Warren Buffett once said fraud will be the biggest growth industry of all time. He was right, and he didn't even know the half of it. That growth is automated on both sides now. Fraudsters use AI to scale attacks, and agentic AI fraud detection is used to shut them down before anyone's fraud team has to get woken up at 2am. That's why we named this year's SardineCon the Agentic Frontier.
Last year at our first SardineCon, I talked about the "scamdemic," and how scam operations had industrialized to the point where they're propping up a meaningful chunk of GDP in places like Cambodia. So this year I wanted to go deeper and ask “what have we actually seen change in the last 12 months?”
Key takeaways:
- Deepfake fraud detection based on video artifacts is an unwinnable arms race. Every new detector gets bypassed by the next model. Device binding and behavioral biometrics are what actually hold up over time.
- Chained AI agents outperform broad models in fraud detection. Narrow, specialist agents produce better results than one general-purpose agent given a loose SOP given a vague prompt.
- Even fraud prevention companies are targets. When two technical roles were posted, a machine learning engineer and an AI forward deployed engineer, 70 to 80 percent of applicants were fake, tracing to North Korean state actors targeting companies that sit on trade secrets.
- A six-month sanctions screening automation deployment with a bank client reached 99.9 percent agreement between AI and human reviewers. This reduced human oversight from 100 percent to 10 percent without a single missed sanctioned individual.
- The payments foundation model trained on more than one billion transactions treats transaction history like language. The result was a more than 45 percent lift in card fraud detection AUC.
- Universal KYC device binding creates a durable identity unit that eliminates repeat verification on the same device.
- Fraud ML model drift detection, dead rule identification, and chargeback contestation now run on scheduled agents without anyone initiating them.
- AI agent fraud SOP design matters more than the agent itself. Give an agent a vague job and it hallucinates. A narrow, documented set of instructions that mirrors how a human analyst actually makes decisions outperform vague prompts every time.
The fraud is getting stranger
Deepfake quality keeps improving, and not in a slow, gradual way. A few months ago, Matt Vega and I went live on CBS LA and deepfaked the news anchor into Taylor Swift, in real-time, using tools anyone can download. She thought it was hilarious but I think it should worry all of us a little more than it currently does.
Then there's candidate fraud, which caught us off guard even though we're a fraud company. We posted two roles earlier this year, a machine learning engineer and an AI forward deployed engineer (the hottest title in the industry right now), and somewhere around 70 to 80 percent of the applicants we received were fake. A lot of this traces back to North Korean state actors going after crypto companies, banks, and yes, fraud prevention vendors like us, because we all sit on trade secrets they want.
One case still sits with me. A candidate calling himself Frank Crawford went through an entire interview loop with our team. We flagged suspicious signals and declined to move forward. Two weeks later, the real Frank Crawford emailed us to say someone had been impersonating him across a string of job applications. This isn't a handful of state actors anymore, but rather an industrial-scale operation targeting anyone hiring for sensitive roles.
We found something similar with a role based in Estonia, where an applicant showed up on a U.S. IP address. Digging in, that address traced back to the Lazarus Group, and behind it sat a whole ring of fake identities cycling through the same infrastructure.
Why we stopped trusting faces and started trusting devices
The thing about video and voice is that they can be stolen. They live on the public web. Someone can move their face side to side, mimic your voice, and pass a liveness check built five years ago. What can't be stolen is how you actually behave: the way you type, swipe, or hold your phone in your hand are all unique. Those intrinsic behavioral signals are what we build around at Sardine.
That's also why we no longer think a face-move liveness check is sufficient for identity verification. You need strong device binding underneath it. I deepfake people on video calls constantly now, just to make the point. You can build detectors that look for blurriness or shakiness in a video feed, but that’s an unwinnable arms race. The moment you ship a detector, a new model removes the artifact it was looking for.
What actually holds up is asking a different question: is this verification even coming from a real device? Fraudsters inject video into a webcam using virtual cameras, hardware injectors, or mobile emulators, which leave their own fingerprints. A phone lying face down while someone claims to be doing a video selfie leaves a fingerprint too. That's the low-hanging fruit, and unlike video artifacts, it's durable.
We took that logic further with Universal KYC, which is now in beta. Once someone completes real KYC (SSN plus ID verification tied to a specific device), we remember it. Show up again on that same device, and you skip the repeat verification. Identity plus device becomes a single, durable unit instead of something you re-prove every session.
When 250,000 accounts show up in a day
This is the part of the talk I care most about. We had a client get hit with 250,000 account signups in a single day, all built on stolen CIP data (real names, addresses, dates of birth, Social Security numbers) purchased off the black market and routed through proxies that pointed to UAE and Switzerland.
Every fraudster makes a mistake somewhere. Here it was device fingerprint reuse across most of those accounts. That gave us two clean signals: first a true location outside the U.S., and second a heavy fingerprint reuse. We handed that as a prompt to our data analyst AI agent, and it ran the full investigation end to end, surfacing five additional fingerprints with the same pattern.
I remember exactly when this happened. It was a Friday, 6pm, my phone wouldn’t stop ringing. My first instinct was to page my data science team, most of whom are on the East Coast and already offline for the weekend. Instead we ran our agent.
The part I actually enjoyed was watching it handle nuance. Device reuse isn't always fraud. Nursing home residents and families share devices for ordinary reasons. The agent didn't just flag velocity, it worked out which reuse patterns were real fraud and which were nursing homes, and only escalated the former.
You cannot give an agent a vague job
The lesson underneath all of this is that you cannot hand an AI agent a broad SOP and hope for the best. Give it something loose and it starts to hallucinate. What actually works is narrow, specialist agents chained together: one for anomaly detection, one for graph and link analysis, one that writes SQL and runs full investigations, and one that proposes new rules once the others have done their work.
We dogfood this constantly on our own crypto on-ramp, which started as our first product line and now runs its own BSA/AML officer, a Lithuanian license, and a full investigations team. It's also our honeypot. Fraudsters attack it daily, which makes it a good place to test agents before anyone else touches them.
We now schedule these agents the way you'd schedule a cron job. One wakes up daily, compares the last 24 hours of traffic against the trailing 30 days, and flags what's new. Another takes our entire rule library (which, if you've ever run a fraud program, tends to accumulate like layers of bandaids) and tells us which rules are still pulling their weight and which ones are dead code. A third watches for card testing patterns and drafts new rules in response.
I've said this before and I'll say it again: machine learning alone is never enough. If you already know a fraud typology, supervised ML will extrapolate it beautifully and find every lookalike. But if you don't know the pattern yet, ML has nothing to learn from. That's what rules are for, they're your unsupervised layer, catching velocity and heuristic patterns before you have labeled data to train on.
Some of the other things our agents now do without anyone asking:
- Watch every queue on our crypto on-ramp and flag when volume falls off a cliff, whether that's a fraud issue or, in one case, a broken Apple Pay integration
- Monitor risk score distributions for drift
- Review TC40 and chargeback files to catch missed fraud patterns or new typologies we hadn't coded for
- Assess which chargebacks are worth contesting under something like Visa's Compelling Evidence 3.0, checking whether the same device and IP have a real purchase history with the merchant in question
Automating 95 percent of sanctions reviews, without cutting corners
The financial crime side of this is less flashy but arguably a bigger opportunity. Banks tell us up to 30 percent of their operating expense goes to financial crime compliance through sanctions screening, L1 transaction monitoring, EDD and CDD reviews. Most sanctions alerts are false positives, but regulation requires a human look at every single one regardless.
We spent six months with one bank client automating their sanctions clearing review, and I believe this is still the only production example of its kind. The agent reviews the alert and leaves a note explaining why it's a false positive, but a human stays in the loop throughout. We started with 100 percent human review of every AI decision for the first couple of months. That's now down to around 10 percent and still dropping.
The number that matters here is the agreement rate of 99.9 percent between the AI and human reviewers. Seven overturns total, and every one of them was the AI being too conservative, flagging someone as risky that a human cleared. Not once did a sample review turn up a missed sanctioned individual, which is the one metric in this whole program that has to be 100 percent accurate, no exceptions.
We got there by documenting the bank's existing SOP in detail, training the agent to replicate exactly how their analysts made decisions, and then running it in production against human review until agreement was consistent before we ever reduced oversight. We wrote up the full approach in a white paper on deploying AI agents in regulated environments if you want to learn about the mechanics.
Agent or workflow? Ask if the SOP exists
Ryan McCormack, who leads our AI and ML work, frames this as agency versus determinism. It's the first question we ask every bank, fintech, or payment processor we work with: do you have a documented SOP for how your team reviews these cases?
If yes, you probably don't need an agent. A deterministic workflow will get you most of the way there. If no, and honestly this is the more common answer, that's where an AI agent earns its keep, usually alongside a forward deployed engineer.
It's not binary, though. You can start with an agent on a queue that has no SOP, and once token costs start climbing, convert the stable, repeatable parts of what it's doing into a deterministic workflow. That's what Sardine Flow is for internally, something like N8n but purpose-built for fraud and financial crime, chaining deterministic steps together with agents where judgment is still required.
Since we launched our AI agents, more than 300 clients have adopted them, a 2.5x increase since January.
Building a foundation model that speaks payments
The last thing I want to cover is where we're headed. General-purpose LLMs are trained on public data. We have something they don't: 6 billion-plus profiled devices, 440 million-plus consumers, and 3 million-plus businesses, all built alongside our customers over years. Like a lot of industries right now, we've concluded that the next leap isn't a bigger general model, it's a model trained on our specific domain.
Large language models predict the next token in a sequence. Map that onto payments and it gets interesting fast. If I transact at SafePay, then Starbucks, then Chevron, then SafePay again, that's a pattern, almost like words in a sentence. Given my history, you can predict with real confidence what merchant I'll show up at next. If my card gets stolen and someone starts buying from Gucci, that breaks the pattern completely, because Gucci was never going to be my next word.
That's the idea behind the payments foundation model our AI lab built. A model trained on more than a billion transactions, a modest 40 million parameters compared to the frontier models everyone talks about, and it lifted our card fraud detection AUC by more than 45 percent.
One thing worth saying clearly is the foundation model alone isn't enough. We train embeddings, things like "what merchant is this person likely to transact at next," and feed those as features into a standard supervised model. The combination is what moves the needle, not either piece alone.
Where are we taking this next? A language of logins, built from the IP addresses and devices people typically log in from. A language of mouse movements, for catching remote access tools like TeamViewer and AnyDesk that scammers use to control a victim's screen. And a language of counterparties for AML, so that when a restaurant sends a $100,000 invoice payment to an arms parts supplier, the model flags it the way a human analyst would: “that sentence doesn't make sense.”
There's a foundation model for fraudsters too now, in a sense. We've always had to decode their signals by hand. If we can train models to learn their language directly, that changes the pace of this whole fight.
If fraud is going to keep industrializing the way Buffett predicted, the only way any of us sleep through the night is by meeting it at machine speed too.
Frequently asked questions
What is agentic AI fraud detection and how does it differ from traditional machine learning fraud detection?
Agentic AI fraud detection uses narrow, specialist AI agents chained together to investigate fraud rings, propose new rules, and automate review queues. Unlike traditional ML models that extrapolate known fraud patterns from labeled data, agents can investigate novel patterns without prior labels. This makes them effective for new attack types that supervised models have nothing to learn from yet.
Why is deepfake fraud detection moving away from video analysis toward device signals?
Video artifact detection is an arms race. Every time a detector ships, a new model removes the artifact it was looking for. Device signals like virtual camera fingerprints, mobile emulator behavior, and phone orientation during selfie verification are durable because they cannot be spoofed at the same rate. Combining device binding with behavioral biometrics creates an identity unit that holds up where video liveness checks fail.
How does sanctions screening automation maintain accuracy while reducing human review?
The key is starting with 100 percent human review of every AI decision and reducing oversight only as agreement rates become consistent in production. In Sardine's case, a six-month deployment with one bank client reached 99.9 percent agreement between AI and human reviewers before oversight dropped to 10 percent. The one metric that cannot move is missed sanctioned individuals, and no sample review has surfaced one.
What is a payments foundation model and how does it improve fraud detection?
A payments foundation model treats transaction history like language, predicting the next likely merchant in a sequence based on prior behavior. When a transaction breaks that pattern, such as a Gucci purchase from someone whose history contains only grocery stores and gas stations, it flags as anomalous. Trained on more than one billion transactions and 40 million parameters, Sardine's payments foundation model lifted card fraud detection AUC by more than 45 percent when its embeddings were fed as features into a standard supervised model.
