39 min
Fraudology
Fraud News: AI Document Fraud, Zombie Credit Cards, and a Digital Arrest Scam
51 min
Welcome back to Fraudology.
Since I’ve been back from SardineCon, I’ve thought about how much faster and cheaper AI is making fraud. That thread runs through basically everything I’m covering today. I’m digging into a new report from Inscribe showing a 4X increase in AI generated documents. I’ll walk through the difference between a document that’s built entirely by AI and one that’s a real document with AI alterations. Because they are not the same problem.
Then we will go deep on a digital arrest scam, and this is the one I really want you to sit with. Frank McKenna has been predicting digital arrests would hit the US for almost a year. I found a first person account from a woman who got a call claiming to be from her local sheriff’s department. What happened to her over the next several hours is genuinely hard to listen to. I think this is one every fraud fighter needs to be able to explain to the people in their own life who aren’t in this industry.
Along the way, I’m covering a case out of Spain where a man was arrested for using deepfakes to get past identify verification checks, a new report on Grok deepfakes, and a study out of UMass on zombie credit cards. Which is a real NFC fraud loophole. It’s a lot but stick with me.
What you’ll hear:
- A quick recap of SardineCon 2026 and why AI was the theme of nearly every conversation I had there
- Inscribe's new fraud report showing a 4X increase in AI generated documents, and why bank statement fraud, fake invoices, and fake pay stubs make up more than half of what they're catching
- The difference between AI generated documents and AI altered ones, and why the altered ones are actually harder to catch
- How synthetic identity fraud and first party fraud both show up in lending fraud, even when the person applying is real
- A case out of Spain where deepfakes almost got a man through identity verification, until a one second glitch gave him away
- A new report on Grok deepfakes and what it means that one platform is tied to the majority of tracked incidents
- A UMass study on zombie credit cards and the NFC fraud loophole that can bring expired cards back to life
- The full, first person story of a digital arrest scam, including the jury duty scam call, someone impersonating law enforcement, a bond scam demand, and a PayPal fraud payment that couldn't be undone
You should listen to this episode if you:
- Want to understand what a digital arrest scam actually sounds like from the inside
- Are in lending, underwriting, or KYC and need to know how bank statement fraud and fake pay stubs are evolving
- Want to know the real difference between synthetic identity fraud and first party fraud
- Have family members who don’t work in fraud and need a real example to help them recognize a jury duty scam or someone impersonating law enforcement
- Are tracking deepfakes and want to know where Grok deepfakes fit into the bigger picture
- Process card not present or in person transactions and haven't heard about the zombie credit card loophole yet
Episode notes
AI document fraud is up 4X, and it’s not slowing down
Inscribe's latest fraud report tracks a full year of data, not just a few months, and the number that stuck with me is the 4X increase in AI generated documents across their network. I break down why bank statement fraud, fake invoices, and fake pay stubs make up more than half of everything they're flagging, and why that concentration makes sense once you think about what those documents unlock for a fraudster.
- your team hasn't looked at how synthetic identity fraud and first party fraud both intersect with lending fraud, this is the report that makes the case.
- AI altered documents, not just AI generated ones, are the harder problem. A real document with a manipulated balance is much easier to miss.
- Don't wait until you see an AI flag in your own queue to take this seriously. The barrier to submitting a fraudulent document is lower than it's ever been.
A digital arrest scam finally happened here
Frank predicted this almost a year ago, and I genuinely didn't think it would work in the US. I was wrong. I'm reading a full first person account of a jury duty scam call where someone spent hours impersonating law enforcement, walked the victim through a bond scam demand, and ended with a PayPal fraud payment that couldn't be reversed.
- Law enforcement will never call you, never ask you to stay on the phone, and never ask for payment through PayPal, gift cards, Venmo, or Zelle.
- This is not a fraud industry problem you can solve on your own. Share this story with the people in your life who aren't in this space, because awareness doesn't happen by osmosis.
- The scam worked because it created urgency and isolation at the same time. That combination is the pattern to watch for, regardless of the specific script.
Deepfakes, Grok, and a one second glitch
A man in Spain was arrested after using real time deepfakes to impersonate more than 30 identities during video verification calls, and he only got caught because of a one second delay in his software. I also cover a new report tying the majority of tracked deepfake incidents to Grok deepfakes specifically.
- Real time deepfakes are no longer theoretical. This case shows they're already being used against live video verification.
- If your identity verification process relies on video calls, a one second delay glitch is not something you should count on catching the next fraudster.
- Know which AI tools in your space have active trust and safety teams working on fraud, and which one this report suggests may not.
Zombie credit cards and the NFC fraud loophole
A UMass study found that expired credit cards can sometimes be reactivated through a flaw in contactless payment systems. This is an NFC fraud issue, not a card present or card not present issue, so it's easy to miss if you're not looking in the right place.
- This affects in person, contactless transactions specifically. Card not present teams aren't the ones who need to act on this.
- Destroying the magnetic strip and chip on expired cards matters more than most consumers realize.
- Even after a card is closed, monitor the account. The underlying account can still be reactivated even when the physical card can't.
Key takeaways
- AI generated document fraud is up 4X, and bank statement fraud, fake invoices, and fake pay stubs make up more than half of it
- Synthetic identity fraud and first party fraud both hide inside lending fraud, even when the applicant is a real person
- A digital arrest scam just happened in the US, built on a jury duty scam, someone impersonating law enforcement, a bond scam, and a PayPal fraud payment
- Real time deepfakes, including Grok deepfakes, are already being used to defeat identity verification, not just theorized about
- Zombie credit cards are a real NFC fraud loophole, and it's specifically an in person, contactless problem
Final takeaway
Everything in this episode comes back to the same thing. Fraudsters are using AI to make their attacks faster and cheaper. Our job is to make fraud slower and more expensive so they go somewhere else. That’s the whole game right now.
Whether it’s a fake bank statement, a deepfake on a video call, or a scared woman o the phone with someone pretending to be the sheriff, the pattern is the same. They’re betting on speed, and we win by slowing them down.
Episode resources & links
Connect with Karisse Hendrick | LinkedIn
Host of the Fraudology Podcast
Award-Winning Cyberfraud Expert
Ecommerce Fraud Prevention Consultant
Startup Advisor, Keynote Speaker, and
Consultant to Fortune 500 merchants
Episode transcript
Karisse Hendrick
00:07
Welcome to the Fraudology podcast. I'm Karisse Hendrick. And we are doing another solo episode today. I am still getting used to talking to myself face to face with myself for YouTube. Um, but I have heard that you guys really like it. So, I'm glad for that. I am just much more comfortable when having a guest, but I know that if I got rid of fraud news episodes, some people would be really disappointed. So, uh, today is going to be a fraud news episode. I haven't done that in a while. Because my last, uh, solo episode was covering the, uh, you know, why cyber security and fraud should work together, uh, study by Accertify and Luminal. If you haven't checked that out, it's really interesting. Uh especially, and then they did additional studies breaking down retail and QSRs and you know entertainment and travel and two other verticals that I'm not thinking of off the top of my head. So, but today we're going to have a fraud news article, or fraud news episode. Today we're going to have a fraud news episode. And first I was just going to talk a little bit about my week. It's been really busy. I continue to be working hard on the con educational content for the Merchant Fraud Alliance, which is in less than six weeks. So, if you haven't gotten your ticket yet, please do. I don't want anyone to have FOMO that week. It's going to be so much fun. It's in Chicago October 6th and 7th. Incredible merchants are coming. Uh we aren't selling vendor tickets uh to be able to control the ratio. We wanted to have more merchants than vendors in the room. And that is what we're doing. So, uh that working hard on that has been number one priority. But on Wednesday I actually, well Tuesday, I flew down. But Wednesday I attended the uh SardineCon in San Francisco. I went last year and I have to say it was more than double the people that were there this year to last year. Uh it was in a new venue so it could hold more people. Uh they actually had over 500 people register. I don't know exactly how many attended but it was a lot. Got to see some familiar faces like Hailey Windham and the team that I work with at Sardine uh for the sponsorship of the podcast. Uh, who I just really enjoy working with. Uh, got to see Dave G who was just on the podcast. Uh, we had a good conversation. Uh, got to see a few other faces and then meet some new people. Uh, and that was really fun. And there was a lot of really good content. I think the highlight for me, uh, was Joseph Cox, the founder of 404 media. If you don't read 404 media, I highly suggest it, especially if you're interested in fraud fighting. Uh, they cover a lot of scams and you know fraud related news. They, the team that writes for them came from Wired and Vice. So they have that style of journalism. Uh, it's an independent journalism website. I subscribed to them. I read them. So it was great to see him on stage as the keynote. He talked a lot about. So the whole theme of the day, last year the theme was the scandmic. And talking all about scams and fighting scams. And while scams are still happening, this year the theme was agentic, the agentic frontier. It made me think of Star Trek or something. So, Joseph Cox talked a lot about like the evolution of AI and deep fakes. And how, you know, just a few years ago it was face swap technology and, you know, uploading a picture from Google images or something like that. And then it's just it's continued. And he talked about how now they are very very close, if not already there, especially in Southeast Asia where they're getting very good at real time AI deep fakes. And where I would have a conversation with you, but yet you would see a completely different person. Um, I might have Frank McKenna come on soon and play around with that now that we have YouTube. Cuz he's done that to me before when we've been recording without YouTube, and that was just weird. Um, but he could play around with it. Um, but it used to be kind of like this, you know, you'd have to upload a picture and you'd have to wait a little bit and you'd, you know, record it and then play it. Well, now it's real time. In real time you can switch faces or you can switch the shirt that they're wearing or you can you know do crazy things. So, uh, that was a great uh presentation and then uh Soups Ranjan who's the CEO of Sardine, uh, talked about using AI to fight fraud. That's something that Sardine has really doubled down on in the last year and that is fraud fighting agents. They have agents that investigate, agents that propose rules, others that will like run on a schedule.
Karisse Hendrick
05:29
They also say though that a human needs to be in the loop to be able to, you know, decide when to fire those, when to activate them, when they're needed. So um it was great you know hearing what, so first we heard what the fraudsters were doing with AI. And then we heard what, you know, some at least one fraud technology company is doing to fight those fraudsters and identify those fraudsters. So that was a great balance. There were a couple of panels after that. I was asked to host a round table. Uh, and that round table was on agentic commerce. There were some interesting conversations, uh, had about it. I mean, I think that the really at the end of the day, and we've talked about this before on the podcast, there are some hurdles that need to be overcome in order to use agents to complete a purchase online. And that is, uh, and where it kind of gets fuzzy. And where, uh, our the challenges are is on the um authorization piece. Um, authorizing the payment method, using an agent, and then also the dispute piece, right? I've been pretty vocal about that. There was someone at, um, my round table that was from MasterCard. And he was familiar with the things that I've said on LinkedIn. Uh, about how the liability piece needs to be looked at again. Because if an agentic platform is responsible for someone getting the wrong thing, right? Like I ordered a pair of size, you know, 11 women's shoes and I really got size nine shoes or, you know, I ordered four and I got and I accidentally paid for 40. Like I wanted four of something but I accidentally paid for 40. Like whatever those errors are that can happen quite often with technology and AI, especially in the beginning. Currently, right now, it's a card not present transaction. Kind of goes to the merchant. And there's nothing written in Visa or MasterCard's dispute rules that say: Here's how a merchant can fight that chargeback. Here's how they can get their money back. So, right now, it automatically goes to the merchant and it's an automatic loss. And several merchants are seeing those already and they're pretty high ticket. So, that's really the two places that we identified need the most work. They didn't agree with Dave G's assessment that people want to shop for things, that retail therapy is a thing, that that the thrill of the hunt for the good deal or the collectible or the great trip that you want to take. Uh, that that humans will still want to do that. Uh, there were several people at the table that thought that won't be the case. That people will want to have an agent do their shopping for them, especially if it's like for something like concert tickets for example. And that makes a little bit of sense. You can set it for the time that you know the tickets are released for the on sale. And you know you can set exact parameters as to where you want to sit and how much you want to spend and all of that. So, you know, maybe for that, but um Dave's whole milk, bread, and eggs theory, uh was kind of thrown out the window. As was his, um I wish he was at the table, actually. But he was somewhere else cuz I think that would have made a really good conversation.
Karisse Hendrick
08:53
But I kind of, you know, when times would get quiet at the round table, I would throw out a question. And so I would say like I had someone on my podcast recently that said that they think that you know now because of stablecoin and agent agents that micro payments are going to be a thing. And the guy from MasterCard just laughed and said if we could have figured out micro payments we would have. Um, he said eventually that chain is going to get so long or the ledger is going to get so long on those you know bitcoins on on the blockchain that there there's going to be a price to process those transactions as well. So uh, I hadn't thought of that before. But he said you know we tried to do it at low cost we couldn't. So I don't think blockchain can or you know bitcoin can either or stable coin either can either. Of course he's going to say that he works for MasterCard, but I thought that was, you know, an interesting counterpoint to things that Dave uh mentioned a couple weeks ago on the podcast. You know, that's really highlights from SardineCon. Hailey did several uh interviews. As well as she recorded an a session that she moderated. And so if you want to check that out, you can go to fraud the Fraud Forward podcast. If you're interested in uh seeing those interviews, I'm included in that. That will be on her YouTube probably this week, I think, maybe next week at the latest. And then or you can just listen to them on on your favorite podcast app, however you prefer to consume our podcasts. But uh if you want to see more from SardineCon, I recommend going to Fraud Forward. So, speaking of fraudsters using AI to commit fraud, a lot of the stories, I would say about half of the new stories that I pulled for this week are around fraudsters using AI and deep fakes as well. I really have to say that my conversation with Cy Khormaee last week was really interesting to me. Because I hadn't really thought about all the research that a fraudster has to do if they want to do a really good spear fishing campaign. Whether that's for business email compromise or for you know any other kind of fraud where they they know all about you. And you know just how time intensive that was even a year ago. And now you can just ask ChatGPT or Claude for all the information they have on a specific person. And the conferences they speak at and the professions of their parents and where their kids go to school. I mean, you can probably pick up a lot of that just through open- source information. And that just kind of stuck with me. I hadn't thought about that aspect of it.
Karisse Hendrick
11:50
Um, and as I've read through some of these news articles I'm going to talk about, I've kind of combined that knowledge with what the news articles talking about. And I'm like, okay, this is definitely leveling them up. Because their goal is always to make fraud faster and cheaper. And our goal is always to make it slower and more expensive, so they go somewhere else. That's really the crux of the cat and mouse game in fraud, right? So, um if they're able to do this faster and cheaper, then they can hit more victims. Uh, make more money, and that's not what we want. So, just kind of keep that in mind as as we talk about these other things. Um like I said, most of them are going to be about deep fakes and AI. Um, I am going to talk about zombie credit cards. Uh, there was a study that came out in Massachusetts. I think it was UMass this week. Uh, where they were able to use expired uh, and cancelled cards to um, make purchases. Which is kind of scary. Um, there's a specific way they were able to do it. And now that it's published, fraudsters can do it. If they hadn't thought of it before, they know about it now. So, um I'll definitely be talking about that as well as I will end with a digital arrest story in the US. If you read or listened to one of our web webinars uh or the podcast episode uh with Frank McKenna and Maryanne Miller and Matt Vega and myself this year uh we every year at the beginning of the year we do fraud predictions. Frank has been talking about digital arrests coming to the US for at least eight or nine months. They were a big thing in India and I was like I don't think that's gonna really hit in the US. Because I don't think that a victim would stay on the phone with someone for hours or days. Um, but it's happening. And Frank found a first person account of exactly what happened to them. And so I'm going to read through that at the end of the episode. So that just gives you a little idea. I hope that you don't skip ahead, but uh if you want to skip ahead to learn about zombie credit cards or, you know, the digital arrest story, you certainly can.
Karisse Hendrick
14:28
Oh, I should show off my new water bottle. I think it's backwards. But it um it says Sardine. Uh they were giving them out at SardineCon. And that worked out perfectly because the hydro flask I've had for several years and cleaned out religiously, don't worry. It had all these fraud stickers on it and it was kind of like my, you know, thing. I carried it around the house. I carry it on conferences and trips. It's been a lot of places. I finally left it in an Uber from the hotel to the or from the airport to the hotel in San Francisco this week. So, I was very grateful that the next day Hailey handed me a new um Sardine Owala. So, uh I really like it. I miss my Hydro Flask. RIP, but uh am grateful to have another one that I didn't have to research or buy. Um, I guess I wouldn't have to research it if I used ChatGPT as well. And like told them what I like in a water bottle. But I don't see myself doing that anytime soon. Um, okay. So, the first news story today is that Inscribe's latest um I'm going to talk about Inscribe's latest news. That they saw a 4x increase in AI flag documents. So, fake documents using AI. Uh just in the last few months. I thought that this was an interesting blog article because it's written by one of their risk analysts. And I've advised several startups. Like early stage startups or you know after their you know series A round. Maybe up to that point on go to market strategy and understanding their customers and the market and that type of thing. And one of the things I've advised is let your fraud people speak. Let your product people speak. Let your risk analysts speak. Let them share their story because that's who your prospects are going to connect with. And if they feel like you have really smart risk people, they're going to trust your company more with their data. And I think it's smart that Inscribe asked uh this risk analyst. And I should give her credit. I hope it says it at the top. Yeah, Jessica Lara. She is a risk operations analyst at Inscribe. So, she starts out this article saying: My job is to look at documents that may not be what they claim to be. Every day I review documents flagged across Inscrib's network, bank statements, paystubs, invoices, tax forms. My work is pattern recognition at the document level. When I started at Inscribe, the patterns were mostly about templates.
Karisse Hendrick
17:20
The same formatting artifacts appearing across dozens of submissions, the same layout quirks. You learn to recognize a template the way you learn to recognize a handwriting style. Then in 2025, a new signal appeared. AI generated documents. And the patterns changed. I pulled our midyear data in June of 2026. And here is what I found. Our a our AI generated detector launched mid last year and we've been tracking AI document fraud trends since. From June of 2025 to May of 2026 inscribes. Okay, so it wasn't just a few months, it it was a year. Inscribes network saw a 4x increase in the monthly volume of AI flag documents. The most recent months are the highest we have recorded. The chart below shows the full trajectory. Um, I'm still figuring out how to share things on YouTube, so I'm not going to do that. But it's basically just picture, well, I'll go like this. A graph going like it's basically a hockey stick. With a couple of ups and downs. Uh, but it just it goes from, you know, just a little bit to a lot. Uh it doesn't have a volume amount. So it doesn't say like you know a million or two million or whatever. But it just so charts on the graph. Um and in the fourth quarter of them measuring this. Uh it went up over the .1% threshold. So 10 bips if I'm doing that right. I think that's right. 10 bips after bips. I'm so bad at bips. Sorry. Um but 0.1%. So they're over .1% of the volume that they're seeing. Which is you know a significant amount. The shape of the curve matters as much as the volume. A spike is often a single fraud ring or data artifact. So that's why there's some ups and then some downs, but the ups are really high. This is a sustained climb, meaning the underlying behavior is spreading across more actors, more institutions, and more document types.
Karisse Hendrick
19:35
Bank statements account for roughly one in four documents we flag as AI generated. Invoices and pay slips follow at similar rates. Together these three documents account for more than half of all AI generated flags across our network. That makes sense. Bank statements, invoices, and pay slips. The next is business filing, utility bill, driver's license, bank letter, financial statement, and a lease record. Um in that order. But definitely bank statement, invoice, and payslip makes up for around half of all of the AI generated incidents that they have. Uh with documents. So that concentration makes sense when you consider what these documents unlock. A convincing bank statement opens the door to high value high value credit approvals, business financing, mortgage decisions, fraudsters target the documents that matter most to underwriters. Because those are the ones worth faking. A year ago, I could tell within seconds. The formatting was Excelike. Perfect table alignment, rounded transaction amounts, pays labeled grocery store instead of an actual merchant name. Real bank statements are messier. Real transactions say Walmart and Shell and have amounts like $47.13. The documents I'm reviewing now require real scrutiny. Some require a second review, a cross check against institutional patterns, or a direct conversation with a customer. The AI tooling used to generate them has improved significantly over the past 18 months. I'm sure that doesn't surprise anyone, but whatever is worth sharing. Not all AI documents are made by LLMs. There are two categories of AI document fraud. We can and we can detect both. The first are documents generated entirely by AI. Built from scratch using a tool, a template prompt, a template prompt or a purpose-built fraud service. This is what this data reflects. The second are real documents with AI altered fields. A genuine bank state, a bank statement with a balance change. A real pay sub with inflated income. The document structure is correct because it started from a real document. The alterations are targeted and precise. So almost like using Photoshop, but AI makes it look even more realistic. The documents that concern me most are the legitimate ones altered using AI. I would have guessed that. Everything looks correct and expected, but most of it isn't. In my experience, this category is consistently harder to catch. So what's changed since 2025? The 2026 state of document fraud report captured data. That that's a doc a report that was created by Inscribe. Uh captured data through December of 2025. And a few things have shift shifted since publication. The growth has continued. The months since January have tracked higher than the same months a year prior. The trend hasn't flattened and template fraud is still here. AI generated fraud gets the attention, but template-based fraud still runs at a rate two to 3x higher consistently. I watch both signals every day.
Karisse Hendrick
23:06
Sophisticated actors use both factors, often in the same fraud wave. The full picture requires tracking the full spectrum. So, what's next for AI document fraud? If current 2026 trends continue, AI generated document fraud will track higher through the rest of the year and into 2027. The projection chart below shows two scenarios. Conservative and moderate lines point the same direction. The pace differs, but the trend does not. So again, there's not any volume numbers uh on the y axis. Uh but it does show you know consistent growth going up. Um whether it's you know a conservative or moderate um projection. What I watch more than value is the capability curve. Open-source models and purpose-built tools like fraud GPT operate without guard rails. The same improvements making commercial AI better at generating realistic documents are making their open-source counterpart arts better too. The barrier to use these tools is near zero. On the detection side, the work is getting better. Cross institution intelligence helps. Pattern matching across submissions and institutions helps. Every detector update that forces fraudsters to change their approach is evidence the system is working. I would imagine, I think when she's talking about cross institution intelligence, I think one of the things she's talking about is because they look at real documents every day. They can go back and look at well what does a real bank statement from bank A look like. Uh and pull several and then compare them to the one in question. Um, that's what I would do if I were manually looking at these. The advice I would give to any fraud team is do not wait to see an AI flag in your own queue before taking this seriously. The barrier to submitting a fraudulent document is at an all-time low. The customer who committed fraud today may look identical to the customer you have trusted for years. Both scenarios point the same direction. Continued growth with AI generated fraud likely reaching volume range comparable to template fraud by the end of 2026 under the conservative model. I was going to say that, you know, the thing about document fraud and lending fraud or, you know, credit card fraud. Like, you know, credit card for issuers, credit card fraud, you know, credit limits, that type of thing, is that they're not just being done by actual fraudsters, right?
Karisse Hendrick
25:52
They're not always synthetic identities or made up identities. Sometimes they're real people that are committing first-party fraud. Or maybe they don't realize they are. If they inflate their income a little bit. Um, they should know that that's wrong, but they may not recognize it as fraud. But that's something you have to take into account with document fraud is that it could be a person who is who they say they are. And you know everything looks right. But they took their bank statement used AI and made it look like they have more money in their bank account. Or you know have a better credit score. Well I guess they'd pull credit. But you know that type of thing. Or uh make more money on their paystub or that type of thing. So that they can get more funds loan to them. So, I thought that was really interesting and a well done article. And, you know, even if a company is not the sponsor of my podcast, if they make good content that I think would be relevant to my listeners, I'll share it. Um, that is not an open call for every single blog post that every vendor uses or, you know, posts. But, um, you know, it's obviously at my discretion. I don't always think that everything that is uh published by solution providers is helpful. Uh, but I thought that was really informative. So um, wanted to share that. The next story comes out of Spain. And the title of the article is The AI That He Used to Alter His Face and Video Calls Betrayed Him After a One-Second Delay. And then the sub headline says: The police arrest a man who used deep fakes to impersonate identities in video calls. The fraud with 38 attempts was uncovered when a delay in the software revealed his real face. So sometimes a glitch is a good thing. Maybe it was a feature, not a bug. I don't know. Um but if but I thought that this was interesting. So, it just says um, the National Police have arrested a man accused of using artificial intelligence to alter his face in real time, during verification video calls, and impersonate the holders of falsified ID cards. The glitch that uncovered the fraud was minimal and decisive. A one-second delay in the facial modification program left the suspect's real face visible when he was trying to pass the check of a company responsible for issuing electronic certificates. And thus obtain authorized digital signatures. So the suspect attempted 38 impersonations with more than 30 identities. The investigation attributes 38 impersonation attempts on more than 30 real identities to the to the detainee. His objective was to pass the video identification processes of an electronic certificate issuing company.
Karisse Hendrick
28:53
To do this, he combined falsified ID cards with multiple manipulated photographs and deep fake tools capable of changing his face during the video call. Furthermore, he used domestic spotlights to reproduce the reflections of the documents security holograms. This detail aimed to give an appearance of authenticity to documents that were manipulated upon verification. And probably manipulated via AI like the last article we read. In similar identity fraud cases, fake job offers and campaigns using real personal data to open new avenues for impersonation have also appeared. The police linked 320 lines to, I think credit lines, to 24 mobile phones contracted with impersonated identities. So, the investigations made it possible to identify more than 320 telephone lines associated with 24 mobile devices. So, that's about like 15 a piece or something like that. Most of these lines had been contracted and impersonated identities at different points of sale. And the agents later seized an encrypted laptop, numerous mobile phones, storage devices, and documentation related to the uh investigated activity. The detainee is accused of a continuous offense of document forgery in official document. Interpol has already warned that artificial intelligence facilitates the combination of voice cloning via video deep fakes and synthetic identities to open new modalities of fraud and identity theft. One out of every three online financial scams detected in Catalonia is based precisely on identity theft. And then it just notes that in 2025, investigators linked a North Korean group to campaigns that used AI generated video and audio to impersonate executives during Zoom calls and install malicious software. Can you imagine if you get on a call with your boss's deep fake and they're, you know, trying to get secrets or install malicious software and uh I think that would be interesting. So, that was that article.
Karisse Hendrick
31:23
Uh, just continuing down the deep fake rabbit hole. Here's another one about deep fakes that didn't surprise me much. But I think is is good to know. Uh, researchers tracked 821 deep fake attacks. And Elon Musk's Grock was linked to most of them. One out of six involved non-consensual sexual imagery of adults or children. That is gross. Elon Musk's Grock AI accounted for 87% of AI generated files connected to deep fake attacks during the first half of 2026. According to a new report from Resemble AI. Researchers examined uh 1760 news reports and identified 821 separate attacks involving at least 15,736 documented victims. Wow. Almost 16,000 documented victims. Incidents included proximity, uh oh sorry, included approx approximately 3.46 million synthetic images, videos and audio files. Wow. So about three and a half million synthetic images, videos and audio files. Resemble AI's data set is based on publicly reported incidents and its percentage applies only to files that researchers could count and attribute to a particular tool. So they're providing, you know, a little bit of a of some context to that. Uh even with that caveat, the figure shows how quickly and widely available AI imagery image generator can be turned into a tool for misuse and abuse. The findings arrive as Elon Musk places a large financial bet on Grock. Following SpaceX's acquisition of XAI, Musk said during a companywide meeting that SpaceX's AI revenue would surpass revenue from all other products as soon as September, according to Business Insider.
Karisse Hendrick
33:47
Does that mean that they're going to get every, a lot more people up in space? I don't know. Uh state stockx reported 2.56 billion in AI revenue during its most recent quarter, putting Grock and the infrastructure behind it at the center of the company's future. That makes questions about how the tool is being used difficult to separate from its rapid commercial growth. So basically, you know, Grock, the team at Grock is saying like, Oh, we have no way to know if any of our revenue, you know, our 2.56 uh billion dollars in revenue, if any of that was for fraud. But these researchers are saying that over 80% of the deep fakes that they analyzed came from Grock. And my understanding is that Grock either doesn't have a trust and safety team or that their hands are tied. I don't know of a fraud and safety team at Grock. I know of the fraud and safety team at OpenAI and Enthropic and Gemini and like all these other ones, but not uh not Grock. So that doesn't mean they don't exist. It just means that they're not active in uh the fraud industry. Um, but it sounds like that could serve them really well. All right, let's talk about zombie credit cards, shall we? Uh, like I said, this came from a uh UMass study. Uh, researchers at the University of Massachusetts Amherst have discovered a security loophole that could allow some expired credit cards to be used fraudulently even after a replacement card has been issued. The findings presented at USENIX Security 2026 conference described what researchers call zombie credit cards. Because certain expired cards can be reactivated through a flaw in the payment system. According to Taqi Raza, an assistant professor in UMass Amherst Riccio College of Engineering says uh the issue stems from the fact that while physical credit cards expire, the underlying account remains active. Researchers found that thieves could potentially manipulate a card's expiration date during a contactless payment transaction. Allowing an expired card to appear valid to some point point of sale terminals. Using two smartphones, nearfield communication or NFC technology, and readily available software, the team demonstrated how card information could be intercepted and modified before being sent to a payment terminal. So, they're getting expired card numbers, you know, card numbers that have been shut down. And adding them to digital wallets or, you know, doing, you know, different, you know, they're trying to fool the um POS. Because the system still recognizes the active account, not the credit card number. The expiration date printed and stored on the card is the only way for a POS to know whether a card is active or expired, says Raja Hosnine Anoir, lead author of the study and a doctoral candidate at UMass Amherst. Yet, it is not cryptographically protected. So we can easily modify it to fool the POS. Researchers said the vulnerability does not affect all credit cards equally. And that digital wallets generally include additional security measures that make them more resistant to this type of attack. The team tested the loophole both in laboratory settings and at local businesses. Including dining facilities and grocery stores. Major credit card companies have been notified of the findings. Researchers say consumers should continue to safely dispose of expired credit cards rather than assuming they are no longer usable. They recommend destroying the magnetic strip and embedded chip, cutting the card into pieces, and monitoring accounts even after it has expired or been closed. Fraudulent charges should be reported to financial institutions immediately. So basically what they're saying is yes the card is expired. But if you add your card to a digital wallet like Apple Pay or Google Pay or PayPal you know any of those. Uh and you use NFC technology the near field communication. You're not swiping the card you're not inserting the card you're not tapping the card. You're tapping your phone essentially. When you use that, then some credit cards are going to authorize. And then chances are you're going to get a charge back. Like this wasn't, you know, authorized by the card holder because it was fraud. And you may think, no, it's not. Like this is the same card they used before. Or this is their address or whatever it is. So, I thought it was really important, especially for e-commerce merchants and bank issuers to be aware of this. That, you know, recycled or uh expired credit cards can be used in an NFC transaction where the card doesn't have to actually be present. It doesn't have to be tapped, swiped, or u chipped. Um, so sometimes the simplest thing is what helps fraudsters get away with fraud. And I think this is relatively simple, but something that a lot of people hadn't thought about. So if you're in e-commerce fraud, it's not your liability. It's not your loss. I totally get it. If you I mean, you should still be aware that this fraud is happening and try to stop it as much as possible. So current present uh transactions aren't really um affected here. However, uh in-person transactions uh Apple Pay, Google Pay, etc. can be. So, just be aware of that. All right, I promised you this at the beginning of the episode.
Karisse Hendrick
40:22
Frank McKenna has been talking about this concept of digital arrests for almost a year. And they were big in India, really big in India. And it would you know consist of someone calling representing law enforcement uh to the you know person who owns the phone. And uh they manipulate them and they say that if they get off the phone if they go somewhere else, if they, you know, do all these things that they, you know, could do without someone knowing if you're on the phone or not. Uh, then there will be an immediate warrant out for their arrest. So, they, you know, scare you. They say a lot of things. A lot of times they research you. Like I was talking about, uh, earlier in the episode. And like we talked about with Cy last week, uh sometimes they're using AI to figure out all about you. So that they can be convincing that they're law enforcement. So uh they, you know, they threaten you and they say, Well, we can pause this if you pay us x amount of dollars. But after paying that amount of money, they don't go away. They don't say, Oh, okay. Have a nice day. They stay on the phone and press her for even more money and say, Well, actually, our computer system had a problem and it said you owed $400, but actually you owed $4,000. So now we're going to sit on the phone with you for another hour while you try to figure out how to come up with that amount. I just kind of wanted to give like an overview of what a digital arrest was before um diving into the story. Um, but like I said, if you read the New Year's predictions, if you listen to any of our webinars we did on our New Year's predictions, this was Frank's like baby of a prediction. I mean, this was his brainchild. And I just I for whatever reason, I didn't think it would work in the US. And I'm not afraid to say that I was wrong. In fact, sometimes when it comes to fraud, I want to be wrong. I don't want a company to suffer a bad fraud attack, right? But if I can spot it, you know, happening or about to happen or, you know, a loophole that they can find, well, you know, there is a little better.
Karisse Hendrick
42:52
So, this is Morgan's story. And she posted it on Facebook. And uh I don't know how, but Frank found it. As embarrassing as it is to admit, I've been a victim of a scam. Only sharing to help prevent this from happening to anybody else. If you have anything negative to say, then don't comment. It'll be deleted. I already feel like an idiot for following for falling for this. I got a call this morning at around 10:00 a.m. from the sheriff's department. In quotation marks. Claiming I have a warrant out for my arrest for failure to show up for jury duty. I've never been to jury duty, so I'm not familiar with how it works. But he gave the address that the paperwork was sent to, which was our old address. He said the paperwork was signed with my name and returned. So, in order for this warrant to go away, I need to go to the sheriff's department with my driver's license so they can compare signatures that's on my license. They told me I was not allowed to hang up the phone, mute the call, merge calls, or even tell anybody what was happening since it was a a legal matter. They gave me the citations and I wrote them down. They said so much information in all legal talk, so I barely understood most of it. I asked so many questions to try to understand better, and they had the answer to everything. They said I needed to gather my things and immediately head to the sheriff's department. I was not able to go anywhere else. I explained I needed to get dressed, get my daughter dressed, and a bag packed for her. They told me that they would wait on the phone for that. I made arrangements for her husband uh to pick up from school since it was close to pickup time. I loaded her small daughter uh into the car. They gave the address, which was the sheriff's department address in our town, so I had no reason to doubt it.
Karisse Hendrick
44:54
They asked me for my speedometer information and how long it would take to get to the department to ensure I didn't stop anywhere along the way. I had to tell them when I began driving. So they could clear me to drive. Because they said I would be arrested if I drove and got pulled over without being cleared. They stayed on the phone. They sent me documents via text from a different number stating everything and all the disclosures. At one point, I had to pull over to verbally read and well to read and verbally agree to the disclosure. While I was pulled over, they then said one of the citations had become active and I needed to pay a bond or something. I don't remember how they worded it. But it needed to be paid before going on property and then it would be reimbursed once things were cleared. It was their way of ensuring I was coming to handle the situation, I guess. They told me the bond amount was $8,500. Luckily, me and my husband have separate accounts and savings. I told them I'm unemployed and no savings, so I don't have that much. They asked how much I could cover and that the bondsman would lower it to a different amount. How generous. I told them and they were able to lower it to $1,100. But they kept reassuring me it would just be on hold and it would be reimbursed once I got there. I texted Jake to confirm or um texted her husband to confirm where the sheriff's department was. And he confirmed the same address they told me. So again, even though I had a weird feeling, why would a scammer be sending me to the actual sheriff's department? So I sent it via PayPal goods and services. Majority of my money that I work so hard for. Just gone. Then they said my background check came back and it does claim I have more money in a separate account, so I would have to pay more than $1,100. They told they told me I needed to pay $4,000 more. I kept explaining I didn't have access to that account and that it was my husband's. How did they know that this about this account? I'm not sure.
Karisse Hendrick
47:14
Lucky guess or did they actually know? They went as far as to say I could go get the money from my husband who was an hour away. If I told them the place of where we would meet, then I could be cleared to meet him and go to the department. They kept saying I was not cleared to drive until this was handled and I would be arrested. This is about the time Jake is calling me, telling me to hang up because he confirmed with his dad, a retired state trooper, that it was indeed a scam. So, she was texting her husband while she was on the phone with these guys. That's uh she does include the text threads uh in her post that where she's saying like, Hey, I don't know what's going on, but I owe money for a jury summons I didn't go to. And you know, that type of thing. And he's like, "Okay, I'm going to call my dad. And his dad immediately said, It's a scam. I was terrified to hang up, thinking I was going to get arrested with Colby in the back seat. So, her younger daughter in the back seat. I was balling in tears, stressed out. They continued to call me eight more times after I hung up. It was so real. They had so much information about me. They had sounds in the background like it was a police, like they were police walkie-talkies. I'm working with PayPal to try to get my money back. I've called banks to put everything on hold. Just terrifying. So, as Frank's been saying for the last year, digital arrests are here in the US. And obviously, I don't I the likelihood of someone who fights fraud and is educated on scams and you know what is possible and what won't happen and all of that are fairly slim. However, that your family members cannot become, you know, fraud aware or scam aware by osmosis. No matter what my husband jokes around about, uh, that's not a thing. So, um, you know, make sure that you tell them that, you know, law enforcement will never call. And they'll never ask for money over the phone. They'll never ask for gift cards. They'll never ask for PayPal transfers or Venmo or Zelle.
Karisse Hendrick
49:35
They'll never do that. So, uh, that's a really important piece of education that is needed. And I I really appreciate that she shared her story because I'm sure it wasn't easy. She shared it the night that it happened. She might have needed to just get it out of her head. But I thought this was, you know, a good a good scam to leave off on because they're creating a sense of urgency. They're creating panic. They're creating, you know, all of those things that they need to commit fraud. And they're going to take however much they can take. And then they're just going to move on. And you're not going to have, you know, get a um reimbursement from the sheriff's department or anything like that. So, that is, I think, a good one to be aware of and to educate others on. With that, uh, I'm going to end this episode for today. Um, I believe I have a great guest coming next week. Uh, I have to double check my calendar, but I think that we are scheduled for this week. And I hope that you guys are doing well. Thanks again for watching and listening to Fraudology. I appreciate it so much. I know we're on episode 420 something. Um, I just I really appreciate it and I hope you have a great rest of the week.
View full transcript
