Australia Warns AI Will Industrialise Scams as Losses Hit $2.18 Billion

Australians reported AUD $2.18 billion in scam losses in 2025, and Australian fraud specialists and cyber security executives warn that AI-driven impersonation scams and account takeover attacks will intensify through 2027. The figure, cited by industry commentators this week, landed even as the number of scam reports fell — a combination that points to fewer, larger and more convincing fraud attempts rather than a shrinking threat.

The warning comes from three named executives: Johan Fantenberg, Director Product and Solution Marketing at Ping Identity; Tori Starkey, Director at Kudosity; and David Caspari, Managing Director and Vice President ANZ at Check Point Software Technologies. Their shared assessment is that generative AI is industrialising fraud while regulators push compliance obligations onto banks, telcos and digital platforms.

How large are Australia's scam losses?

The 2025 data sharpens the concern across the sector. Investment scams accounted for AUD $837.7 million in reported losses, while payment redirection scams accounted for AUD $166.8 million. Reported losses rose overall, yet report volumes declined — a signal that individual scams are becoming more damaging.

The payments picture is not uniformly negative. Fantenberg noted that Australian-issued card fraud fell to approximately AUD $854 million in the 2024-25 financial year, and its rate per dollar spent also declined. He expects more attempted fraud and more targeted attacks, but not a uniform rise across every metric.

That mixed picture has pushed attention toward prevention before money leaves an account.

What role does AI actually play?

The experts described a threat environment in which social engineering converges with payment fraud, account compromise and impersonation across email, text, websites and phone calls. They said generative AI is making false endorsements, voice cloning and fabricated business communications more plausible. They stopped short of claiming that every scam is AI-driven.

Caspari said scams now combine AI-generated phishing, impersonation, malicious websites, SMS and phone calls. Staff behaviour remains critical alongside technical controls, he said, particularly when messages create urgency or seek credentials or payment details through unfamiliar channels.

"Fraud will become more industrialised, more convincing and harder to detect through any single channel," said Johan Fantenberg, Director Product and Solution Marketing, Ping Identity.

Why is login security no longer enough?

Fantenberg argued that organisations need to move beyond a narrow focus on login checks. Fraud controls should assess the wider context of a customer or employee interaction, especially before funds move or account details change.

He pointed to a shift from one-off authentication to continuous assessment of identity, device, behaviour and transaction signals. The key intervention points, in his view, are:

• high-risk payments
• new payees
• supplier bank-detail updates
• account recovery
• unusual login behaviour

The most vulnerable moments remain unchanged despite the new tooling, according to all three commentators: when a customer or employee is asked to trust a message, change an account or move money.

Can verified business messaging stop impersonation?

Tori Starkey described business messaging as a front line in the fight against impersonation. AI is improving the quality of fake messages, voices and video, she said, while Australia's sender verification measures give legitimate businesses stronger ways to prove who they are.

"I expect a growing contest between increasingly convincing impersonation and stronger ways to establish who a business really is," said Tori Starkey, Director, Kudosity.

Two mechanisms anchor that contest:

• The SMS Sender ID Register, which Starkey said is making it harder to impersonate brands through text messages.
• RCS Business Messaging (rich messaging with verified business identities and branded profiles in supported messaging services), which shifts the balance away from asking customers to judge a message by its wording alone.

Why is data sharing the hard part?

Both Starkey and Fantenberg said stronger verification alone will not be enough. Useful fraud signals often sit across banks, telcos, digital platforms, identity systems, devices and customer service teams. Governance and privacy issues can slow fraud prevention efforts. When signals are fragmented, organisations may spot risk too late.

Fantenberg said businesses must:

• establish legal authority for information sharing
• set limits on what data is used
• maintain controls over access, security and retention

He also said automated decisions need clear ownership, monitoring and a path to human review.

Starkey raised parallel concerns in the messaging environment. Organisations need clear ownership of messaging accounts, agency authorisations, APIs and employee access, she said. Companies introducing richer messaging and AI tools should also understand how providers process message content, who can access it and how long information is retained.

What does the Scams Prevention Framework change?

Pressure on governance is rising as scams policy moves into operational practice. The commentators pointed to the Scams Prevention Framework as a major compliance driver for banks, telecommunications providers and digital platforms. Readiness, they said, is becoming a board-level issue rather than a narrow technology task.

That regulatory stakes matter beyond Australia's borders: the framework obliges the three industries most abused by impersonation fraud to demonstrably prevent scams, and similar liability regimes are spreading through other jurisdictions watching Australia's implementation.

What should businesses measure now?

Prevention before money leaves an account is the practical takeaway from the commentators. Businesses should:

• strengthen account recovery processes
• secure privileged access
• independently verify bank-detail changes and payment requests
• measure outcomes such as prevented losses, intervention times, false positives and repeat victimisation

For all three executives, the common message is that fraud defence now depends on identity assurance, channel trust, rapid verification and human oversight. Attack methods are changing quickly; the exploitable moments are not.

The forward question for 2027 is whether verification infrastructure — sender registries, verified business messaging and cross-industry signal sharing — can scale faster than AI-assisted impersonation industrialises. The AUD $2.18 billion in 2025 losses is the baseline against which that contest will be judged.