ANZ says AI fraud is growing more sophisticated in Australia just as its scam losses fall 24%

By Zendoric · October 6, 2026.

ANZ, one of Australia's big four banks, issued a warning to businesses on October 6 about the rise of frauds that combine social engineering with artificial intelligence: business email compromise (BEC, where an attacker impersonates an executive or supplier by email to divert a payment), brand impersonation, investment scams and invoice fraud through payment redirection. According to the Australian Signals Directorate (ASD, the national cybersecurity and signals intelligence agency), Australia received more than 84,700 cybercrime reports in the 2025 financial year, with BEC and identity fraud among the most reported against businesses.

Cosi De Angelis, ANZ's General Manager of Specialised Sales, describes a familiar pattern now accelerated by AI: impersonating banks and trusted suppliers, sending fake invoices and manufacturing urgency so that the business owner, short on time, authorizes the payment without checking. The bank also identifies an emerging threat of a different profile: coordinated criminal activity that opens accounts with stolen identities and uses them as "mule accounts" to move scam proceeds and for micro-laundering — that is, splitting illicit transactions into small amounts that go unnoticed.

The only thing verifiable with figures is the response, not the threat. ANZ reports a 24% drop in customer scam losses between October 2025 and June 2026 compared with the same period a year earlier, and says it has prevented or recovered more than $100 million in fraud funds, relying on behavioral biometrics (typing patterns, mouse movement or phone handling that reveal whether the person operating the account is not its usual owner), fraud analytics and stricter onboarding controls for opening new accounts. The bank is also reminding customers of its "Stop. Check. Protect." motto, taking advantage of October being Cyber Security Awareness Month in Australia, with Black Friday and the festive season — periods of higher payment volumes — just around the corner. Its recommendations are basic but still work: never share passwords, PINs or OTPs, even if the request comes from someone claiming to be from the bank; confirm any change to a supplier's bank account by phone, not by email; require dual authorization on large payments.

Our reading is that the statement sells more alarm than its own data supports. ANZ frames the warning around AI, but offers not a single figure isolating its real effect: no number of voice deepfakes detected, no estimate of how much of total fraud is attributable to synthetic content. What it does measure precisely — the 24% drop and the $100 million recovered — describes a defense that, for now, is gaining ground on the attack. This fits a thesis we have been arguing for some time: the immediate risk of AI is not a runaway superintelligence but the industrialization of everyday fraud, and against that concrete risk the big banks are deploying their own AI systems — behavioral biometrics, pattern analytics — with measurable results.

That is also where the winners and losers are divided. A bank the size of ANZ can invest in biometric detection at scale; an Australian small business — the "time-poor business owner" De Angelis himself points to as scammers' favorite target — has no such cushion and depends on its payment provider protecting it well, or on an employee spotting a fraudulent invoice in time. The asymmetry will repeat in any sector as long as defense against AI-enabled fraud remains a corporate luxury rather than a minimum standard of the financial system. In the long run, if these detection tools become cheaper and more widespread — as has happened with other layers of digital security — the result could be an economy with more verification friction but less actual theft, a small step toward the kind of institutional trust needed for the abundance AI promises to also reach those who today sign invoices without the time to check them.