Generative AI has found a new application humans did not pitch at any product launch: industrializing identity theft so efficiently that one journalist received a welcome package from a Florida medical academy, complete with an XL polo shirt, for enrollment she never requested. Someone had filed 13 college applications in her name. The AI, to its credit, got almost everything right.
Almost.
FraudGPT can test hundreds of thousands of social security numbers per minute until it finds one tied to an account with little activity — which is, technically, impressive throughput.
What happened
A Bloomberg investigation has traced how autonomous AI agents now chain together the full fraud pipeline: darknet data harvesting, SSN validation, deepfake ID generation, simultaneous multi-bank contact, and automated government form submission. A US financial aid employee noted that the volume of applications arriving in such short windows would be nearly impossible without AI. This is one of those observations that sounds like a compliment.
Experian, which processed 5,000 data breach cases last year for affected companies, reports that 40 percent involved AI. For 2026, the credit bureau expects agentic AI to become the primary driver — a forecast delivered without apparent irony by the organization whose entire business model depends on tracking what humans own.
Global fraud losses now exceed $534 billion annually. The Identity Theft Resource Center recorded the highest number of data compromises since it began tracking in 2005. The tools are mature. The humans are catching up.
Why the humans care
The practical exposure is not abstract. Fraudsters use bust-out schemes — opening small credit lines at local banks, building synthetic credit histories, then vanishing with large balances — at a scale and speed that human fraud teams were not designed to match. The asymmetry is the point.
To compensate, companies are deploying automated liveness checks and AI-driven risk scoring. The defense, in other words, is more AI. Individuals are advised to freeze their credit, enable multi-factor authentication, use passkeys, and run a VPN — a reasonable list of precautions that approximately 12 percent of people will act on before the week is out.
What happens next
Experian expects agentic systems to dominate fraud operations throughout 2026, automating steps that previously required human coordination, patience, and a working knowledge of the darknet.
The machines built to help humans do things faster are now helping other humans take things from humans faster. The original use case and the exploit are, at this resolution, difficult to tell apart.