Fraud, scams, and targeted manipulation

39 of the world's largest companies we reviewed acknowledge the AI risk "Fraud & scams", including Mastercard, Visa and Commonwealth Bank of Australia.

Which companies acknowledge this risk?

• Mastercard: “In unauthorized payment fraud, fraudsters take control of a user's account to make payments using their funds. Generative AI can help fraudsters gain access to accounts... and can help them move funds using compromised accounts automatically with limited need for human intervention.” (Mastercard Generative AI Cybersecurity Report)
• Visa: “In the age of agentic AI, adversaries can spin up thousands of targeted operations in minutes... Synthetic content generated by AI can be indistinguishable from genuine business materials, rendering many existing fraud indicators unreliable.” (Agentic Commerce: Threats and Risks | Visa)
• Commonwealth Bank of Australia: “Investment scams - deepfake celebrities and experts with 'don't-miss- out' success stories. Deepfake videos imitate well-known people to promote fake investments.” (How good are Australians at spotting an AI-powered deepfake scam?)
• Microsoft: “...prevent malicious actors from creating and disseminating abusive AI-generated content, including deepfakes, intended to defraud, abuse or manipulate people.” (Microsoft: G7 Hiroshima AI Process (HAIP) Transparency Report)
• SAP: “We may therefore see a rise in spear phishing campaigns... An unsuspecting victim may be easily convinced if targeted via multiple channels in a single coherent real-time and interactive attack.” (SAP Generative AI Cybersecurity Strategy)
• IBM: “Generative AI models might be intentionally used to imitate people through deepfakes using video, images, audio, or other modalities without their consent.” (Foundation models: Opportunities, risks and mitigations)
• Alphabet (Google): “including when such technologies are used to target our employees or impersonate members of senior management in order to gain unauthorized access to our systems.” (Alphabet - Form 10-K 2024 Annual Report)
• Palantir: “AI, including our use of AI, may create additional cybersecurity risks... and may result in... phishing attacks... As AI capabilities improve... we may see cyberattacks crafted with an AI tool... by creating more effective phishing emails or social engineering and by exploiting vulnerabilities... utilizing false image or voice recognition.” (2024 10-K Palantir)
• Coinbase: “The increasing sophistication of AI poses a greater risk of identity fraud, as malicious actors may exploit various AI technologies to create increasingly convincing false identities, transaction records, or attempt to manipulate our verification processes.” (Coinbase Global, Inc. 10-K Annual Report (FY2025))
• Meta: “propensity to automate social engineering via spear-phishing” (Expanding Our Open Source Large Language Models Responsibly)
• AMD: “Do not use AMD AI for any potentially harmful uses, including fraud, deception... Impersonation of human beings for purposes of deception.” (AMD Responsible AI Use Policy)
• JPMorgan Chase: “The increasing sophistication of artificial intelligence technologies poses a greater risk of identity fraud, as malicious actors may exploit artificial intelligence to create convincing false identities or manipulate verification processes.” (JPMorganChase 2024 10-K Annual report)
• National Bank of Canada: “The risk of fraud is intensifying across the industry, particularly with the accelerated progress achieved in AI. These developments enable more sophisticated schemes, such as the creation of synthetic identities, impersonation through deepfakes, automated phishing and Fraud-as-a-Service” (National Bank of Canada Annual Report 2025)
• PNC Financial Services: “The effectiveness of these efforts may be enhanced using AI. These efforts may be to obtain access to confidential information, often with the intent of stealing from or defrauding us or our customers” (PNC Financial Services 2025 Annual Report)
• American Express: “the possibility of... malicious social engineering... fraudulent or other malicious activities... cannot be eliminated entirely and will evolve as new and emerging technology is deployed by threat actors, including the use of artificial intelligence” (American Express 2024 Annual Report)
• Citigroup: “the use of increasingly sophisticated AI technologies by malicious actors and others has increased the risk of fraud, including identity theft and bypassing of verification controls” (Citigroup 2024 Annual report)
• Goldman Sachs: “in response to the proliferation of AI-enabled fraud ... we have emphasized phishing and cybersecurity training for our employees” (Goldman Sachs 2024 Form 10-K)
• Intel: “The proliferation of generative AI increases the risk of these technologies being used by threat actors to impersonate authorized individuals, which may make attacks even more difficult to detect and prevent.” (Intel Annual Report 2024 - 10K)
• National Australia Bank: “Threats to information security are constantly evolving, including through the use of emerging technologies, such as advanced forms of AI (including generative AI)... used to perpetrate fraud, scams” (NAB H1 2025 Offering Circular)
• Alibaba: “However, it can also be used to create videos and images depicting things that have never happened. Such fake videos with inappropriate comments could erode the reputation of individuals, especially where public figures are involved.” (Alibaba's CTO On Everything You Wanted To Know About AI Ethics (But Were Too Afraid To Ask))
• Applied Materials: “Artificial intelligence and deepfake technologies could be used to attack information systems by creating more effective phishing emails or social engineering and by exploiting vulnerabilities in electronic security programs utilizing false image or voice recognition.” (Applied Materials 2024 Annual Report)
• Blackstone Group: “These cybersecurity threats and compromises could occur as a result of threat actors impersonating Blackstone or its employees, including through the use of artificial intelligence technologies. Such technologies could make such impersonation more likely to occur or appear more credible. As a result, unauthorized individuals could gain, and in some past instances have gained, access to certain confidential data.” (2024 Blackstone 10-K filing)
• Broadcom: “The emergence and maturation of AI capabilities may also lead to new and/or more sophisticated methods of attack, including fraud that relies upon "deep fake" impersonation technology” (Broadcom 2025 Annual Report on Form 10-K)
• Coca-Cola: “cyberattacks by hackers... (which may include deepfake or social engineering schemes, worms, phishing, spyware, ransomware and other forms of malware, business email compromise, cyber extortion...)” (Coca-Cola 2024 Form 10-K)
• Fortinet: “Emerging technologies, such as AI, compound these risks by expanding the attack surface. AI-driven phishing campaigns, for example, are increasingly difficult to detect” (2024 SUSTAINABILITY REPORT | Fortinet)
• Glencore: “machine learning and artificial intelligence has led to an exponential increase in the volume and sophistication of fraud attempts... increasing the potential for phishing or fraud attacks that impersonate senior executives” (2024 Annual Report - Glencore)
• HSBC: “The accessibility and increasing sophistication of generative AI brings additional financial crime risks... there is also a risk that criminals use generative AI to perpetrate fraud, particularly scams.” (HSBC 2024 Annual Report)
• ICBC: “it analyzed a series of new trends in cyber-crime, such as AIGC, deep-fake biometric recognition” (ICBC Sustainability Report 2024)
• Inditex: “new training pills that tackle emerging deepfake and artificial intelligence threats. These courses explore how attackers are using AI to make their tactics more sophisticated, and therefore more convincing and harder to detect.” (Inditex 2024 Annual Report)
• Intuit: “We operate in industries that are experiencing an increasing amount of fraudulent activities by malicious third parties, and those fraudulent activities are becoming increasingly sophisticated, including through the use of AI.” (Intuit 2025 Annual Report)
• Morgan Stanley: “parties may also attempt to fraudulently induce employees, customers, clients, vendors or other third parties ... to disclose sensitive information ... and such parties may see their effectiveness enhanced by the use of artificial intelligence.” (Morgan Stanley 2024 Annual report (10K))
• QUALCOMM: “as AI continues to evolve, cyber-attackers could also use AI to develop... increasingly sophisticated phishing attempts” (Qualcomm 2025 Annual Report)
• ResMed: “Such cyberattacks increasingly exploit AI and machine-learning techniques-ranging from generative-AI phishing and deep-fake impersonations” (ResMed 2025 Annual Report (10-K))
• Shopify: “social engineering (such as spear phishing attacks)... could be enhanced or facilitated by artificial intelligence” (Shopify Inc. Annual Report on Form 10-K (Fiscal Year 2025))
• Steris: “generative AI may be used by malicious actors to create more targeted phishing narratives... or otherwise enhance the social engineering capabilities of such malicious actors.” (Steris 2025 Annual Report)
• T. Rowe Price: “we are exposed to risks arising from the use of AI technologies by bad actors to commit fraud and misappropriate funds” (T. Rowe Price Group 2025 Annual Report (10-K, FY2025))
• TSMC: “as AI continues to evolve, cyber-attackers could also use AI to develop... sophisticated phishing attempts” (TSMC Form 20-F 2024 Annual Report)
• Walmart: “the increasing sophistication of AI technologies poses a greater risk of identity fraud, as malicious actors may exploit AI to create convincing false identities or manipulate verification processes.” (Walmart 2025 Annual Report)
• Wells Fargo: “attacks that may exploit AI to make fraud detection and authentication more difficult” (Wells Fargo 2025 Annual Report)