The fraud blind spot: Where AI, data and technology are creating new risks for businesses

Fraud is evolving in speed, scale and sophistication. Organisations need to understand where risk can sit unnoticed between people, processes, systems, data and controls. Fraud remains a significant business risk, but it can receive less attention than cyber security, artificial intelligence and data risk. As organisations become more digital, interconnected and inter-reliant, technology is making established fraud methods faster, more scalable and more convincing.

The scale of technology-enabled scams is increasing. ASIC removed more than 19,400 online scams in FY26, up 182 per cent on the previous year, and has warned that criminals are using generative AI to create deepfake websites, fake celebrity endorsements, fabricated news articles and convincing interactive voice calls and videos.

Where is your fraud blind spot?

Stan Gallo, Partner, Forensic Services at BDO, sees this shift playing out in the speed, scale and sophistication of fraud. While the underlying objective may be familiar, the evolution of AI and other technologies can make fraudulent communications easier to personalise and distribute, allowing more organisations and individuals to be targeted on an ever-increasing scale.

For businesses, the challenge is not simply whether controls exist, but whether those controls remain effective and fit for purpose. A ‘set and forget’ process can be followed correctly and provide false assurance. A seemingly low risk amendment may open the door to the subsequent fraud, whilst being harder to detect. This is particularly difficult to detect when linked to a familiar supplier, legitimate email account or expected transaction.

The financial impact is significant. National Anti-Scam Centre data shows payment redirection was Australia's second-highest scam category by reported losses in 2025, with $166.8 million reported lost.

As Stan Gallo notes, cyber security and fraud controls are closely connected, but they are not interchangeable. Strong technical security may not prevent manipulation of people, trusted relationships or legitimate business processes. Likewise, traditional controls remain important, but do not stand alone. Organisations should test whether verification processes, segregation of duties and stored information remain effective against current risks.

The risk is often in the gaps, not the obvious weaknesses

One of the key themes emerging from recent discussions across the fraud and risk landscape it that, AI changes the nature of fraud, organisations need to revisit their fraud risk frameworks.

An organisation can have policies, controls and systems in place and still remain exposed. Karyn Lander, Partner, Forensic Services at BDO, brings a fraud risk management and investigations perspective to the gap that can exist between how controls are designed and how they operate in practice.

Controls may not be consistently applied, while exceptions, workarounds, excessive system access and trusted relationships can create vulnerabilities. Risk can also fall between functions, with fraud, cyber, operational risk and technology teams each holding only part of the picture.

Organisations should regularly review their fraud risk frameworks and test whether policies and procedures are operating as intended, focusing on the following areas:

• Test controls in practice through sample testing of transactions, approvals and system activity to confirm they operate as per the stated policy or procedure.
• Monitor exceptions and overrides to identify controls that are routinely bypassed or treated as an administrative step rather than a genuine control.
• Review access controls regularly particularly privileged, dormant or outdated access that may no longer reflect an employee’s responsibilities.
• Maintain oversight of trusted relationships including long-serving employees, senior personnel and established suppliers. Familiarity should not replace appropriate oversight.
• Connect information across functions to identify patterns that may otherwise be missed in isolation.
• Test staff awareness to confirm fraud policies are understood and translated into day-to-day behaviour.
• Track remediation with clear ownership, deadlines and follow-up testing to confirm identified weaknesses have been addressed.

Ultimately, organisations need to look beyond whether a policy or control exists and ask a more important question: is it understood, consistently applied, monitored and demonstrably working in practice?

More data does not necessarily mean better visibility

Organisations are generating and retaining more data than ever. Conor McGarrity, Partner, Forensic Services at BDO, highlights that greater volumes of data do not automatically translate into greater visibility of fraud risk.

Effective monitoring depends on connecting technical analysis with business context. Data and analytics teams may have access to large volumes of information, but significant indicators can remain hidden without input from the people who understand the underlying processes, behaviours and risks. Poor data quality, inconsistent fields and information gaps can further reduce monitoring effectiveness.

Organisations should focus on three practical areas:

1. Connect information across systems. Transactions, employee activity, supplier information and system records should not always be reviewed in isolation.
2. Help people recognise and escalate unusual activity. Employees need the confidence, training and clear pathways to act when something does not look right.
3. Use technology with appropriate oversight. Automated workflows and system-based controls can miss activity that falls outside predefined rules or monitoring parameters.

Conor McGarrity also emphasises investigation readiness. Organisations should understand where critical data and evidence are held, how they can be preserved, and who is responsible for coordinating a response. Technology can support detection, but it should sit alongside governance, oversight, professional scepticism and business context.

When something goes wrong, can you establish what happened?

Identifying potential fraud is often only the starting point. Katie Bourne, Partner, Forensic Services at BDO, explains that establishing what happened, how long it continued, who benefited and what was lost can be significantly more difficult.

In complex investigations, the answer rarely sits in one transaction, document or system. Katie Bourne points to the importance of bringing together financial records, communications, system data, supplier records, and banking information. Viewed together, these sources can establish a chronology, test explanations and identify relationships that were not previously known.

Three key priorities a clear investigation response should focus on:

1. Build the full picture. Look beyond the first person, transaction or document that raised concern. Fraud may involve multiple accounts, entities, communications or jurisdictions.
2. Follow the evidence and the money. Tracing transactions and assets can identify beneficiaries, connect apparently unrelated parties and help quantify the organisation’s loss or exposure.
3. Act early to preserve information. Delays may allow records to be altered or deleted, systems to overwrite data, devices to be replaced, or funds and assets to move further beyond reach.

Warning signs should also be considered together. A concern that appears explainable in isolation may become more significant when viewed alongside other incidents or patterns. Recording, escalating and objectively testing concerns helps prevent trust or organisational relationships from substituting evidence.

Investigation readiness starts before an incident occurs. Organisations should know where critical data is held, how relevant communications can be preserved lawfully, who has authority to secure records and devices, and how legal, forensic accounting and digital investigation expertise will be engaged. readiness starts before an incident occurs. Organisations should know where critical data is held, how relevant communications can be preserved lawfully, who has authority to secure records and devices, and how legal, forensic accounting and digital investigation expertise will be engaged.

For Katie Bourne, the objective is to develop a defensible account of what happened, how it happened, who was involved or benefited, where funds or assets moved, what losses were incurred and what action should follow.

From fraud awareness to fraud readiness

Taken together, the perspectives of Stan Gallo, Karyn Lander, Conor McGarrity and Katie Bourne show why fraud readiness requires more than a policy, a reporting channel or a technology platform. Organisations need to understand how their people, processes, systems, data and controls operate together, and where risk can sit between them.

Boards and executives should ask whether controls work in practice, whether warning signs can be connected across the organisation, whether people know when and how to escalate concerns, and whether the organisation can preserve evidence and establish the facts if an incident occurs.

How BDO can help

BDO’s Forensic Services team supports organisations with fraud risk management, forensic accounting, investigations, digital evidence, data analytics and whistleblowing programs. The Fraud and Corruption Control checklist for boards and executives provides a practical starting point for assessing current risks and the controls used to manage them.