A synthetic identity may begin taking shape months before any suspicious transaction occurs. Data can be obtained through a security breach, combined with publicly available information, and used to create a fabricated profile. Social engineering, a deepfake, or an automated operation may then come into play. By the time the fraud reaches the financial system, part of the story has already unfolded elsewhere.
This evolution is changing the nature of the problem. Financial fraud can no longer be understood solely as an event that one institution must detect within its own systems. It is a phenomenon that spans channels, institutions and, increasingly, borders.
Fraud Is Built Before the Transaction Occurs
Synthetic identities are a clear example. A profile may accumulate apparently legitimate information and behavioral patterns before being used to apply for credit, open an account, or conduct a transaction. The U.S. Federal Reserve has studied this type of fraud and notes that synthetic identities combine personal information to create a fabricated identity for illicit financial purposes.
Federal Reserve research also refers to the concept of farming: the process of building and maintaining synthetic identities before using them to generate financial gain. This helps explain how fraud can begin long before an institution sees a transaction that appears suspicious.
This is compounded by data obtained through breaches, social engineering techniques, and tools capable of generating highly convincing content. Deepfakes make it more difficult to distinguish a legitimate interaction from impersonation, while artificial intelligence makes it possible to automate an increasing share of fraudulent activity.
As a result, the point at which fraud is detected may be far removed from the point at which it first began to take shape.
When a Single Signal Does Not Tell the Whole Story
The challenge for financial institutions is not simply to identify more signals, but to connect them.
A credit application may appear normal to one institution. A phone number may have appeared in a previous case elsewhere. A device may be associated with multiple accounts. A transfer may share characteristics with transactions that another institution has already flagged as suspicious.
Individually, each signal may be inconclusive. Together, they may reveal a pattern.
The BIS, the Bank for International Settlements, has explored precisely this possibility through Project Hertha, a joint initiative with the Bank of England. The project examined how data from different participants in a payments system, combined with artificial intelligence techniques, could help identify patterns of illicit financial activity that may be difficult to detect from the perspective of a single institution.
In its test, system-wide payments data enabled banks and payment service providers to identify 12% more illicit accounts than with their usual methods and improve the detection of new behaviors by 26%. The exercise used synthetic data, and the results were positioned as a complementary tool rather than a standalone solution.
This points to an important shift: moving from asking, “Does this transaction look fraudulent?” to understanding, “How does this transaction relate to patterns we already know?”
AI Is Also Changing the Speed of the Attack
The evolution is not limited to the techniques used to deceive individuals. It is also changing the speed at which certain actions can be carried out.
In September 2026, the Spanish Data Protection Agency reported receiving the first notification of a personal data breach in which the incident was allegedly carried out by an artificial intelligence agent.
According to the information submitted, the agent searched for vulnerabilities, successfully gained access, and continued exploring the system autonomously until it modified personal data and accessed invoices. The Spanish Data Protection Agency has remained cautious regarding the details of the case and has not publicly identified either the affected organization or the model involved.
The key differentiator is autonomy.
An agent can be given an objective, plan intermediate tasks, use tools, interpret results, and adjust its behavior based on what it encounters.
When threats can evolve at this speed, the ability to identify patterns and respond must also become faster.
From the Bank That Detects to the Ecosystem That Responds
Collaboration among participants is moving from an aspiration to an operational capability.
The United States provides one example. The American Bankers Association operates a Fraud Contact Directory, a tool that enables financial institutions to connect with one another to resolve fraud cases involving checks, wire transfers, ACH transactions, real-time payments, and FedNow.
In March 2026, the ABA reported that 2,443 banks were using the directory, representing more than half of U.S. banks, and announced that access would be extended to international institutions.
The logic behind initiatives like this is straightforward: one institution may detect a signal, while another may hold the information required to provide context and accelerate the response.
The objective is not to give every participant unrestricted access to the same data. It is to establish secure mechanisms for sharing the information that is necessary, within the appropriate privacy and data protection frameworks, and to turn isolated signals into actionable intelligence.
In Latin America, this conversation is also becoming increasingly relevant from a regulatory perspective.
In Colombia, for example, Law 2573 of 2026 establishes measures addressing identity impersonation cases involving financial and credit institutions, including obligations related to identity verification, the handling of suspected impersonation cases, and the disclosure of information used to approve financial products or services.
The law was enacted in May 2026, with general effectiveness scheduled for November 20, 2026. Other Latin American countries are also addressing fraud through regulatory frameworks, including Mexico through the Federal Law on the Protection of Personal Data Held by Private Parties, Brazil through Law 13.709, Argentina through Law 25.326, and Peru through Law 29733, among others.
The Colombian regulation also establishes that, in certain cases, the determination that impersonation did not occur is reserved for the competent judicial authorities.
Despite regulatory differences across countries, the underlying challenge is the same: identifying patterns that no single participant can fully see in isolation.
An Architecture Built to Respond
Threats may originate at different points across the ecosystem, but a critical part of the response takes place when a transaction reaches the transactional infrastructure: identifying risk signals, applying the appropriate rules, and determining how the transaction should be processed.
This is the layer where the capabilities of CLAI PAYMENTS® Technologies can add value. AXIA™ uses artificial intelligence and machine learning to identify patterns associated with potentially fraudulent behavior within transactional operations.
AZ7® enables institutions to apply rules and orchestrate transactions according to defined decisions, managing how each transaction should be processed. CRYPTGRID™, in turn, protects transactions through cryptographic capabilities that support the security of the transactional operation.
Together, these capabilities address a specific part of the challenge: detecting risk signals within the operation, converting those signals into processing decisions, and protecting the information that supports those decisions.
The objective is not to cover every stage that may precede or follow a fraudulent event. It is to strengthen the transactional layer where a risk signal must become a response.
In an environment where threats are increasingly distributed, having infrastructure capable of detecting, deciding, and responding within the transaction flow is becoming a critical and essential capability.
If your organization is looking to implement an architecture prepared to address today’s banking security challenges, complete the form below and one of our specialists will contact you.
