AI is increasing the speed and scale at which bad actors can defraud banks and account holders, forcing banks to take a proactive approach to fraud, rather than a reactive one.

“The pace at which AI is able to turn around and enact a threat, frankly, has caused us as an institution to turn around and really think about controls that maybe in the past were sufficient,” Spencer Shea, head of enterprise fraud management at BMO, told FinAi News.

“It’s becoming much faster, it’s becoming much more intrusive and it’s become a force multiplier for bad actors looking to turn around and create and execute nefarious deeds.”

To stay ahead of fraudsters, BMO is dedicating employees and teams to ferret out fraud before it happens, Shea said.

“We have to take the fight to the fraudsters and be more proactive,” he said.

Shea sat down this week with FinAi News to discuss AI-powered fraud and how banks and their customers can better safeguard themselves against bad actors.

This conversation has been edited for clarity and length.

FinAi News: How can banks better protect themselves and their clients from AI-powered fraud?

Spencer Shea: One of the ways is … looking at your current controls. The threat vectors are constantly evolving, so the controls that you used in an effort to thwart and mitigate fraud five years ago — maybe even in certain instances five months ago — may not be what is going to turn around and protect our clients, our employees and the outfit five days from now.

Also make sure that you have an adequate and superior incident management team that can turn around and quickly respond to these events.

These events can cascade very quickly, so speed is a tremendous factor.

At BMO, we are using AI to fight AI. We are turning around and looking at unconventional methods that maybe we hadn’t turned around and utilized in the past.

We’re not waiting for this to come to us. … We’re going out and proactively engaging the individuals that are acting nefariously in an effort to stop this issue before it starts.

FinAi News: As AI grows in sophistication and scale, how can financial institutions stay secure?

Shea: You need designated individuals and groups whose specific focus is trained on that, as well as the changes that are quickly occurring throughout the marketplace.

Who’s in your emerging threats team? Who are the individuals that are forward-looking for what has not necessarily happened, but what’s going to happen? There’s a lot of intelligence that’s out there in the marketplace. How are we turning around and leveraging that?

[Doing this will] make you less of an attractive target and, frankly, make the fraudsters think twice before they start to try to approach your organization. And that’s really the goal of what we’re looking to do here: Make it so that … criminals look at BMO and just say it’s not worth their time.

FinAi News: Part of being proactive is predicting what the next big threats will be. What threats do you foresee becoming more problematic in the near future due to AI?

Shea: AI has become very good and continues to get better at being able to facilitate deepfakes.

The traditional methodologies that we’ve often used in an effort to authenticate people, whether they be voice or visual, may be rendered obsolete. Be very careful about traditional means of authentication that we have become accustomed to.

And bad actors are going to go after [less tech-savvy] constituents with these deepfakes.

FinAi News: How can customers better protect themselves from AI-powered fraud?

Shea: One of the most effective ways to protect yourself is to pause to verify and to trust your instincts. A few extra minutes and questions can save you a severe financial loss. If something is too good to be true, it probably is.

Awareness remains one of the strongest defenses against scams, but the people that perpetrate [scams] are constantly adapting their tactics.

Criminals continue to impersonate [FIs] to obtain card details, passwords, PINs. They can use ID spoofing [on] phone calls, so never rely on the number that’s displayed as proof that a call is legitimate. BMO is never going to ask for your password, your PIN or your one-time passcode through an unsolicited call, email or text. And if you’re ever unsure about it, hang up and call the number on the back of your card.

FinAi News: In addition to education, how does BMO empower its customers to protect themselves and their accounts from fraud?

Shea: We give them the opportunity to turn on or turn off some of [their account capabilities and notifications], which enables us to also understand more about our customers. For example, if a customer turns off the option or the ability to draw on a home equity line … and then now, all of a sudden, we see that’s turned on — that’s a red flag for us.

This also helps us mitigate client friction. Every day, we walk a tightrope between making sure we protect the institution and [creating] so much friction that the client can’t turn around and live their life.

Register here for the FinAi Lending Summit, set for Oct. 7-8 in Las Vegas. This inaugural event will include speakers from Fifth Third and Capital One as well as a fireside chat with Piermont Bank founder and Chief Executive Wendy Cai-Lee.