AI fraud is turning identity checks into a continuous trust test

As AI learns to imitate faces, voices, documents and ordinary behaviour, payments and identity firms are replacing one-off verification with continuous, context-aware risk assessment.

Generative AI is forcing payments and identity executives to rethink one of the sector’s oldest assumptions: that a customer can be checked once and then trusted for the rest of the interaction. In a recent PYMNTS report, leaders across payments, fraud and identity argued that the problem is no longer confined to deepfakes or synthetic identities on their own. The deeper concern is that fraudsters can now imitate faces, voices, documents, device signals and even ordinary human behaviour well enough to blur the line between legitimate and fabricated activity.

That shift is pushing the industry away from a model built on single checkpoints and towards one built on continuous judgement. Hubert Behaghel, chief technology officer at Veriff, told PYMNTS that identity systems now have to keep asking whether a user is who they claim to be, whether they can be trusted and whether they are still tied to the account in question. Matthew Pearce, vice president of fraud risk management and dispute operations at i2c, said the pressure is greatest at the moments when institutions must verify people they never meet, such as onboarding, login and call-centre contact. Elizabeth Wadsworth, vice president of decision intelligence and transformation at Velera, warned that synthetic voices can be assembled from clips scraped online, turning a simple phone interaction into a fraud risk.

What makes the threat more difficult is that AI is not only imitating identity markers, but also manufacturing what several executives called “fake normal”. Tim Joslyn, chief technology officer at Paymentology, told PYMNTS that bots can now type with human-like cadence, sustain long sessions and behave in ways that look convincingly routine. Adam Hiatt, vice president of fraud strategy at Spreedly, described the result as an arms race, while James Mirfin, senior vice president and global head of risk and security intelligence solutions at Visa, said the hardest cases are often the ones that resemble ordinary behaviour most closely. In other words, the danger is increasingly less about obvious alarm bells and more about subtle signals that once seemed reassuring.

The response, according to the executives interviewed by PYMNTS, is a layered security model that treats authentication as a stream rather than a gate. Zac Cohen, chief product officer at Trulioo, said the industry’s biggest step is moving from point-in-time verification to continuous, contextual trust. Behaghel added that firms need to instrument the full customer life cycle, pulling together thousands of signals when possible. The point, several leaders said, is not to replace one control with another, but to combine device intelligence, behavioural analytics, biometric checks, transaction context and real-time risk scoring so that confidence can rise or fall as activity unfolds.

That view is reflected in products already being marketed across the identity sector. HiTRUST says its platform brings together risk detection, decisioning, authentication and device-trust analysis in one system. Pindrop offers a real-time trust platform for voice, video and digital channels, while Mitek says its tools are designed to catch deepfakes, biometric spoofing, injection attacks and synthetic identities across the customer journey. IBM’s Verify multifactor authentication product is built around adaptive, context-aware checks, and Jumio emphasises biometric verification and liveness detection to strengthen onboarding and authentication. Twosense, meanwhile, focuses on continuous session authentication through signals such as typing rhythm, mouse movement and app use.

The final change may be the most significant. As Christine Hurtubise, vice president of artificial intelligence and machine learning at FIS, told PYMNTS, the old question of whether activity is machine-driven or human-driven is already breaking down as agents begin to mimic human actions. That raises a new policy question for merchants and financial institutions: not just who the user is, but who authorised the software agent, for what purpose and within what limits. Mirfin said merchants are already facing a world in which some automated traffic is legitimate and should be accepted. Joslyn argued that tokenisation can help by limiting what any one actor or agent can do, reducing exposure to credentials and sensitive data. In that environment, digital trust becomes less about a single yes or no answer and more about controlling permissions, scope and behaviour over time.