AI raises bank fraud risks as Australia faces control gaps

AUSTRAC has found potentially hundreds of millions of dollars in fraudulent loans.

Bank fraud in Australia is becoming harder to detect as criminals use artificial intelligence (AI) to forge identities and documents, whilst weaknesses in lending controls and legal protections leave banks and customers exposed, analysts said.

Konstantin Poptodorov, director of fraud and identity at LexisNexis Risk Solutions, Inc., said there was little specific evidence of AI-driven bank fraud two years ago, but the technology is now involved in almost every type of fraud his team sees.

“That ranges from fake identities, documentation, and deepfake videos,” he told Asian Banking & Finance.

Poptodorov also warned that criminals are recruiting third parties to facilitate fraud, including people who sell their identities for fraudulent purposes.

The Australian Transaction Reports and Analysis Centre (AUSTRAC) on 19 August said it had identified hundreds of millions of dollars in suspected fraudulent loans across 10 major banks.

The analysis followed Commonwealth Bank of Australia’s (CBA) self-reporting of about $712m (A$1b) in potentially fraudulent home loans to authorities in March. Some of the loans involved AI-generated documents and “synthetic identities,” which combine real personal information with fabricated details, according to reports.

The Australian Securities and Investment Commission and Australian Prudential Regulation Authority told Asian Banking & Finance separately that they are working with the industry and police on the mortgage fraud issue.

National Australia Bank was also involved in a separate $107m (A$150m) fraud and money-laundering case in September 2025 involving a senior banking manager who used fake documents to secure mortgages.

AUSTRAC said loan fraud was not confined to a particular lender or borrower group.

“Recurring warning signs across participating banks included falsified or misleading documents and the repeated use of mortgage brokers, accountants, and law firms across multiple loan applications,” it said.

Poptodorov said banks’ anti-fraud measures appear to be working because the industry has not been overwhelmed by AI-enabled fraud.

“What is happening is that the methods they use to forge documents are perhaps more sophisticated, but also the methods of fighting fraud are becoming more sophisticated,” he said via Zoom. “So we’re kind of learning on the same level.”

Alex Brooks, co-founder and vice president at Scam Victim Alliance, an Australian nonprofit organisation representing financial scam victims, said banks and consumers both face growing risks, although consumers often bear the losses.

“There is no question that banks are being scammed at the same rate as consumers and they are significantly investing in staff and technology to prevent scams,” she said in an emailed reply to questions.

Brooks’ son Louis lost more than $78,000 (A$109,305) in a property payment scam. She said the fraud involved insider knowledge of a property purchase and redirected a payment to a fraudster’s bank account.

Her son got an email impersonating a law firm and containing a forged Property Exchange Australia form about 30 minutes after speaking with the law firm by phone, Brooks said.

She and the Scam Victim Alliance also raised concerns that data breaches could help criminal networks identify bank and payment accounts vulnerable to scams.

Brooks cited an HSBC spoofing scam in which more than 1,000 Australians lost $24m (A$34m) between 2022 and 2024 after fraudsters posed as HSBC fraud investigators.

She said scam networks were also exploiting weaknesses in government identity controls, corporate registrations with the Australian Securities and Investments Commission (ASIC), and the Australian Financial Complaints Authority’s (AFCA) dispute-resolution framework.

“New and evermore inventive scam-adjacent information-harvesting lead-generation websites pop up faster than ASIC can take them down,” she said.

Poptodorov said regulators had taken an appropriate approach by focusing on risk exposure and policy rather than prescribing specific technologies.

Australia also has a well-defined cyber policy, he said. The Cyber Security Act 2024 covers cybersecurity requirements for products, information sharing, and responses to cybersecurity incidents.

“Rather than focusing on specific approaches, what we need to look at is where the risk is coming from, how the criminal community is acting, and just take a more holistic approach to fraud prevention,” Poptodorov said.

He said banks need accurate detection across multiple channels and layers because criminals can move to less-protected points when one control becomes harder to bypass.

“We can deploy the most sophisticated AI detection method in one place, in one channel, and at one point, and that would effectively stop fraud,” he said. “And then all it’s going to do is just move to another place where perhaps the criminals assume there are fewer detection methods.”

Brooks said gaps in Australia’s legal framework could leave customers bearing losses even when fraud exploits weaknesses in financial systems.

Corporations can exploit gaps between civil and criminal legal codes by making customers bear all the loss, she pointed out.

Brooks said her son received no reimbursement after his case, whilst another scam victim received partial reimbursement through AFCA.

CBA offered her son $712 (A$1,000) as a goodwill payment in exchange for a full and final settlement, Brooks said.