Fraud rings now operate like a business—and one-time onboarding checks aren’t enough

Karen Boyer spends part of her week in industry groups, IFCI, BPI and the ABA among them, and she was careful to say on Mitek Systems' Fraud and Focus podcast that she was describing what those groups see across the industry, not what any one bank sees. What they see is a criminal trade with no entry requirements. A fraudster once had to find a dark net forum and get another criminal to vouch for them, Boyer, senior vice president of financial crimes at M&T Bank, told host Adam Basia, who leads product marketing at Mitek.

That change ties together what Basia calls the four horsemen: deepfakes, data breaches, template attacks and injection attacks. Each is a separate problem. Together, Boyer and Basia argue, they turn fraud into a business that is tested, refined and resold, and that a one-time onboarding check was never built to stop.

Check cooking shows how a single hit becomes a run

Basia points to check fraud, which he said has occupied Mitek for a large share of its history, as the clearest example. Check washing meant stealing one paper check, lifting the ink and getting one attempt. Now, he said, a criminal photographs the check, builds a template and deposits the same image at multiple institutions, altering it slightly after each success.

Boyer corrected him on one point: the deposits do not just get attempted, they clear. The check itself is genuine, taken from stolen mail, so the counterfeit-detection work banks spent years building around check stock has nothing to flag. What gives the scheme away is the activity around the check, she said, and regulations written for paper originals have not caught up with the technology.

For a payments or operations leader the lesson is uncomfortable. A control that goes quiet is not a control that is finished. Basia compared fraudsters to water that always finds the path of least resistance, and said the industry never gets to drop a defense, only add to it.

A fake ID and a face morph beat the front door

Deepfakes get the headlines because they are visual, Basia said. Boyer said the threat is neither overstated nor fearmongering, and it predates the generative AI news cycle. In her investigator days, one question to a scam victim, whether they had ever met the person, was often enough to break the spell. Today victims answer that they FaceTime the person every day, and some of those faces are morphed to match a fake profile.

The same tools hit onboarding, where the bank has no history on the applicant at all.

Adaptive Security, a security awareness training vendor, describes on its own site a January 2024 case in which a finance worker at an engineering firm authorized $25.6 million in wire transfers to accounts controlled by AI-generated impersonators, on a video call where every other participant was a deepfake. The same material lists identity verification and know-your-customer systems as under pressure from AI-generated documents, synthetic identities and digital injection attacks. It is marketing for a training product and carries the vendor's interest, but the case it cites is dated and specific.

Boyer said the onboarding problem is spreading past banks into underwriting, title companies and real estate, and into hiring, where employers are discovering that applicants can pretend to be other people. Basia added that the branch deserves attention. A teller in Austin, Texas has no way to know what a Minnesota driver's license should look like, he said, and the digital defenses banks built in 2020 did not follow customers into the branch, which can make it easier to open a mule account in person.

Sleeper accounts waited for a pandemic that had not started yet

Every synthetic identity starts with something real, Basia said: stolen personal data from breaches, of which there is now no shortage. He asked whether that reality has changed how Boyer views trust at onboarding. Her answer was that it has not, because her career has run on guilty until proven innocent, but the bar for proof has moved.

A decade ago, matching an application's data to identity verification records counted for something, because the applicant had to know all of it. Now, Boyer said, that step proves little on its own. The work shifts to what she calls identity authentication, proving that the person typing Adam's information is Adam, with other digital signals doing the same job.

The long game is where the damage hides. At a bank where she worked previously, Boyer said, her team spotted synthetic sleeper accounts in 2020 and watched them in what she described as a honeypot. When EIDL pandemic relief arrived, the accounts began funneling government funds, even though they had been opened before the pandemic existed, farmed and seasoned for a bust-out whose target the fraudsters had not yet chosen.

Basia said he sees the same pattern: accounts built quietly to accumulate credit, then busted out, sold on Telegram or turned to money laundering. Boyer said the seasoning and the bust-out are often done by different people, with the account changing hands in between. Credit monitoring catches little of this, she said, and identity theft with no credit component at all, such as a stolen identity carrying a heroin-trafficking warrant, stays under the radar.

One gap at one bank becomes a flood everywhere

Template attacks give the model its scale. Once a ring finds a document type or application pattern that passes at one institution, Basia said, it repeats it thousands of times and moves to the next. He asked whether the past two years feel like a shift from isolated attacks to something industrialized.

Boyer offered a hypothetical, with her usual disclaimer that she has no inside knowledge of any bank's controls: a ring learns that one bank accepts passport cards its document check handles poorly, floods it, then scouts for other banks using the same vendor. The consequence for a fraud or risk executive is that onboarding cannot be treated as a gate, she said. It has to be one input into monitoring that runs for the life of the account.

The old rule of thumb that a bad account reveals itself within a few months of opening no longer holds for sophisticated schemes, she said. Losses have to be reviewed at scale, not one by one, to find the shared feature that traces back to a broken control at application time. Basia said fraud defense is by nature a little reactive: the first sighting of a new tactic is usually a loss, and the job then is to search the book for everything that resembles it before it breaks out.

Injection attacks arrive looking like normal traffic

The fourth horseman used to seem technical even to him, Basia said. Free virtual cameras and online tutorial libraries now let someone with a decent laptop push content straight into a verification system in minutes. Boyer's response was blunt: a well-executed injection attack does not look like an attack, it looks like ordinary activity, so the industry is less sure how much it is seeing than how much it is missing.

That is the practical question for a bank or fintech buying identity tooling, and for the CFO signing off on it. Basia's warning is that nothing gets retired, since check fraud returned once the industry assumed it was solved. Boyer's signal is more specific: when losses examined together share a document type, a channel or a vendor path that dates to onboarding, that commonality is the broken control, and a ring is already testing it at the next bank.