AI is changing how fraud happens, making attacks faster, more convincing, and harder to detect. Discover how AI-powered fraud detection, behavioral analysis, mobile-network signals, and risk-based authentication help businesses identify suspicious activity, protect OTP flows, and keep customer journeys secure.
Sandra Posavac Content Marketing Specialist
A bank customer opens their app to pay a service provider. As they add the payee, the bank detects a recent SIM change and several password-reset attempts. Instead of blocking the customer outright, it pauses the change and requests an extra verification step. The bank confirms the customer’s identity and allows the payment to continue. A short explanation tells the customer why the check was needed and what to do next.
AI for fraud detection helps identify patterns like these and highlight suspicious activity. The challenge is turning those insights into the right response: preventing account takeover while keeping legitimate payments and customer journeys running smoothly.
25%
of organizations use AI or machine learning in their anti-fraud initiatives.
28%
of organizations expect to adopt AI/ML in their anti-fraud initiatives by 2028.
AI makes familiar fraud tactics faster and easier to adapt. Generative AI, including large language models, can write convincing messages, translate them, and create fake images and audio. Criminals can use this content to impersonate employees, suppliers, banks, customers, or public figures. They can also repeat these tactics at scale.
The FBI’s Internet Crime Complaint Center says AI can reduce the time and effort needed to deceive people. Its alert highlights fake profiles and IDs, cloned voices, fake videos, and chatbots that direct people to harmful links. AI makes it easier to create multiple versions of an attack, avoid common warning signs, and target people who may be more likely to respond.
Fraud often involves a sequence of connected actions. An attacker may start with fake identity details during sign-up, then send a message or make a call to gain trust. A credit card transaction may be just one part of a wider sequence involving account changes and messages. Later, the attacker may request a payment or verification code. Each step can look normal on its own, which makes it important to connect activity across sessions and account changes before deciding how to respond.
The scale of these threats is also reflected in Infobip’s Fraud and Security Report 2026. According to the report, the volume of harmful messages detected on Infobip’s platform increased by 77% between 2024 and 2025. Phishing accounted for 49% of blocked harmful content, compared with 45% the previous year. Phishing volume also climbed by 94% year over year.
These figures show that familiar attacks remain a major threat, even as deepfakes attract more attention. Focusing only on fake audio, video, or OTP abuse can leave other parts of an attack unnoticed.
The report also records growth in two AI detection categories. Text Detection rose 59%, while Image Detection increased by 628% over the year. Text and image analysis can help identify different parts of the same attempt. A message may use language that imitates a trusted brand, while an image may contain a fake invoice or ID. Together, these checks provide more context for assessing suspicious activity and deciding what action to take.
In practice, AI helps financial services identify patterns across large amounts of data and flag suspicious activity earlier. Fraud detection systems can compare current actions with previous behavior, connect related attempts, and prioritize activity that needs a closer look.
As part of a broader fraud prevention strategy, AI-powered systems can help make detection faster and more consistent. Clear rules and review processes ensure that the resulting actions remain appropriate.
Useful signals include:
- Changes in usual behavior: Differences in login habits, device usage, account activity, or transaction frequency. Data should be handled in line with privacy requirements and applicable consent rules.
- Unusual OTP requests: Repeated requests or bursts sent to multiple numbers. These patterns can indicate automated abuse.
- Phone number and SIM changes: A number’s status or a recent SIM change can provide additional context that may not be visible within an app.
- New devices and account activity: A new device, sudden account changes, or unusual payment patterns may warrant an additional verification step, especially when several signals appear together.
An AI-generated risk score serves as a signal to guide a defined response, rather than evidence of fraud. Understanding what a score represents helps translate detection into appropriate action.
Performance should be measured through indicators such as false blocks, missed cases, customer drop-off, and results across different regions and user groups. These insights help improve accuracy while keeping customer journeys smooth. Data quality also matters: incomplete historical information and emerging fraud patterns can affect how well machine learning models perform. Regular reviews help keep detection relevant as threats evolve.
Behavior signals show how a person uses a service, while mobile-network signals provide information about the phone connection. AI can help analyze these different data sources together to identify patterns and highlight activity that may indicate fraud. A device may still look familiar after a SIM change, while a stable SIM does not necessarily mean that session behavior is normal.
Network checks are particularly valuable when they support real-time decision-making. Integrating network intelligence into fraud detection processes can help businesses respond to suspicious activity as it happens. Setting response-time requirements and defining fallback actions in advance also helps maintain consistent decisions when a particular check cannot be completed.
An OTP confirms that someone can receive a code through a chosen channel. It is an important part of authentication, but it does not independently confirm account ownership or guarantee that an action is legitimate.
For example, a customer may share an OTP after an attacker impersonates their bank. The code confirms access to the communication channel, but not whether the person requesting it is trustworthy.
Risk-based authentication helps apply the right level of verification to each situation. Routine, low-risk journeys can remain simple, while higher-risk actions trigger stronger checks.
AI and machine learning can support this process by identifying suspicious patterns across requests, account history, session behavior, and network information. These insights can help determine whether to allow a request, limit retries, ask for additional verification, or block clearly abusive activity. The goal is to strengthen security without adding unnecessary steps for legitimate customers.
The importance of adapting fraud prevention measures is also reflected in Infobip’s Report. Data from Infobip Signals showed a 35% decrease in suspicious activity overall and a 38% decrease in suspicious messages. However, suspicious artificially inflated traffic (AIT) increased by 86% in Europe and 75% in Latin America. These findings highlight how fraud patterns can vary across regions, making it important to adapt detection methods and prevention measures to local threats.
Before sending an OTP, businesses can use Infobip’s SIM Swap API to check for a recent SIM change and factor that signal into the risk decision. A recent change may call for a stronger check or a different authentication route, rather than an SMS OTP alone. For journeys that need stronger protection, Infobip’s Number Verification API can verify a mobile number through the network without asking the customer to enter a code. SIM-based Number Verification can provide a phishing-resistant option where available.
Infobip Signals and Authenticate support two complementary aspects of OTP security. Infobip Signals uses machine learning and adaptive algorithms to identify and block fraudulent OTP requests, helping protect messaging traffic from abuse. Infobip Authenticate supports omnichannel two-factor authentication and OTP delivery, helping businesses build secure and convenient verification journeys. Combined with risk-based rules, these capabilities support stronger authentication while keeping the experience straightforward for legitimate users.
An effective fraud prevention strategy connects each risk signal to a clear action. Every high-risk activity should have a defined response, an assigned owner, and a fallback for situations where information is unavailable. Security measures should also protect legitimate customer journeys.
Here are six practical steps to consider:
- Map potential fraud entry points. Look at the entire customer journey, from sign-up and login to OTP requests, account changes, and payments. Identify which signals are available at each stage.
- Define risk levels and responses. Decide what should happen at low, medium, and high risk. Apply the lightest effective control and reserve hard blocks for situations supported by clear evidence.
- Combine signals from different sources. Avoid making high-impact decisions based on a single weak indicator. Compare session behavior with message, account, and network data whenever possible.
- Protect the OTP journey. Check for a recent SIM change before sending an OTP and use that signal to decide whether an extra verification step is needed. Set appropriate request limits and retry rules. Distinguish between a legitimate customer who needs another attempt and automated traffic spread across multiple numbers.
- Measure security and customer outcomes. Track fraud losses, blocked abuse, false blocks, completion rates, support requests, and regional differences. A higher detection count may reflect increased traffic or a change in detection rules, rather than improved protection alone.
- Review models and rules regularly. Test performance across customer groups and channels. Document how data is used, update controls as fraud tactics change, and include human review in unclear or high-impact cases.
Consider a customer signing in from a familiar device after a SIM change and requesting several password resets. The familiar device alone may not justify a block. However, the recent SIM change combined with repeated reset requests may warrant an additional check or a short pause before the account is changed. Measuring the outcome helps establish whether this approach stops abuse while allowing legitimate customers to continue.
Before adjusting a model, establish a performance baseline. For each action, compare how much abuse it prevents, how many legitimate customer journeys it delays, and whether suspicious activity moves to another channel. Regular reviews across regions and over time help keep controls effective as fraud tactics evolve.
AI can identify patterns that would be difficult to spot manually, but the final decision should always consider the impact on legitimate customers. Successful fraud prevention means reducing abuse while keeping genuine customer experiences smooth.
As AI becomes more widely used across customer interactions, businesses are increasingly looking at how to coordinate AI agents, customer data, automation, and communication channels. AgentOS brings these elements together in a single platform, providing an environment for managing AI-powered customer engagement across different channels.
This broader approach shows how AI can support more connected customer experiences, from handling routine interactions to coordinating communication across channels, while keeping security and customer experience in focus.
