Bank impersonation: beyond regular fraud

Uri Rivner outlines seven ways financial institutions can prepare for the growing threat of fraud impersonation.

For years, fraudsters faced an annoying business constraint: they could have scale, or they could have quality.

Send ten million terrible phishing emails and perhaps someone would click. Or hire a social engineer to spend hours charming one victim into moving their life savings. It was one or the other.
AI has demolished that trade-off.

Think about a small bank or credit union. What if, in one lazy afternoon, thousands of its customers were attacked simultaneously? What if criminals used generative and agentic AI to launch polished, personalised conversations at once?

What if the campaign starts with a high-scale call spoofing attack? With no other visual cue, customers see the bank’s number on screen and trust it. The callers speak perfect English because they use real-time deepfake, or better yet - because they are AI agents trained for the job, with a script that adapts to questions and hesitation. The bank has detected fraud, and the customer must act immediately, usually by sharing a one-time code or visiting a convincing copycat site.

And what if, once credentials are stolen, the agentic attacker changes the password and phone number, disables alerts, and sends money through wires, ACH, or Zelle?

A year ago, these were theoretical questions. In 2026, they are reality. It’s not about to happen. It’s already happening, at scale.

Every week, hundreds of US banks and credit unions, many extremely small, are targeted through their customers. It started with larger regional banks and spread downstream, fast. Smaller institutions are selected precisely because their operational capacity is easier to overwhelm.

Five hundred targeted customers at one of the world’s largest banks may be an unpleasant Tuesday. At Bank #1,000, it becomes an institutional crisis. Alerts pile up. Analysts scramble. Call-centre queues stretch into the distance. Branches and operations receive conflicting instructions. Legitimate payments are delayed while dangerous ones slip through the chaos.

At this point, ‘fraud campaign’ is no longer an adequate description. Customers are the immediate victims, but they are almost part of a supply-chain attack, with the financial institution itself as the operational target. The attack is designed to exhaust finite human capacity. It resembles a denial-of-service attack: not because the website goes offline, but because critical decision-making does.

This is why AI-powered bank impersonation belongs on the operational-risk and cyber-risk agenda, with executive ownership, surge planning and rehearsed incident response. You do not want to invent the fire escape while the curtains are already burning.

Seven preparations before the phones start glowing

1. Have the awkward vendor conversation now. Smaller institutions depend heavily on core processors and digital banking providers. Ask which controls exist, which are enabled, what costs extra, and how quickly vendors can respond when alert volume rises tenfold. Can they detect remote-access tools, provide device and post-login behavioural data, protect outbound numbers, or remove copycat sites? ‘We assumed the vendor handled it’ is rarely delightful in a post-incident report.

2. Make alert rules ready for a flood. A rule that works beautifully at normal volume may become a concrete block tied to an analyst’s ankle during an attack. Combine risk signals rather than triggering on isolated anomalies: new beneficiary, high amount, and new device, for example. Add velocity logic. Know your false-positive rate and the precise volume at which manual review breaks. Every operation has a maximum load, even if nobody has written it down.

3. Watch the preparation, not only the payment. Account takeover leaves muddy footprints before money moves: password resets, changed contact details, disabled notifications, or a newly added authorised user, all from a new device. Connect these events to transaction monitoring and consider cooling-off periods for high-value payments following sensitive profile changes. The wire is the finale; do not ignore the first four acts.

4. Use behavioural and device intelligence. Correct credentials do not necessarily mean the correct human. Typing rhythm, navigation, pasted data, unusual devices, remote access, SIM swaps, eSIM farms, and rent-a-phone services can expose an apparently legitimate session. Ask digital providers what signals they collect and whether those signals reach the fraud decision. Data imprisoned in a neighbouring system is mostly decorative.

5. Create a payment slowdown protocol. Criminal automation moves quickly; defenders sometimes need to manufacture time. Define when suspicious payments may be paused, who has authority, how customers are informed, and how transfers are safely released. The aim is not to turn every payment into a Victorian railway journey. It is to introduce precise friction where risk is highest, with compliance involved before the emergency.

6. Move verification out of the phone-call swamp. Calling customers about suspicious payments is slow, hard to scale, and confusing when the crime itself begins with a call from “the bank”. Build automated, branded, multi-channel digital verification. Contact established account parties, not a number changed five minutes ago, and reach multiple valid parties where possible. Verification needs high-trust proof, rapid resolution, and machine speed. Alert resolution is the new bottleneck; automate it.

7. Treat it as an enterprise incident. Fraud cannot solve this alone. The call centre must prepare for panicked customers. Retail and treasury teams must prepare for rapid changes to money-movement controls. Digital and IT own channels and vendor relationships. Communications must protect trust. Legal and compliance must approve slowdown policies. Executives must decide how much friction and exposure the institution will tolerate, and which tools to adopt before the storm hits. Agree on roles, thresholds, and escalation paths, then run a tabletop exercise. Preferably one where the first discovery is not that three essential people are on holiday.

The old fraud model assumed criminals searched for vulnerable customers. The new model searches for institutions with vulnerable capacity. When fraud behaves like a denial-of-service attack, the analyst queue becomes a weapon.

We live in interesting times. AI is the biggest game changer in financial crime, and the industry needs a new defence doctrine: one that moves at machine, not human, speed.

About author

Uri Rivner is CEO and co-founder of Refine and co-founder of BioCatch, the behavioural biometrics company acquired by Visa. Previously, he led New Technologies at RSA following its acquisition of Cyota. A 25-year financial crime veteran, Uri has worked with leading global banks and spearheaded innovations including Risk-Based Authentication and the world’s first eFraud Network.

 

 

About Refine Intelligence

 

Refine Intelligence helps banks and credit unions resolve fraud alerts at machine speed, achieving >88% alert auto-resolution through Agentic AI triage, high-trust automated customer outreach, and Intent-aware AI.