Investigating AI-Driven Fraud Synthetic Identities, 27 January 2027

Current Threat Picture for 2027

 

Our workshop provides an overview of the current threat picture of AI-Driven Identity Fraud as it is a rapidly evolving landscape that is providing new and complex challenges to investigators.

​

It is rapidly changing both the scale and sophistication of financial crime. Fraudsters can now combine stolen personal information, synthetic identities, AI-generated documents, deepfake video and voice, automated social engineering and increasingly sophisticated digital manipulation techniques.

​

For investigators, the challenge is no longer simply identifying a forged document or an inconsistent customer profile. Modern AI-enabled fraud requires investigators to correlate multiple weak signals across identity data, digital footprints, behavioural patterns, devices, transactions and open-source information.

​

Our workshop provides investigators and fraud professionals with a practical framework to understand, detect, investigate and respond to AI-driven identity fraud.

​

It combines emerging fraud typologies, investigative methodologies, OSINT techniques, identity verification approaches and practical case-based exercises.

 

Session One

The New AI-Driven Fraud Landscape

The opening session introduces how Artificial Intelligence is transforming traditional fraud schemes and creating new investigative challenges.

​

We will explore how generative AI, deepfakes, automation and increasingly accessible AI tools are reducing the cost and complexity of producing convincing fraudulent identities and communications.

​

Topics include:

• how generative AI is changing the economics and scalability of fraud;

• the evolution from traditional identity theft to synthetic and hybrid identities;

• AI-generated documents, photographs, profiles and supporting evidence;

• deepfake video and voice impersonation;

• AI-assisted social engineering and highly personalised fraud attempts;

• Business Email Compromise and executive impersonation enhanced by AI;

• automated creation and management of multiple fraudulent personas;

• Fraud-as-a-Service and the industrialisation of AI-enabled fraud;

• the convergence between identity fraud, account takeover, mule networks and financial crime;

• emerging risks associated with increasingly autonomous AI agents.

 

The session also introduces the concept of the AI-enabled fraud lifecycle, showing how criminal actors may move from data collection and identity construction to testing, exploitation and monetisation.

​

Key Investigative Question

Participants are encouraged to move beyond the question:

“Is this document or identity genuine?”

and instead ask:

“Does the complete digital identity make sense when all available information is considered together?”

 

Session Two

Anatomy of AI-Driven Fraud Schemes

This session examines how AI-enabled identity fraud operates in practice.

​

We will reconstruct the lifecycle of synthetic and hybrid identities, understanding how fraudulent identities may be developed gradually before being used against financial institutions and digital platforms.

​

Topics include:

• how synthetic identities are assembled using combinations of genuine and fabricated information;

• hybrid identities combining stolen personal information with AI-generated elements;

• how fraudulent identities may be matured over time to develop credible digital histories;

• use of AI-generated photographs, documents and supporting information;

• deepfake video and voice during remote onboarding and authentication;

• manipulation of liveness-verification processes;

• the distinction between presentation attacks and digital injection attacks;

• automation and bots used to test onboarding and verification controls;

• repeated use of identities across financial institutions, fintechs and other platforms;

• exploitation of weak or fragmented KYC environments.

 

The session also examines common criminal monetisation models, including:

• consumer and business loan fraud;

• Buy Now Pay Later exploitation;

• payment fraud;

• account takeover;

• fraudulent business accounts;

• mule recruitment and mule-account networks;

• telecom and SIM-related identity fraud;

• layering of fraudulent identities across multiple financial products.

 

Applied Exercise – Mapping the Fraud Lifecycle

We will analyse simulated AI-enabled fraud scenario and reconstruct the sequence from identity creation to financial exploitation.

 

They identify:

• information used to construct the identity;

• verification controls targeted by the fraudster;

• indicators that could have revealed the fraud earlier;

• the point at which the identity became operational;

• potential links with other accounts or identities.

 

Session Three

Detection, Verification and Digital Investigation

Detecting sophisticated AI-driven fraud requires investigators to combine multiple sources of evidence rather than relying on a single verification technology.

​

This session introduces a structured investigative methodology for assessing potentially synthetic or manipulated identities.

​

Topics include:

Identity Consistency Analysis

• analysing names, dates of birth, addresses and contact information;

• identifying inconsistencies across multiple identity attributes;

• assessing chronological plausibility;

• comparing identity information across different platforms;

• identifying unusual changes in identity information.

 

Document and Metadata Analysis

• detecting inconsistencies in digital documents;

• examining metadata and document-creation information;

• identifying anomalies in timestamps and file histories;

• recognising indicators of AI-generated or manipulated documentation.

 

Digital Footprint Analysis

• validating identity claims through open-source information;

• analysing social-media presence and account history;

• reverse-image searching;

• facial-search techniques where legally and operationally appropriate;

• validating employment, education and corporate affiliations;

• identifying duplicated or recycled identity elements.

 

Deepfake and Synthetic Media Assessment

• common indicators associated with manipulated video and audio;

• understanding the limitations of automated deepfake-detection tools;

• detecting inconsistencies between biometric evidence and the wider identity profile;

• distinguishing manipulated media from genuine but unusual digital evidence.

 

Behavioural and Technical Indicators

• device and session anomalies;

• velocity and repeated onboarding attempts;

• unusual behavioural patterns;

• links between multiple identities, devices, addresses and accounts;

• detecting patterns that may indicate coordinated fraud operations.

 

Participants learn to adopt a multi-layered verification model, combining:

Identity + Documents + Biometrics + Behaviour + Devices + Digital Footprint + Transactions rather than treating individual verification results in isolation.

​

Applied Exercise – Synthetic Identity Investigation

Participants receive an investigative package containing identity information, documents, photographs, online traces and behavioural indicators.

​

They must determine whether the subject is:

• a genuine identity;

• a manipulated genuine identity;

• a hybrid identity; or

• a fully synthetic identity.

 

Participants must support their conclusion using evidence rather than intuition.

 

Session Four

Operational Response, Investigation and Emerging Threats

The final session focuses on how organisations should investigate and respond when AI-enabled fraud is suspected.

 

We will examine how fraud indicators should be transformed into investigative hypotheses and operational decisions.

​

Topics include:

Investigating Suspicious Identity Activity

• analysing failed or suspicious KYC attempts;

• reconstructing onboarding activity;

• identifying document inconsistencies;

• investigating unusual behavioural patterns;

• analysing relationships between identities, devices, accounts and transactions;

• identifying repeated indicators across multiple customers.

 

From Individual Fraud to Fraud Networks

We will look at apparently isolated fraud attempts may reveal wider organised activity.

This includes:

• identifying shared devices and infrastructure;

• linking repeated identity attributes;

• identifying common payment destinations;

• analysing mule-account relationships;

• recognising recurring behavioural patterns;

• developing network-based investigative hypotheses.

 

Continuous Identity Assurance

The session introduces the concept that identity verification should not necessarily end when the customer successfully completes onboarding.

​

Participants explore how organisations can move from:

One-Time KYC to:

​

Continuous Identity Assurance by assessing significant changes during the customer lifecycle, including:

• device changes;

• unusual account recovery;

• changes to contact information;

• behavioural anomalies;

• unusual transaction activity;

• new biometric interactions;

• emerging links with known fraudulent accounts.

 

AI Agents and Automated Fraud

A dedicated emerging-threat section examines how increasingly autonomous AI tools could change fraud operations.

​

The focus is not on cybersecurity techniques, but on the investigative implications of AI systems capable of assisting criminals with:

• automated research on potential victims;

• creation of personalised social-engineering content;

• management of multiple digital personas;

• automated interaction with online platforms;

• adaptation of fraudulent narratives;

• generation of supporting documentation;

• repeated testing of controls.

 

Participants consider how automation may change the speed, scale and digital footprint of financial crime.

​

Investigation, Escalation and Reporting

The session concludes by examining:

• coordination between Fraud, AML, KYC and Compliance teams;

• escalation criteria;

• documenting investigative hypotheses;

• distinguishing facts, indicators and assumptions;

• assessing evidential confidence;

• identifying potential mule activity or money-laundering indicators;

• developing proportionate investigative conclusions and recommendations.

 

Final Practical Challenge

AI-Driven Fraud Investigation

The workshop concludes with an evolving investigative case.

​

Participants receive multiple pieces of information progressively during the exercise, including:

• identity documents;

• photographs;

• digital profiles;

• onboarding information;

• transaction data;

• device information;

• communications;

• OSINT findings.

 

Participants must:

1. reconstruct the suspected fraud methodology;

2. identify manipulated or inconsistent evidence;

3. distinguish genuine information from AI-generated or altered information;

4. correlate identities, accounts, devices and transactions;

5. develop alternative investigative hypotheses;

6. determine which hypotheses are supported by the available evidence;

7. identify potential links with wider fraud or mule networks;

8. recommend additional investigative steps;

9. determine appropriate escalation actions; and

10. present an evidence-based investigative conclusion.

 

The exercise concludes with a structured debrief comparing investigative approaches and identifying the indicators that were most useful in resolving the case.

 

Learning Outcomes

By the end of the programme, delegates will be able to:

• understand how AI is transforming identity fraud and financial crime;

• recognise synthetic, hybrid and AI-manipulated identities;

• understand how deepfakes and synthetic media can affect onboarding and authentication;

• identify indicators of digital injection and liveness manipulation;

• apply OSINT techniques to validate identity claims;

• correlate identity, behavioural, device and transactional indicators;

• distinguish isolated fraud attempts from potentially coordinated fraud activity;

• develop evidence-based investigative hypotheses;

• understand the emerging implications of AI agents and automated fraud;

• strengthen investigative escalation and response processes.

 

Held online via Teams

Certificates of CPD available.

​

HOW TO BOOK

Cost: £219 + VAT (GBP) per delegate per workshop (LEA and Government Agency rate).  £275 + VAT (Industry rate), per delegate 

​

Group bookings: We offer various discounts for group bookings depending on numbers, please contact us for details.

​​​

Booking: Please send the delegates name(s), email address(es) and purchase order (made out to The Investigator) to booking@the-investigator.co.uk or telephone +44(0)844 660 8707 for further information. 

​

Payment can be made by PayPal/debit/credit card. ​The meeting link will be sent out 7 days before the event.

​

​