Americans reported losing about $16 billion to fraud in 2025. That is the highest figure the Federal Trade Commission has ever recorded, up roughly 25 percent in a single year and more than four times what people reported in 2020. And that's just the people who filed a report.
The FTC told Congress this spring that the true cost runs far higher, because most victims never tell anyone.
I’ve spent a long time inside fraud programs at financial institutions, fintechs, and travel and hospitality companies, and the number that should worry an executive isn't the one reported by the FTC.
It’s the one nobody on your executive team has likely calculated: your total exposure, prevented and unprevented, the good customers you’ve turned away, the customers who have left, and the true operational cost of managing the "loss line" number. If you’ve never seen that figure for your business, you aren’t managing fraud; you’re absorbing it.
The unfortunate part is that companies aren’t losing to fraud because the criminals are brilliant. They’re losing because the company was never built to fight back.
Why Fraud Gets Overlooked
Start with incentives. Executives are incentivized to pursue revenue and margin. A dollar spent on a new revenue stream is much more likely to satisfy analysts and shareholders than pursuing the reduction of an already approved loss budget.
Then look at who owns it. Twenty-five years ago, corporate America decided cybersecurity was a critical vulnerability and responded with C-level titles, federal czars, industry frameworks, and frequently updated regulation.
...
Anti money laundering followed the same path, funded not because it helps earnings but because the fines exceed the cost of compliance. Fraud has received none of that. No mandated owner; rarely are there examiners looking over their shoulder. As such, it competes for budget, viewed simply as a cost center, and usually loses.
The result is a function held responsible for losses it was never given the authority to prevent. In more than 80 percent of the companies I’ve worked with, the fraud team already knew the weaknesses. However, the fix belonged to product or IT teams, who had their own targets, so the loss arrived anyway and got booked back to the fraud organization, with little to no accountability borne by the teams that implemented the fraud prone product.
Cyber solved this a decade ago with "security by design," ensuring all new products were built cyber resilient from the ground up. Fraud, however, is often overlooked until after the product is ready to ship.
And that was before generative AI. It’s worse now. Deepfakes accounted for one in five biometric fraud attempts last year, and deepfake selfies used in identity verification rose 58 percent, according to Entrust’s 2026 Identity Fraud Report.
The AI Agent Challenge
Now add agents. Soon, a real share of your customers won’t visit your website or call your contact center. Their AI assistant will. It will book the flights, dispute charges, change addresses, and move money because the customer told it to. Or because the customer said something vague and it went rogue and improvised. Or because someone else took control of it.
Customers don’t know how to control these things. Most people couldn’t tell you what their assistant is allowed to do, what it did last Tuesday, or how to switch it off.
Companies are in no better shape. Confirming that an agent is authorized by a customer is not the same as confirming that the customer authorized a particular action, and neither can be reliably determined in today’s environments. When an agent does something unexpected, who’s on the hook? The customer who delegated, the company that accepted the instruction, or the vendor that built the agent? Nobody has written that down, and the fraudsters will find the gap before the lawyers do.
Regulation will arrive eventually. Companies that wait for it will spend the years in between paying for fraud three times: once in losses, again in operational expense, and yet again in the customers who lose trust and quietly leave.
Fraud as a Growth Asset
The better reason to act now is that a strong fraud program is a growth asset, not just a defense. Precise detection approves more good customers, cuts false declines, and streamlines onboarding. Paying to bring a customer to the door and then refusing to let them in isn’t caution; it’s acquisition spend thrown away.
Trust compounds from there. Customers who feel protected stay longer, bring more of their business to you, and recommend you to others. Customers who are defrauded or wrongly declined tend to leave, and each one who churns is more difficult to replace.
A company that can tell a customer honestly what happened and what it’s doing about it can turn a fraud event into a retention opportunity instead of an attrition event.
That is the case for funding fraud management as a sustained investment rather than a line to be trimmed every budget cycle. In practice, it means moving fraud out of the operations cost line and into enterprise risk: a named owner, a defined risk appetite, a seat at the table when products get designed, and a share of losses charged to every department that contributes to them.
It means testing your own controls the way an attacker would, before an attacker does it for you. And it means measuring the program on what it enables, including approval rates, retention, and customer lifetime value, not only on the losses it prevents.
Companies that keep treating fraud as a tax will keep paying it. The ones that build fraud management into how they earn and keep customer trust get to set the terms.
Brent Whittington is managing director of Anti Fraud Advisors, which advises companies on fraud and cybersecurity investments; all opinions are the author’s own.