The market for cybercrime tools mirrors the legitimate SaaS industry. Criminals can purchase subscriptions to deepfake services, uncensored language models, and phishing kits, complete with pricing tiers and customer support, making advanced fraud accessible for a low monthly cost.

AI has transformed scamming into a highly efficient business. Research shows cybercriminal organizations deploying AI generate 9x the volume and 4x the revenue of their peers. Leveraging generative AI for hyper-personalization, they operate like sophisticated, profitable businesses, effectively weaponizing technology for fraud.

Previously, creating unique, high-quality phishing websites was costly, limiting the scale of fraud. AI makes generating novel, legitimate-looking content nearly free. This allows bad actors to overwhelm detection systems that rely on identifying repeated fraudulent assets, increasing the volume of believable scams.

AI-generated scams are now so convincing that even sophisticated users are fooled. The responsibility has shifted from teaching customers to spot fakes to brands proactively deploying technology to take down threats. Blaming the customer is irrelevant as the brand still loses trust and revenue.

The accessible AI software that helps brands quickly build websites, create ads, and list products is a double-edged sword. These same tools are exploited by fraudsters to accelerate the speed and scale of their nefarious activities, creating an arms race where brands must also adopt AI to defend themselves effectively.

Viewing fraud as its own form of infrastructure, with its own "APIs of evil," provides transferable lessons. By understanding how fraudulent systems are built and operate, we can gain insights to better architect and secure the legitimate, critical infrastructure in our lives.

While many focus on AI for consumer apps or underwriting, its most significant immediate application has been by fraudsters. AI is driving an 18-20% annual growth in financial fraud by automating scams at an unprecedented scale, making it the most urgent AI-related challenge for the industry.

The old security adage was to be better than your neighbor. AI attackers, however, will be numerous and automated, meaning companies can't just be slightly more secure than peers; they need robust defenses against a swarm of simultaneous threats.

Large-scale fraud is not run by individual hackers but by organized 'factories' that resemble corporations. These entities have specialized departments, division of labor, performance KPIs, and even employee services like cafeterias and clinics, operating with high efficiency.