In recent weeks there have been uncomfortable revelations surrounding an AI agent’s unauthorised access to Australia’s Medicare statistics portal. While authorities have stated there is no evidence that personal medical information was accessed, the incident serves as a reminder that AI systems are becoming increasingly capable in ways we are only beginning to understand.
In the world of fraud and scams, AI is enabling new forms of deception that are more convincing, more personalised and more scalable than anything we have seen before.
For almost two decades, my research has focused on fraud, scams, cybercrime and victimisation. During that time, I have spoken directly with hundreds of victims. One lesson has remained remarkably consistent: fraud is often portrayed as a technological problem, but it is fundamentally a human one. AI may change the tools used by offenders, but it does not change the underlying dynamics of trust, manipulation and victimisation.
The technology is new, but the deception is not
Fraud is not new, and the evolution of technology, AI or otherwise, has not created fraud. It has, however, radically altered the ways in which offenders are able to perpetrate deception, and the speed and cost involved in targeting victims globally. AI can be seen as a force multiplier in this context, profoundly increasing the speed, scale, sophistication and accessibility of fraud offending.
AI allows offenders to create polished, targeted and realistic approaches to victims. It can generate convincing communications, create synthetic identities, clone voices and automate interactions that previously required substantial human effort.
Offenders use a range of deliberate techniques to build trust and rapport with potential victims. They take on the personas of banks, government agencies, employers, family members, friends or partners. They use social engineering approaches, grooming tactics and psychological abuse techniques to create credibility and encourage compliance. They create situations that seem plausible and require a response based on urgency, secrecy or emotion.
AI allows the proliferation of these techniques at scale while maintaining the appearance of a personalised interaction. No longer can we assume that seeing, or even hearing, is believing. Increasingly, we are being asked to navigate an environment where trust and authenticity are becoming more difficult to determine.
When traditional warning signs no longer work
Traditionally, fraud prevention messaging has revolved around a checklist of warning signs. Spelling mistakes, poor grammar, awkward language and implausible or visibly fake images have all been promoted as indicators that something is wrong. However, those warning signs are becoming less reliable.
We have spent years telling people to reverse image search profile pictures to ensure they have not been stolen from social media. Yet if an offender is using AI to create an entirely synthetic identity, complete with unique images of a person who does not exist, this advice quickly becomes redundant.
Importantly, regardless of the format or content of the message, timing remains critical. A fraudulent approach does not need to be perfect. It simply needs to seem plausible enough in that moment to elicit a response. Once that occurs, the offender has succeeded.
Historically, responsibility for fraud prevention has largely been placed on individuals. Drawing on what O’Malley (1992) describes as the “prudential citizen”, the underlying assumption is that victimisation occurs because individuals have failed to adequately protect themselves. But in a world where even detailed levels of due diligence and verification may no longer be sufficient, telling people to be “more careful” is increasingly inadequate.
Critically, we also need to stop talking about “falling for fraud” as though it is a passive experience that someone simply stumbles into. Such language obscures the actions of offenders and minimises the skill involved in manipulating victims. Instead, we need to recognise the deliberate and purposeful nature of fraud offending, and the reality that victimisation can happen to anyone.
Vulnerability is about circumstances, not characteristics
There remains a persistent narrative that fraud only happens to “other people”. Popular beliefs often centre on older people, younger people, those with lower levels of education, or those perceived to be more trusting than others. My research has consistently challenged this assumption.
Vulnerability is rarely fixed. Rather, it is contextual, dynamic and constantly changing. The question is not who is vulnerable. The question is when vulnerability occurs.
Major life events such as the death of a loved one, illness or divorce may increase vulnerability. Temporary circumstances such as loneliness, financial stress or emotional distress may do the same. Sometimes vulnerability emerges in entirely ordinary situations, such as checking an email while distracted, receiving a phone call at the wrong moment, or responding to a message from an organisation you were already expecting to hear from.
Everyone has a weakness or vulnerability that can be exploited, if targeted in the right way at the right time. The challenge is that AI enhances the ability of offenders to identify, create and exploit these moments consistently and at scale.
This matters because the impacts of fraud extend well beyond financial loss. Throughout my research, victims have described experiences of anxiety, depression, declining physical health, relationship breakdown, unemployment, homelessness and a persistent fear of future victimisation. Many also experience profound shame and embarrassment. The financial loss may be detrimental, but it is often not what impacts victims the most profoundly.
Fraud prevention is a shared responsibility
The Australian Government’s Scams Prevention Framework represents an important step towards recognising that fraud prevention requires stronger organisational and system-level responses. Fraud prevention cannot remain solely an individual responsibility. It requires a collective effort involving government, technology companies, telecommunications providers, financial institutions and online platforms.
When used positively, AI may also offer powerful opportunities to detect, disrupt and prevent fraud. However, if we continue to define fraud solely through the lens of technology, we risk missing the key issue.
The future of fraud is not a story about machines, rather it is a story about people.
The key lesson from my research is that despite the rise of AI, fraud remains unchanged at its core. Our challenge is ensuring that our responses evolve accordingly, moving beyond victim-blaming and towards a shared responsibility for preventing fraud and supporting victims.
You may also be interested in these publications from the author:
Button, M. & Cross, C. (2017) Cyber frauds, scams and their victims. Routledge, United Kingdom.
Cross, C. (2024) Romance baiting, cryptorom and ‘pig butchering’: an evolutionary step in romance fraud. Current Issues in Criminal Justice, 36(3), pp. 334-346.
Cross, C. (2022) Using artificial intelligence (AI) and deepfakes to deceive victims: the need to rethink current romance fraud prevention messaging. Crime Prevention and Community Safety, 24(1), pp. 30-41.
Cross, C. (2015) No laughing matter: Blaming the victim of online fraud. International Review of Victimology, 21(1), pp. 187-204.
