Agentic Fraud

Identity fraud has a new execution model. Where attacks were once driven by human operators submitting fake documents or scripted bots replaying credentials, they are now being replaced by autonomous AI agents that run the full fraud workflow without human involvement at each step.

This document is a technical taxonomy of that threat class. It defines the framework, describes two distinct attack surfaces that require separate defenses, and catalogs ten techniques observed in production environments, each with a technical description, an observed scenario, and detection signals.

What is agentic fraud?

Agentic fraud is a category of identity fraud in which the attack is executed by an autonomous software agent rather than a human operator. The agent finds targets, generates the synthetic media or documents required, submits them to verification systems, reads the outcome, and retries with adjusted parameters. The distinction from prior fraud automation is the feedback loop: the system observes what fails and updates its approach without requiring human involvement at each step.

Voice cloning, face synthesis, and document generation have each been commercially accessible since at least 2022. The shift is in how they are now combined: a single agent chains all three, runs the full sequence without human involvement, and does so across hundreds of parallel sessions at once. Earlier AI-assisted fraud required a person to direct each tool. The cost per attempt in agentic fraud falls to the cost of compute.

Each of those capabilities reached mainstream use within months of public release, and fraud operations adapted to each one. The timeline below traces six milestones from 2022 to today, pairing each public capability shift with the fraud applications that followed.

Each node marks a public AI capability milestone. Above the line: mainstream adoption. Below the line: how fraud operations adapted within months.

Significant change in the IDV Fraud execution model

Fraud analysis has historically organized attacks by artifact (what was faked) or by vector (how it entered the system). Both dimensions remain relevant. What AI has changed is the execution model, replacing human intervention with autonomous agents that observe, adapt, and retry.

An agentic attack is one where an autonomous software agent, not a human operator, executes the fraud loop. The agent observes system responses, updates its internal model, selects the next action, and retries. This cycle runs continuously, at scale, without human involvement in each iteration.

Manual fraud requires human effort and trial-and-error — slow, costly, less scalable. Agentic fraud generates, tests, adapts, and retries automatically; a continuous feedback loop drives improvement. Source: Incode — AIMS Workshop, CVPR 2026.

Three dimensions of any identity fraud attempt

A useful framework for classifying any identity fraud attempt uses three independent dimensions. Understanding each separately clarifies why agentic fraud requires a different defensive response than prior attack classes — a change in the execution model demands a change in the detection model.

A mature agentic operation typically starts with real media, making small incremental changes to probe system defenses and map which parameters trigger rejection. Once a vulnerability is identified, the operation scales: the validated attack pattern is deployed across hundreds of parallel sessions. By the time the financial loss event occurs, the attacker is operating on a valid credential issued to a fraudulent identity, often with no synthetic media involved in the triggering transaction.

Two distinct attack surfaces

Agentic fraud reaches identity verification systems through two fundamentally different paths. Each requires a distinct class of defense. The failure to distinguish them is one of the most common architectural gaps in current fraud programs.

Surface 01 Pre-agentic baseline

Classical presentation attacks (PAD)

Physical artifact → real camera → verification system

Traditional liveness detection was built to stop presentation attacks: 2D artifacts (printed photos, screens), 3D artifacts (silicone or paper masks), and video replay attacks. These require a human physically present at a device. They cannot be fully automated at scale.

This is the pre-agentic threat model. It is documented here because PAD is the defense layer that agentic injection attacks are engineered to bypass entirely.

Required defense

Media authenticity detection: liveness analysis (PAD), deepfake classification, anti-spoofing

Surface 02 Primary agentic surface

Injection attacks

Media → bypasses capture path → injected directly into data stream

Agentic fraud simulates the entire capture environment through three primary methods:

01Virtual camera drivers routing synthetic video directly into the data stream, bypassing the physical camera entirely

02Man-in-the-middle interception capturing and modifying payloads between the SDK and the verification server before they reach analysis

03Emulated device environments running at scale on device farms, each mimicking a distinct real device fingerprint, sensor profile, and behavioral signature

Required defense

Capture path integrity: device attestation, SDK integrity verification, emulator detection

Ten documented attack techniques

The following techniques represent the current generation of agentic identity fraud as observed in production environments. They are not mutually exclusive: a single fraud operation typically combines multiple techniques across different stages of the attack chain.

Four-stage execution model observed in production agentic fraud operations. Each stage corresponds to a cluster of techniques in the taxonomy below. Source: Incode threat intelligence / Agentic Fraud Technical Taxonomy.

Synthetic generation in practice

Base SDXL — generic "selfie" prompts. Outdoor backgrounds, studio lighting, high-end rendering. Caught by IDV detectors trained on KYC distributions.

IDV-domain fine-tuned — same prompts, generator fine-tuned on KYC capture data. Mobile camera quality, indoor lighting, realistic imperfections. APCER rises from 0.0000 to 0.905 against production detectors.

AFT-01 — Synthetic media generation

DFaaS rings operate fine-tuned generators — not commodity models. The gap between these two outputs is why IDV-domain fine-tuning breaks detectors trained on public benchmarks.

Source: Incode Mirage dataset — CVPR 2026 / Efim Boieru, Iago Suarez, Anvar Ganiev

AFT-02 — Document synthesis & cloning

Three generations of the same document. The base is a real credential. Each iteration modifies one field — name, date of birth, ID number — while preserving fonts, barcode encoding, holographic overlay placement, and machine-readable zone formatting. The result passes optical document verification because the structural signals are authentic.

The fraud operation does not forge from scratch. It edits real documents, one parameter at a time, to produce variants that survive cross-reference checks against public records. At $15 per document, a single service can produce 20,000 of these per day.

Source: Incode threat intelligence.

Select any technique for technical detail, observed scenario, and detection signals.

How techniques combine into operations

Individual techniques rarely operate in isolation. A mature agentic fraud operation runs multiple techniques in parallel, organized into functional roles. The Collect–Create–Test–Scale model describes how these roles interact.

Three questions fraud systems must keep separate

Most identity verification systems were designed around a single question: is this person who they say they are? Agentic fraud exploits the conflation of three distinct trust questions, each of which can be answered independently and each of which has different failure modes when systems treat them as one.

Mitigation principles by question

Detector embedding space

UMAP projection: real images, diffusion-based synthetic, GAN-based synthetic, face animations, and face swaps occupy distinct regions. A new unseen tool (Nanobanana Pro, red) lands in a separate region the detector had not encountered in training.

Adapting to cover a new cluster requires 20–30 labeled samples — not thousands.

Source: CVPR 2026 / Incode, Efim Boieru et al.