AI and Fraud: What CPAs Should Know

A recent article in the Journal of Accountancy says that artificial intelligence technology can be misused for fraud, but it is also a tool accountants can use to detect fraud. Authors Ray Sang and Clay Kniepmann point out that resourceful fraudsters “can now use AI to create convincingly realistic documents and data such as invoices, contracts, reports, spreadsheets and bank statements to support a fraud scheme. The more examples of legitimate documents available for an AI system to evaluate, the higher-quality fake the AI can generate. AI’s capabilities of generating documents — whether for fraudulent or legitimate purposes — are ever-increasing and now represent a dangerous tool in a fraudster’s arsenal.”

Historically, they continue, “these types of schemes required some human intervention or at least hours of programming and planning. AI can perform them with astonishing speed.

In a recent development, they note that criminals have turned to generative adversarial networks (GANs), which use two neural networks; i.e., they are basically two AI systems working in conjunction. “The criminals train one of the networks to generate false information, while the other is designed to detect the false information. They are used to train each other, continually creating better means of evading detection.”

While AI has the potential to support fraudsters, the authors point out that advancements in AI technology also present opportunities for those in fraud prevention and detection professions, such as accountants and finance professionals. According to the authors, some of the ways AI can be used to assist in detecting and preventing fraud include:

Pattern recognition: Data analytics have long been used to detect anomalies, or fraud indicators, in large datasets. AI has the potential to speed up and improve pattern recognition by analyzing massive sets of data quickly. AI and machine learning increase the ability for firms and finance departments to efficiently and effectively detect anomalies.

Risk assessment: AI can be used to evaluate system and process security to identify potential gaps in internal controls. This can be done through a single-factor analysis or a multifactor scoring model, which can locate blind spots in less than a second.

Threat detection: AI can be used to detect and eliminate threats such as malicious code, sometimes even malicious AI code. “Unfortunately, as is usually the case in the fraud space, the ability to detect fraud tends to lag behind the creativity of fraudsters, as it is difficult to detect a scam that has not yet been created. Still, AI tools available should be used to attempt to thwart bad actors.”

Automation: The same way fraudsters are using AI to automate scams can be employed in fraud detection through implementing AI-driven software. In the past, running real-time data analytics was practically and economically impossible. With emerging AI capabilities, these measures can be automated and can be run in a matter of seconds and with little or no supervision or human intervention.

The authors stress that establishing safeguards that address AI risks are the most important countermeasures against misuse. They suggest, among other things:

  • Learn as much as possible about AI technology and its capabilities, both now and what may come in the future. Familiarity will increase your ability to manage AI-aided fraud risks.
  • Verify results that AI produces. The technology isn't perfect. Despite constant improvements, it can get things wrong, particularly when it relies on data that is inherently false or misleading. If AI is used in an official capacity, statements relying on AI results need to be vetted for veracity.
  • Limit and/or control internal company data. AI relies on available data to perform its analysis. Data that cannot be obtained cannot be used against you
  • Establish company- and firm-specific standards of use and development of AI as soon as possible.

The AI landscape is a complex and evolving field, say Sand and Kniepmann, “and one that accounting professionals, particularly forensic accountants, should be conscious of. It is incumbent on those in accounting to be aware of the evolving landscape and to employ this technology in an ethical manner.”