--- title: Should Fraud and Cybersecurity Teams Converge? source_page: https://www.sardine.ai/media/the-saturday-fraud-strategist/episodes/ai-phishing-detection canonical: https://www.sardine.ai/media/the-saturday-fraud-strategist/episodes/ai-phishing-detection format: text/markdown date: 2026-06-13T05:00:00.000Z description: AI phishing detection now depends on shared fraud telemetry, email security signals, upstream detection, and AI model testing to stop AI-powered fraud... --- **Quick links:** [Human page](https://www.sardine.ai/media/the-saturday-fraud-strategist/episodes/ai-phishing-detection) · [Home](https://www.sardine.ai) · [Customers](https://www.sardine.ai/customers) · [Blog](https://www.sardine.ai/blog) · [Demo](https://www.sardine.ai/demo) --- # Should Fraud and Cybersecurity Teams Converge? **Published:** 2026-06-13T05:00:00.000Z AI phishing detection now depends on shared fraud telemetry, email security signals, upstream detection, and AI model testing to stop AI-powered fraud... Every few years our industry rediscovers the same debate: should fraud and cybersecurity teams actually sit together? And honestly, usually both sides hate the idea immediately. Not because they dislike each other. Mostly because both teams are already overwhelmed and nobody wants another meeting. But over the last couple of years, something changed. The signals started converging. Credential stuffing became account takeover. Account takeover became fraud. Fraud became phishing. Phishing became invoice fraud and ACH fraud. And suddenly the same security telemetry that detects compromised infrastructure also helps identify fraudulent users before they ever reach checkout. That is where things start getting weird. In this episode, I sat down with Cy Khormaee, who helped build Recaptcha at Google and now runs Aegis AI, to talk about why AI phishing detection is forcing fraud and cybersecurity teams closer together whether they like it or not. And honestly, once you realize the same behavioral signals can stop both account takeover and payment fraud detection, the organizational separation starts feeling a little artificial. We get into AI email security, AI-powered fraud, fraudster ROI, upstream fraud detection, and why modern attackers are moving faster than most enterprise security stacks were designed for. Also, I learned that Google literally tracked the market price of breaking CAPTCHA systems like a stock ticker. Which honestly feels extremely fraud-brained. What you’ll hear in this episode: A practical look at why fraud and cybersecurity teams are starting to share the same signals How credential stuffing and account takeover pushed security tools into fraud prevention use cases Why AI phishing detection depends on more than static email rules or reputation checks How AI email security is changing as attackers use AI to generate more targeted phishing attacks Where invoice fraud, ACH fraud, and accounts payable fraud sit between security and fraud operations Why security telemetry and fraud telemetry become more useful when teams connect the full user journey How Recaptcha evolved from image puzzles into behavioral detection and fraud prevention infrastructure Why “good people leave tracks” still applies across both fraud and security signals How upstream fraud detection helps stop problems before money leaves the platform Why fraudster ROI is one of the most useful ways to think about modern defense What teams should ask vendors before buying AI-powered fraud or AI security tools Expect a conversation about tools, signals, attacker economics, and the awkward reality that fraud and security may already be converging, whether the org chart admits it or not. Who should listen: Fraud leaders and fraud analysts Cybersecurity professionals Trust and safety teams FinTech fraud prevention teams Email security teams Accounts payable and payment risk teams Teams evaluating AI phishing detection or AI email security vendors Anyone working on credential stuffing, account takeover, invoice fraud, ACH fraud, or upstream fraud detection Basically, if your fraud team and cybersecurity team only meet during incident review, this one may be worth playing in both rooms. ### Episode notes This conversation starts with ransomware in a classroom, which is funny for about three seconds and then immediately becomes the point. Honestly, for a cybersecurity professor, that is either terrible timing or very strong teaching material. Maybe both. It also happens to be a clean way into the actual topic: what happens when security stops being theoretical and fraud stops staying neatly inside the fraud team? Cy and I talk about the overlap from a practical angle. Not “should the org chart change?” in some consulting-deck way. More like: are both teams already looking at the same attacker behavior, identity patterns, and telemetry? A lot of the answer is yes. We get into Recaptcha, account takeover, phishing, invoice fraud, ACH fraud, and why the line between security and fraud keeps getting blurrier. Cy also explains why AI-generated attacks are making the old rule-based playbook harder to trust, especially when adversaries can adapt faster than most enterprise systems. The part I think fraud teams should pay attention to is the operational one: how far upstream can you detect the problem before it turns into money movement, cleanup, and a very uncomfortable incident review? We also talk about what to ask vendors claiming they have AI, including how their models work, what happens to your data, and whether AI model testing is actually happening or just being implied in a slide deck. Because “we use AI” is not an answer. Not anymore. ### Key takeaway Fraud and cybersecurity do not need to become the same team tomorrow. But they do need to stop pretending their signals live in separate universes. AI phishing detection, AI email security, fraud telemetry, security telemetry, account takeover detection, and upstream fraud detection are all starting to point at the same thing: the attack path is connected, so the defense probably has to be connected too. The goal is not perfect security. That does not exist. The goal is to make the attacker’s business model worse. Less glamorous than “stop all fraud.” Probably more realistic. Not ready to stop the conversation about my, and hopefully your, favorite subject? Subscribe to The Saturday Fraud Strategist newsletter.