AI-Enabled Fraud at Financial Institutions: What Audit Committees Should Ask

AI-generated documents and deepfakes can pass through controls even if a financial institution barely uses AI. Here’s what audit committees need to ask.

Earlier this year, Commonwealth Bank, Australia ’s largest mortgage lender, reported that it had uncovered over A$1 billion (approximately US $700 million) in suspected home loan fraud. The incident involved an increasingly common practice: loan application submissions fabricated by artificial intelligence (AI).

This should sound the alarm for every financial institution’s audit committee, which must ensure that unreliable, AI-generated information cannot pass through its controls and affect customer assets, the institution’s balance sheet, or financial reporting. Back in 2024, for instance, the US’s Financial Crimes Enforcement Network (FinCEN) issued an alert on deepfake fraud schemes targeting financial institutions and found that such entities often detected synthetic content in identity documents only after the potential customer passed through onboarding controls.

Within its purview around AI-enabled fraud, the audit committee should understand significant risks and potential losses, related processes and controls, potential financial reporting implications, known gaps and remediation efforts, and the institution’s readiness and contingency plans.

While significant confidence is placed in internal audit’s findings, less than 40 percent of senior internal audit leaders in North America considered their functions adequately prepared to detect AI-enabled fraud. Relatedly, audit committee chairs have “expressed concerns … around integrity of information and staff preparedness to detect fraud that might be facilitated with the use of” AI.

Here’s what audit committees need to know to understand that potential gap.

Why Financial Institutions Are a Top Target for AI-Enabled Fraud

Although all companies face risks from fabricated information, financial institutions may be more likely targets because of the nature of their business:

• Customer onboarding may be exposed to synthetic identities, fabricated identification documents, or manipulated images used to defeat verification.
• Lending may be exposed to fabricated borrower financial statements, tax records, or collateral support that distort credit decisions.
• Payments and customer servicing may be exposed to impersonated instructions, account takeover, or fraudulent changes to beneficiary details.
• Financial reporting may rely on unreliable inputs, including altered data, that impact credit loss estimates or valuations.
• Third-party arrangements may introduce unreliable identity checks, transaction data, or other information that the institution uses without independent validation.

While some processes have long been vulnerable to falsified information, AI can streamline creation of highly convincing fabrications that traditional controls may not detect.

Nearly nine in ten internal audit respondents to the survey cited above identified AI-powered phishing as a top concern. Other concerns included fabricated invoices or financial documents (65 percent), automated social engineering (58 percent), and synthetic identity fraud (27 percent).

The following areas and questions can help guide audit committee discussions.

Where could AI-enabled fraud cause significant losses?

The audit committee should ask how the institution assesses risk and potential losses arising from unreliable information:

• How has the institution identified the points at which unreliable information could lead to the authorization of a sizeable transfer, establishment of a significant customer relationship, a consequential credit decision, or a material financial reporting judgment?
• Has the institution’s risk assessment considered the risk of unreliable information across its products and delivery channels, including its reliance on third-party information?
• Does management’s risk assessment consider coordinated deception across several stages, such as creating an account, changing contact details, and initiating a payment?
• Who owns each significant exposure, what residual risk has the institution accepted, and is the residual risk consistent with the institution’s risk appetite?
• How do emerging fraud attempts or changes in attacker capabilities trigger reassessment, and how are AI-facilitated fraud incidents captured and monitored?

Are identity verification and payment controls strong enough?

The audit committee should understand the institution’s current identity verification and payment controls, including any deficiencies, how exceptions are authorized, which residual exposures the institution accepts, and how the strength of verification controls varies relative to the level of risk and materiality of potential losses.

Committees should consider:

• Where has the institution replaced existing controls or introduced new controls in response to its risk assessment?
• Which risks does the institution address through independent verification?
• How does the institution independently verify identity, authority, and document authenticity before opening accounts, granting credit, changing beneficiary details, or releasing funds—particularly for material, higher-risk transactions?
• Could corroborating evidence come from the same fraudster? For example, do callbacks use independently established contact details rather than information supplied in a suspicious request?
• How do monitoring controls detect coordinated fraud patterns, including linked synthetic identities, repeated supporting documents, rapid account changes, or payments to common beneficiaries?
• What testing has been done under realistic conditions that demonstrates employees and systems can resist these attacks?

How can AI-enabled fraud affect financial reporting?

The audit committee should discuss how unreliable information gathered earlier in customer onboarding, lending, or transaction processing may affect the institution’s reporting judgments. For instance:

• How does management identify and validate inputs potentially affected by unreliable information and prevent this information from influencing significant estimates, disclosures, or key performance indicators?
• Do significant data inputs, assumptions, and supporting documents have a traceable history? Can the institution determine their origins, identify who changed them, and establish which versions supported a reporting judgment?
• If a fabricated document or identity is discovered, how does management identify other affected accounts, transactions, portfolios, and reporting periods?
• How does management assess resulting losses, customer reimbursement obligations, and reporting implications, including notifications or disclosures required under applicable rules or contractual obligations?

Which gaps remain, and how are risks tracked and mitigated?

The audit committee may seek to understand which emerging risks may not yet be fully addressed, as well as the status of mitigation efforts:

• What confirmed or attempted frauds, near misses, or controlled tests have exposed weaknesses involving unreliable information?
• Which significant risks remain unresolved, and how will control effectiveness be demonstrated?
• For each significant weakness: who owns remediation, what is the target date, and what interim restrictions or additional approvals reduce exposure?
• Does remediation address the underlying control failure across all relevant products and channels rather than only the specific fraud technique observed?
• How will overdue actions, repeat incidents, and accepted residual risks be reported to the committee?

Is the institution ready to contain AI-enabled fraud once identified?

The institution should be prepared to contain and investigate fraud that bypasses preventive controls. The audit committee should understand when it will be notified of significant incidents and how information will be shared with the board risk committee, where applicable.

Audit committees should consider:

• How does the institution test payment containment and customer response under realistic time pressures?
• Does the institution understand when recovery depends on action by other institutions or service providers?
• Can the institution quickly identify related fraudulent activity; secure affected accounts; preserve original communications, instructions, authentication records, approval histories, and access logs; and prevent further losses?
• Are responsibilities and arrangements clear for contacting affected customers, counterparties, and receiving institutions; pursuing recovery; supporting affected customers; and making required notifications?
• If an identity-verification method or service provider is compromised, can critical activities continue through a tested alternative without weakening fraud controls?
• Are incidents appropriately escalated to management, the audit committee, and the board risk committee, if applicable?

How can internal audit teams better detect and prevent AI-enabled fraud?

Internal audit has a key role to play in detecting and preventing unreliable information from affecting the institution. The committee should understand internal audit’s risk assessment and assurance coverage for the areas discussed above. Questions include:

• How does internal audit’s plan cover material risks related to unreliable information across business functions and third-party arrangements?
• Does internal audit have appropriate expertise and access to relevant systems and records to identify unreliable information, including those of service providers?
• What does testing reveal about how employees respond to requests presented as urgent or supported by seemingly credible voice or video content (e.g., AI deepfakes)? How does internal audit use these findings?
• Which business or third-party dependencies remain outside of internal audit’s assurance coverage?

Next Steps for Audit Committees

Given the potential for AI facilitated fraud, your committee’s next discussion should connect information reliability to the institution’s most consequential decisions, risks, and reporting judgments.

Now is the time to ask management and internal audit teams to identify exposures with the greatest potential for loss, consequences if those losses occur, and the most effective ways to mitigate those exposures.