Banks issue warning over AI-powered identity fraud risks

The Better Identity Coalition has announced two publications from the Financial Services Sector Coordinating Council on AI-driven threats to identity and authentication. The papers were produced with the American Bankers Association through a Treasury-backed industry initiative.

The documents examine how financial institutions and policymakers should respond to identity fraud linked to generative AI, including deepfake impersonation, synthetic identity creation, and the use of AI agents in fraud attempts. One paper reviews attack methods and defensive tools for firms; the other outlines 20 policy actions for government and regulators.

The work was developed over 18 months by a group co-chaired by the Better Identity Coalition, the American Bankers Association, and the Financial Services Sector Coordinating Council. More than 130 experts from financial institutions, technology companies, regulators, and government agencies contributed to the project.

The initiative was part of a Treasury Department effort to strengthen cybersecurity and AI risk management in the financial services sector. It also involved members of the Financial and Banking Information Infrastructure Committee, the government counterpart to the FSSCC.

Attack Vectors

The main industry paper, Mitigating AI-Powered Attacks Against Identity and Authentication, identifies what it describes as the 10 leading attack vectors generative AI poses to financial institutions. These include deepfakes that mimic faces, voices, and video; synthetic identities built from real and fabricated data; and AI agents used to automate fraudulent activity.

The publication also details tools financial institutions can use to detect and stop such attacks. A companion paper, Recommendations for Policymakers: Mitigating AI-Powered Attacks Against Digital Identity and Authentication, sets out four broad areas for government action.

They include developing next-generation remote identity proofing and verification systems, expanding the use of stronger authentication methods, coordinating internationally on standards and requirements, and increasing education for consumers and businesses on identity threats.

The policy paper also points to mobile driving licences and other digital credentials as part of the response to AI-enabled fraud. It argues that stronger digital identity infrastructure and phishing-resistant authentication, such as passkeys, would help financial institutions address current and emerging attacks.

Congress has already begun engaging with one of the recommendations. The Stop Identity Fraud and Identity Theft Act of 2026, introduced by Congressmen Pete Sessions and Bill Foster, would direct the US Treasury to establish an Identity Fraud Prevention Innovation grant programme for states.

The proposal would support digital versions of driving licences and other identity credentials that meet National Institute of Standards and Technology guidelines. Its aim is to help states develop credentials that can resist deepfake-enabled fraud.

According to the policy paper, limited progress by states reflects resource constraints and funding gaps. It argues that a grant programme could help states accelerate development of mobile driving licences and related credentials.

Industry Concerns

The two publications are intended to serve as a playbook for both the financial services sector and government. The emphasis reflects growing concern that AI tools are lowering the cost and increasing the scale of identity fraud, while making impersonation attempts harder for banks and other organisations to detect.

Financial firms have seen more fraud attempts involving manipulated video and audio, as well as synthetic identities used to open accounts or obtain credit. Security specialists have also warned that AI agents could enable criminals to run attacks more automatically and persistently across multiple channels.

Jeremy Grant, coordinator of the Better Identity Coalition, said the papers were designed to provide practical guidance on a problem escalating across the sector.

"At a time when criminals and hostile nation-states are leveraging AI-powered deepfakes to convincingly spoof photos, videos, and voices, companies need concrete, actionable recommendations on how to address these threats to best protect consumers from identity theft and fraud," Grant said.

"Stopping AI-powered cybercrime and fraud starts with hardening our identity and authentication infrastructure; the FSSCC's new publications provide both financial institutions and government a roadmap on where to get started," he added.

The coalition's members include large technology groups, banks, credit bureaus, and identity companies such as Apple, Block, Capital One, CVS, Equifax, Experian, Google, JPMorgan Chase, Microsoft, Okta, PNC Bank, TransUnion, US Bank, and Wells Fargo.