutors in New York indicted three people accused of using AI to impersonate corporate executives and attorneys to steal about $129 million. According to the indictment, the group targeted thousands of companies over more than a year and a half.

They often emailed a company's accounting department in the name of the CEO, then set up a phone or video call where AI mimicked the CEO's voice and sometimes the CEO's image, and pointed the target to a second impersonator posing as an attorney at a major law firm. The defendants are charged with wire fraud and aggravated identity theft, and the charges remain allegations until proven in court. People handled every step while AI produced the voices and images, so this is another AI-generated case.

North Korean remote IT worker schemes

A fake job candidate who gets hired is already inside the organization, with real credentials and access to company networks. In May 2026, the Justice Department announced sentences for two US facilitators whose separate schemes helped North Korean operatives get hired by nearly 70 US companies. The companies shipped laptops to workers they believed lived in the United States, and the operatives logged in from overseas using stolen identities. Microsoft Threat Intelligence warned in March 2026 that operatives now use AI to build fake identities faster. People still run these schemes, with AI speeding up the preparation, which makes them AI-assisted fraud.

AI agent data extortion campaign

In August 2025, Anthropic reported that it had disrupted a criminal who used its Claude Code coding agent to run a data theft and extortion campaign against at least 17 organizations, including healthcare, emergency services, government, and religious institutions. According to Anthropic, the agent automated reconnaissance, harvested credentials, and penetrated networks, and it made decisions such as which data to steal and how to word each extortion demand. Ransom demands reached as high as $500,000.

The case involves extortion, and it matches the loop described earlier in this guide: an agent that runs the whole sequence and adjusts as it goes.

How to prevent agentic fraud

No single check stops an attacker that adapts after every rejection. Prevention works when defenses raise the attacker's cost at every stage of the customer journey. Five practices help most:

1. Defend every stage. Account opening, login, account recovery, transactions, and customer support each need controls, because attacks combine across stages.
2. Protect the capture path. Effective agentic fraud detection starts at the camera. Liveness checks (which confirm a real person is in front of the camera) and deepfake detection work best when paired with signals about the device, camera, and software that sent the image, since injected video can bypass a camera entirely.
3. Reduce feedback leakage. Give customers safe ways to fix a failed attempt and give your own team detailed evidence, without exposing the thresholds an attacker could learn from.
4. Use network and behavior signals. Treat repeated devices, linked identities, the speed of attempts, and activity right after account recovery as part of the identity decision. Incode's TrustGraph links fraud signals across more than 800 organizations, so an attack caught at one company can become detection at the next.
5. Step up at meaningful moments. Ask for another verification when risk changes, such as a new payee, a higher amount, a new device, or a recovery request.

Identity verification gives these controls a foundation. When an agent can run a scam from start to finish, the most reliable checkpoint is confirming that a real, verified person sits on the other side of the interaction.

How Know Your Agent (KYA) separates good AI agents from attackers

Many AI agents are legitimate. Customers increasingly send agents to log in, open accounts, and pay bills for them, and at the login screen a customer's agent and an attacker's agent can look the same: a valid credential, a clean device, and human-paced behavior. Blocking every agent turns away customers, but admitting every agent lets agentic fraud in.

Know Your Agent (KYA) is the framework that resolves this. It identifies the agent, binds it to the person responsible for it, and checks its actions against policy. Know Your Human (KYH) is the counterpart that proves a live person is present. Together they let a business ask who sent an agent and what that person allowed it to do, and an agent with no verified person behind it has no answer.

Ready to see how identity verification can help stop agentic fraud? Request a demo today.

Frequently asked questions about agentic fraud

What is agentic fraud?

Agentic fraud is fraud that is AI-generated, AI-assisted, or agent-operated. At the agent-operated end, autonomous AI agents carry out some or all steps of an attack, from finding targets to submitting fake identities and retrying after a rejection, with little or no human directing each step.

How is agentic fraud different from traditional fraud?

Agentic fraud puts AI to work at some or all stages of an attack. At the agent-operated end, an agent can run many attempts at once, work around the clock, and adapt after every rejection, while a human-run operation is limited by headcount and working hours.

Is AI-assisted fraud agentic fraud?

Yes. AI-assisted fraud, where a human operator uses AI tools to speed up parts of an attack, is one form of agentic fraud, along with AI-generated and agent-operated fraud. In agent-operated fraud, the agent runs the attack loop itself.

What types of fraud can AI agents automate?

Incode's Agentic Fraud Report scores confidence and romance scams 5 out of 5 for end-to-end automation. Investment fraud, imposter scams, and business email compromise each score 4 out of 5.

How can businesses prevent agentic fraud?

Layer defenses across every stage of the customer journey, protect the camera and capture path, limit what failed attempts reveal, use network and behavior signals, and step up verification when risk changes.

What is Know Your Agent (KYA)?

Know Your Agent (KYA) is a framework for deciding which AI agents to trust. It identifies the agent, binds it to a responsible person, and checks its actions against policy.