By Ricardo Amper Founder & CEO, Incode Technologies
1. How are AI agents changing the economics of fraud?
They take the cost out of it. For most of history, fraud was a labor business. You needed people who could write a convincing message, hold a conversation, handle objections, and do it in the victim’s language. That put a ceiling on every operation: you could only run as many scams as you could staff.
AI agents remove that ceiling. A criminal group no longer hires people, it spins up digital workers. They speak every language, they never sleep, and the cost of adding one more is an API bill. The marginal cost of the next scam is close to zero.
Media Partner
And they are better at the job. AI-generated phishing converts around 4.5 times better than messages written by humans. Payments flowing to vendors that sell AI scam services have grown roughly 1,900 percent since 2021. That tells you where the money is going. Fraud has stopped being a human operation with some tools attached. It is now a machine operation with a few humans watching the dashboard.
2. Could autonomous agents make fraud attacks continuous rather than one-off?
They already do. A human fraudster runs a campaign, gets a result, and moves on. An agent does not have a campaign. It has a loop.
It researches the target, opens the conversation, and adapts to whatever comes back. If you say no, it does not get discouraged or move to an easier victim. It logs the rejection and tries something different. Every failed attempt becomes training data. The tenth version of the pitch is better than the first because the first nine taught it something.
So the attack never really ends. It runs against your customers, your employees, and your onboarding flow around the clock, and it improves while it runs. That is a different problem from the one most fraud teams were built to handle. You are not blocking an event anymore. You are defending against a process.
3. Why does agentic fraud challenge traditional identity verification?
It helps to be clear about what “traditional” means. The old model was: look at the face, look at the document, decide if it looks real. The current standard added passive liveness, which checks that there is a living person in front of the camera rather than a photo or a screen. The frontier today is multimodal. You do not just analyze the face. You analyze the camera, the device, the sensors, and the whole path the capture took to reach you, so you know nothing was injected or tampered with along the way. That is what we built Incode Deepsight to do.
Agentic fraud breaks the old model completely. An agent can manufacture a face, a voice, and a live conversation that a human reviewer will believe. “Does this look real” is no longer a useful question, because the answer is yes. It looks real. That is the point.
The second problem is bigger than most people realize. A huge share of the platforms where people get scammed have no identity verification at all. Crypto investment scams are the clearest example. An agent posing as a person opens accounts on forums, group chats, and message boards, builds a relationship, and convinces someone that a fake investment is legitimate. Nobody ever checked who was behind the account, because the platform was never designed to ask.
Compare that to opening an account at a bank running the frontier approach. Every capture is checked for liveness, the device is checked for integrity, and the entire session is analyzed for signs of a machine. The gap between those two worlds is where agentic fraud lives.
4. How can businesses tell a real person from an AI-driven attack?
Not by looking. That has to be the starting point. In our internal testing, Deepsight was about ten times more accurate than trained human reviewers at catching deepfakes. If your defense depends on a person spotting the fake, you have already lost.
The way to tell is to stop asking whether the face looks right and start asking a set of harder questions. Is there a live human in front of a real camera right now? Is the device trustworthy, or is a virtual camera feeding us a generated video? Does the behavior in the session look like a person, or like a script that has run a thousand times before? Does the pattern of this attempt match hundreds of other attempts we have seen this week?
Each of those questions is answered by a different layer. Biometrics and liveness handle the first. Device and camera integrity handle the second. Behavioral analysis handles the third. The layers together are what make the difference, because an attacker who can fake one signal usually cannot fake all of them at once, and a good system can even identify which generative model produced the fake.
And the honest answer includes one more point: you need AI to do this. The volume and speed of machine-driven attacks are beyond what any human team can review. The question is not whether to use AI in fraud defense. It is whether your AI is trained on the attacks that are actually happening.
5. Can AI agents be trusted with identity and authentication decisions?
I would split that into two questions, because they have different answers.
Can AI make identity decisions? Yes, and it already does it better than people. We built Incode on our own AI from day one, without human reviewers in the loop, and independent testing has shown it outperforms trained humans at detecting fakes. The conditions matter, though. The models have to be trained on real attacks, retrained constantly as attacks change, and validated by someone other than the vendor. Independent benchmarks and certifications exist for a reason. Ask for them.
Can an AI agent be trusted as the party being authenticated? Not by default. An agent that shows up at your API or your login page should be treated as unverified until you know three things: what it is, which human or organization it acts for, and what it is allowed to do. That is the framework we call Agentic Identity. Every agent is bound to a verified human owner through deepfake-resistant biometrics. It gets a scoped token that defines exactly what it can access, with explicit consent, expiration, and revocation built in. And its behavior is monitored continuously so that a compromised or confused agent gets caught before it does damage.
Trust an agent the way you would trust an employee: only after you know who they are, who they report to, and what their job is.
6. How should identity systems evolve for a world where humans and AI agents interact?
Most identity systems were built for one scenario: a human in a browser, verified once at signup. That world is gone. Today there are three kinds of actors showing up at your door — a human, an agent acting legitimately on a human’s behalf, and an attacker pretending to be either one. Your identity system has to handle all three.
That means a few changes. First, detection. You need to know when you are talking to an agent, across web, mobile, APIs, and machine-to-machine protocols. Agents that pass as humans undetected are the whole problem.
Second, accountability. Every agent should trace back to a verified human. When something goes wrong, and it will, there has to be a person on the other end of the chain.
Third, scope. Static credentials were designed for humans who log in and log out. Agents are ephemeral and multi-step. They need permissions that are specific, time-limited, and revocable, tied to consent that a real person actually gave.
Fourth, continuity. Verification cannot be a one-time gate at onboarding. Fraud today happens at account recovery, at high-value transactions, and inside sessions that started legitimately. Identity has to be something you check when the risk is present, not something you did once.
And finally, identity has to become shared infrastructure. Fraud rings hit many companies at once, and each company defends alone. The organizations that win will be the ones connected to a trust network that has seen the attacker before they have.
7. Will we see an AI arms race between fraudsters and fraud prevention teams?
We are in it. The numbers are not subtle. Agentic attacks went from about 3 percent of the attempts we observed in 2024 to 40 percent in early 2026. On the current trajectory, they pass 90 percent within 18 months. That is not a trend. It is a phase change.
The asymmetry is what worries me. Fraudsters deploy machines that optimize themselves. They test, learn, and redeploy in hours. Most defending organizations still update their rules quarterly and depend on humans to review the edge cases. You cannot win that race with those tools.
The only defense that keeps pace is a frontier AI model for identity that is trained continuously on new attack vectors. When a new generative model comes out and attackers adopt it within days, your detection has to adapt within days too. That is not a product feature. It is an operating model. The companies that treat identity as something you buy once and forget about are going to be the ones in the headlines.
8. What should organizations do now to prepare for agentic fraud?
Start with an honest audit. Where in your business can someone create an account, recover an account, move money, or change a critical setting without a strong identity check? Those are your open doors, and machines are already testing them. Many companies discover that some of their most sensitive flows have no identity verification at all.
Then upgrade the checks you do have. If your verification still depends on document images and face matching, it is not enough. Move to multimodal: liveness, device and camera integrity, and behavioral analysis together. And take human review out of the critical path for deepfake detection. It is slower, it is more expensive, and it is less accurate.
Extend identity past onboarding. Account recovery is the weakest point in most systems today, and attackers know it. Verify at the moments that matter, not just on day one.
Prepare for agents as legitimate users, because they are coming to your platform whether you plan for it or not. Decide now how you will detect them, how you will bind them to a real owner, and what you will let them do.
And choose partners carefully. Ask for independent validation, ask how often the models are retrained, and ask what they saw last week. In a world where attackers improve daily, the vendor’s answer to “how fast do you adapt” is the only answer that matters.
When identity can be faked, everything breaks. The good news is that the technology to hold the line exists. The organizations that move now will be fine. The ones that wait will find out how expensive waiting was.
About Ricardo Amper:
Ricardo Amper is the founder and CEO of Incode Technologies, launched in 2015 in San Francisco to transform the digital identity space. Under his leadership, Incode has developed AI- and ML-powered, privacy-centric solutions that help banks, governments, retailers, and other industries reduce fraud, increase revenue, and deliver seamless user experiences. A serial entrepreneur with over 20 years of experience, Ricardo previously founded La Burbuja Networks, co-founded Amco Foods (acquired by Grupo Bimbo), and led Grupo Amco before selling it to Brenntag. Born in Mexico and based in San Francisco, he continues to advance Incode’s vision of “One Identity Everywhere,” enabling broader access to services while empowering users to control their identity information.
