The Problem

As it did with the advent of the internet, criminals are now using AI to support their activities. With its help they can create more convincing deepfakes, voice clones, synthetic identities, official documents and fake profiles, which are making it increasingly difficult to authenticate information.  We have come across a number of examples including our clients’ being provided with fake bank statements, websites and company documents.

The Risk

The risk to companies is greater than ever, as the speed, type and number of scam and fraudulent approaches has increased dramatically. Fraudsters, with the help of AI and other sources, can now create apparently legitimate individuals, businesses and relationships, building complex structures, profiles and backgrounds to convince companies of their authenticity. Sophisticated fraudsters seek to establish credibility and relationships before attempting the actual fraud.

The Investigative Challenge

How do you distinguish genuine information from manufactured information?

AI can be a very useful part of a verification process, but an AI detector’s “real” or “fake” answer should never be treated as proof. The evidence supports this caution: NIST currently reports that deepfake-detection systems can lose 45–50% of their performance when moving from academic testing to operational deployment.[1]

NIST is the US National Institute of Standards and Technology, part of the US Department of Commerce. As part of its remit it runs the NIST AI Challenge Problems, which conduct community evaluations to advance safe and trustworthy AI.[ Meanwhile, the technology that generates convincing fakes continues to improve, making the detectors’ task harder. (https://www.nist.gov/about-nist; https://ai-challenges.nist.gov/ )

Verification

It is incumbent on the party concerned to check the veracity of any information provided as part of a business deal, relationship or similar.

For example, when checking the veracity of a document, AI can assist in looking for suspicious characteristics (such as spelling, grammar, fonts and logos), but you should not rely on AI alone to authenticate its appearance.  An investigator will independently verify the document by contacting the organisation it came from, using contact details found independently (i.e. not from the document provided).   This is just one example; a later newsletter will examine other verification methods in more detail.

Conclusion

AI does not eliminate the need for investigators. In fact it may make professional investigation more important. In an environment where information can be manufactured, almost instantly, the value increasingly lies not simply in finding information but in determining whether it can be trusted.

If you are unsure about the authenticity of a counterparty, document or approach, please get in touch.

We have started to explore and trial the use of Artificial Intelligence in some of our investigative research projects. Whilst it has its benefits in the speed and sheer volume of the internet it covers it does have its limitations, particularly in jurisdictions where there are limited public records or information that is held behind a paywall.

Therefore, we continue to develop and work with on the ground sources who have direct access to the relevant registries and also good local knowledge of what information is/is not available and provide essential context. We also recognise human sources are vital for providing comment/opinions on a subject’s reputation and perceived integrity.

However, from our experience of using it and attending workshops/conferences it will be only as good as its user i.e. how you interrogate and question it to recover the information you need. Therefore, currently AI cannot replace an experienced analyst/investigator but rather it should be considered as another tool to support any investigative projects.

Cyberattacks regularly make headlines in the news. These crimes affect high-profile businesses including retailers, banks as well as individuals. Ian Stuart, until recently the head of the UK arm of HSBC, announced that the bank is “being attacked all the time” by online criminals, with cybersecurity now its biggest expense, costing the lender hundreds of millions of pounds.

The National Crime Agency states that cyberattacks are financially devastating and disrupting to both people and businesses. They undermine the economic stability of the UK and cost the UK economy millions of pounds each year.

Not all cyberattacks are financially motivated. Some are for espionage, and/or operational disruption motives. On 19th January 2026 the UK’s National Cyber Security Centre (NCSC) – a part of GCHQ – warned of Russian aligned ‘hacktivist’ groups continuing to target UK organisations with disruptive cyberattacks.

In addition to using AI to carry out cyberattacks, the use of AI technology connected to company systems, data, and operational technology for tasks leaves any company or organisation using AI technology at risk. It is therefore crucial for any organisation to maintain up-to-date cyber security measures on their AI systems and their dependencies. Whilst AI offers great potential for efficiency and creativity, organisations are strongly encouraged to follow the NCSC’s guidance on deploying AI tools securely, and to protect themselves from cyber threats. In addition the NCSC has developed a minimum standard of cyber security called Cyber Essentials. The self-certification scheme is aligned to five technical controls designed to prevent the most common internet based cyber security threats.