Every criminal enterprise has a production constraint. Drug trafficking is capped by the physical difficulty of moving product across borders undetected. Traditional fraud was capped by something less obvious but just as real: it took a skilled, convincing human being to run a scam, and skilled, convincing human beings don't scale. A con artist could only work so many marks a day, in so many languages, with so much patience.
Generative AI just removed that constraint. Not by inventing a new kind of fraud — romance scams, fake invoices, impersonation, and investment cons are all old crimes — but by making the labor behind them nearly free and infinitely scalable. That shift, more than any single statistic, is what's turning fraud into one of the fastest-growing criminal economies on the planet, and it's worth tracing exactly how it happened before getting to what actually stops it.
What AI actually removed from the equation
A scam used to require three things in short supply: someone who could write convincing, personalized messages at scale; someone who could sound or look like a trusted person on demand; and someone who could build a fake website or payment page good enough to survive a glance. Generative AI now supplies all three on command, which is why the recent surge in AI-enabled fraud looks less like a new threat and more like an old threat with its labor costs deleted.
Bloomberg's recent investigation into this shift — "AI's Supercharging a Scam Economy Bigger Than the Cocaine Trade" — puts a number on the result: citing Global Anti-Scam Alliance data, it reports that scam victims lost roughly $442 billion across 42 countries last year, a sum the piece says now exceeds some valuations of the entire global cocaine trade. Nearly two-thirds of victims, per the same reporting, pay within 24 hours of first contact — even as schemes like "pig butchering" still rely on weeks of AI-assisted grooming beforehand to get there. It's a striking comparison, but the more useful part of Bloomberg's reporting is the mechanism it documents underneath the number: a ZeroFox analysis cited in the piece found phishing pages hosted on the free tiers of nine developer and AI app-building platforms rose more than fourfold over two years, to roughly 10,600 — evidence that building a convincing fake payment page no longer requires any real skill, just a prompt.
Other research fills in just how far that collapse in skill requirements has gone. Sumsub's fraud data shows deepfakes' share of all fraud attempts climbing from 0.1% in 2022 to 6.5% in 2025 — a more than sixtyfold increase in three years. DeepStrike estimates the raw number of deepfakes circulating online has grown sixteenfold since 2023, to roughly 8 million. And Pindrop recorded a 1,300% rise in synthetic voice attacks in a single year, which tracks with a simple, uncomfortable fact McAfee has demonstrated directly: about three seconds of someone's voice is now enough to clone it with 85% accuracy.
The economics show up as real losses, not just capability
Capability only matters if it translates into money moving, and it clearly has. The FBI's Internet Crime Complaint Center reported $893 million in AI-related fraud losses across 22,364 complaints in its most recent full-year data — a figure the Bureau itself calls a floor rather than a ceiling, since plenty of victims never realize AI was involved in what defrauded them at all. The average loss per AI-flagged complaint, at $39,963, ran 93% above the IC3's overall average complaint loss. Separately, Vectra AI's analysis found AI-powered scam activity growing 1,210% year over year, against 195% growth for traditional fraud over the same stretch — AI-enabled fraud isn't simply adding to the existing problem, it's compounding roughly six times faster than everything else.
The single incident that makes this concrete is the 2024 fraud against engineering firm Arup's Hong Kong office: a finance employee joined a video call where the CFO and several colleagues present were all AI-generated deepfakes, and over the course of that call authorized 15 transfers totaling about $25.6 million. It's considered the largest confirmed deepfake-fraud loss to date, and researchers have calculated it at roughly 187 times the FBI's average reported business-email-compromise loss — one convincingly faked video call outperforming nearly two centuries' worth of ordinary email-based fraud attempts, in an afternoon.
It's also worth being honest about what sits behind a meaningful share of this industry: forced labor, not just code. The UN Office on Drugs and Crime estimated scam losses across East Asia, Southeast Asia, Australia, and New Zealand at $88.3 to $114.1 billion in 2025 alone, run substantially from compounds in Myanmar, Cambodia, Laos, and the Philippines where the UN Human Rights Office estimated at least 120,000 and 100,000 trafficked people, respectively, were being held and forced to work as of late 2023. The UNODC's own July 2026 assessment confirms these same networks are now layering generative AI and deepfake tools onto their existing cryptocurrency-laundering operations — meaning the efficiency gains described above aren't only benefiting lone fraudsters with a laptop; they're industrializing an operation already built on trafficked, coerced labor. And because PYMNTS Intelligence research found the share of scam victims who never report their fraud rose 26% over the past year — more than a quarter of non-reporters simply didn't know it was an option — every figure above should be read as a floor, not the real total.
Three layers, because no single one survives contact with a good fake
The pattern across every statistic here is the same: AI attacks aren't getting better at fooling content, they're getting better at fooling an entire channel — a voice on a phone call, a face on a video call, a page that looks pixel-identical to a real bank. That's a different problem than the one most fraud defenses were built for, and it's why protecting against it has to work on three separate levels, not one.
The first level is the human being who receives the call, the message, or the request. Detection tools can't catch everything a sufficiently convincing fake can slip past, so the realistic goal isn't eliminating human error — it's training it down through repetition. The same mechanic that's made phishing-simulation training effective for years (simulate the failure safely, correct it immediately, measure improvement over time) extends naturally to "spot the cloned voice" and "spot the deepfaked colleague" scenarios. An employee who has practiced recognizing a fabricated urgency play in a low-stakes drill is measurably less likely to act on one for real. This is the job of Human Risk Management.
The second level sits further upstream, at the devices and accounts these scams actually depend on. A meaningful amount of the personalization that makes modern fraud convincing — knowing a target's job, employer, relationships, recent activity — comes from data harvested through compromised accounts and endpoints in the first place. Hardened Endpoint & Identity Protection shrinks what attackers have to work with before a human is ever targeted, and catches a compromised credential fast enough to limit how far it travels into a scam operation's targeting pipeline.
The third level assumes the first two will, on some day, for some employee, not be enough — because eventually a fake will be good enough to get through. That's why the actual instruction to move money needs a check that doesn't depend on trusting the channel it arrived through at all. The Arup fraud succeeded because everything inside that call was internally consistent: the faces matched, the voices matched, the urgency was plausible. It only fails against a process that refuses to take any single channel's word for it, and instead confirms payee and account details through a separate, previously established line before funds move — Fraud & Payment Verification, currently in private pilot and not yet generally available, built specifically for the moment a human being, however well-trained, gets fooled anyway.
None of these three layers is sufficient alone, and that's not a gap — it's the design. AI has made each individual deception more convincing than a single layer of defense can reliably catch on its own. The $442 billion Bloomberg's reporting points to already moved last year, compounding at roughly six times the rate of ordinary fraud. The businesses that come out the other side of this won't be the ones that trusted their people to always spot the fake. They'll be the ones that never let spotting it be the only thing standing between a convincing lie and a real wire transfer.
Sources:
- AI's Supercharging a Scam Economy Bigger Than the Cocaine Trade — Bloomberg
- Scamming Becomes $422 Billion Business With AI Assistance — PYMNTS
- How AI Supercharged the Global Scam Economy — OODAloop
- AI Scam Statistics 2026 — Axis Intelligence
- Deepfake Statistics 2026: Growth, Fraud & Detection Data — StationX
- Scam center — Wikipedia
- Amid Crackdown, Few Signs of a Slowdown in Scam Compounds — Tech Policy Press
Note: the dollar figures cited above measure different things and shouldn't be summed — the $442B Global Anti-Scam Alliance figure covers all reported scam losses across 42 countries; the $88.3–114.1B UNODC figure covers Southeast Asian scam-compound losses specifically; the FBI's $893M and Vectra AI's 1,210% growth figure refer specifically to AI-flagged fraud in US complaint data.