Accounting
AI forgeries launch new phase in anti-fraud arms race
Generative AI has improved to the point where it is now capable of producing fake documents realistic enough to fool automated systems, creating new opportunities for fraud and new challenges for those trying to prevent it.
This new capacity came as part of OpenAI’s
Anti-fraud professionals like Mason Wilder, research director with the Association of Certified Fraud Examiners, believe the issue is not so much the fake documents themselves but the fact that they can now be quickly and easily produced at an industrial scale. He noted that people have been forging documents since time immemorial, however doing so tended to need a lot of time, effort and expertise, which created a high bar for such activities. This meant that even if someone had thought about, say, inflating their expense reports with fake receipts, the effort required to do so was beyond what most were willing to do.
But now people don’t need to edit things in Photoshop or alter text with whiteout. Instead they just need to describe what they need in detail, and an AI model will produce the requested file.
“It opens the door for lazier fraudsters. You don’t even need to be sufficiently motivated or technically sophisticated to carry out a fraud scheme that 5–10 years ago would’ve required some level of technical sophistication and more motivation and time and energy. Now you can just do it in an afternoon pretty easily,” said Wilder.
This is not just a theoretical problem, as AI-generated fakes are already being used in fraud schemes, such as the case of a Singaporean man who faked $16,000 of
While there is widespread agreement this is a problem, there is less when it comes to what exactly to do about it. Some have suggested using metadata to detect AI images, with certain vendors like T&E solutions provider
“When we see that these markers are present, we have really high confidence of high accuracy to identify them as potentially AI-generated receipts,” said Ramp’s Dave Wieseneck in a
David Zweighaft, a partner at forensic accounting firm RSZ Forensic Associates, said professionals in the field might take a similar approach. There are already ways to look at documents for evidence of alteration. While theoretically someone could strip out the metadata, he said that doing so, itself, creates new evidence of alteration.
“We’ve got to move past the 2-d world we live in and look at the metadata, look at any traces that any electronic transactions or electronic modifications might leave. [We] may want to work with the software providers to come up with validation,” he said.
He added that cases like these are exactly why people developed data forensics as a field. While the actual forensic work might be more difficult and complicated when dealing with AI, he felt the overall principles were sound.
“This crisis is not new. Ever since computer-generated information has been used in litigation, it came up. … And that is where data forensics was invented—and that is where all of the legal defense work around data and making sure things were unchanged began. And now you have data validation and MD5, SHA-256, or MD64 hash algorithms to prove something was not changed from its original pristine state on the computer. This is just the latest iteration of that scenario,” added Zweighaft.
Wilder, however, said that in order for data to become a foolproof way of verifying authenticity, there would need to be some sort of widely-adopted industry standard that mandates the inclusion of certain metadata (essentially, a watermark) in AI-generated images that can’t be removed. And even if that happened, he wasn’t sure how sustainable that technique would be in the long run.
“As mainstream, institutional-type software providers agree to incorporate that into their services, there’s still a big issue: a lot of these LLMs and other AI models have been open-sourced at some point in the recent past. That means the underlying code is in the hands of whoever wants it, and they can build on top of it and make their own AI tools. So even if there is industry-wide adoption of some kind of tech standard like that, that is not going to really account for, you know, people who’ve built their own AI models. And there are a lot of really smart bad guys out there,” he said.
While the immediate instinct for many would be to solve this problem with AI, Wilder was skeptical. Automated systems are easy to fool, and even if they’re powered by AI models, AI does not have the best track record when it comes to detecting AI. He pointed to a large number of cases where people put their own work through an AI detection solution only to find the software concluding it was done by computer. Overall, he felt the tools for generation were far outpacing the tools for detection, which makes them a poor choice for detecting AI-generated fakes.
“You’ll have solutions providers telling people in the anti-fraud industry that, like, you can just use AI to solve this problem for you. And I would encourage people to exercise that professional skepticism in those contexts as well, because, you know, with emerging technologies, we’ve seen countless examples of people overstating the capabilities of AI tools. So I would encourage anti-fraud professionals to be really wary of the claims of solutions providers on the detection capabilities of their tools,” said Wilder.
Instead, he felt professionals will need to start leaning on “more old fashioned controls” such as requiring everyone to use company credit cards that can be monitored, retrieving actual financial records versus screenshots (with the employee’s consent), and generally being more diligent in monitoring for anomalies and problematic patterns. He added that most companies can view what people do on their network, and so looking to see if someone’s Internet history literally shows them making the fake receipt can help too. And to account for external fraudsters, he recommended that contracts include a Right to Audit clause that lets them request official bank records from actual financial institutions to corroborate expenses.
Todd McDonald, founder and CEO of financial intelligent software provider Valid8, however, felt that AI and automated systems must be part of the solution, even if it’s not as one generally imagines them. Recalling an exhaustive investigation into a Ponzi scheme that was done fully manually, he felt stepping away from automation was a bad idea.
“Having to recreate the books and records for a Ponzi scheme, where there weren’t tools like the ones we’ve now built to validate things—at that time, we had to spend thousands of hours recreating the books and records from subpoenaed bank records—hundreds of thousands of transactions, over 12 years, across 20 entities. That was all manual, and it did not require the best of our skills and training. It was an unbelievably burdensome effort. We had to identify what had happened before we could even move on to what we could do about it. I didn’t have that luxury. I had to go through months of painstaking work just to get a data set I could trust before I could interrogate it and understand it,” he said.
So while asking an AI “is this AI?” may not yield good results, this is far from the only option. Valid8 doesn’t look at a picture of a receipt and determine whether or not it is real but, rather, pulls actual records like bank and credit card statements or copies of deposit slips and checks, and uses that to verify discrepancies or duplications. This in mind, he himself is unconcerned with the AI’s ability to fake documentation, as his company concerns itself with the actual data.
“It really comes back to the provenance of where you are getting the support for this documentation. At Valid8, we come with a specific point of view: bank statements don’t lie. They are a fundamental ground source of truth… There’s nothing immediate we’ve done as a result of the announcement or some of the new tech that is out there. It hasn’t changed things one bit from our roadmap to expand from using bank support evidence as a ground truth and being able to augment and enhance that with additional supporting documentation,” he said.
However, he also noted that technology is only part of the solution. Having “highly trained humans” to actually interpret the data and understand the context is vital, as is training those humans to exercise professional skepticism and compliance, and checking to make sure those lessons were absorbed. There is still value in the old fashioned controls to which Wilder referred.
“You should be setting up a culture of compliance, a clear and outlined code of conduct for what the expectations are regarding expense reports. You should set up a random audit methodology, and employees should know there are consequences for that. This is just good old blocking and tackling—someone is paying attention,” he said.
George Barham, director of standards and professional guidance with the Institute for Internal Auditors, raised a similar point in that while it is unlikely people will step away from automated systems, they do need to be taught to take the outputs with a grain of salt and not blindly trust what the AI tells them.
“I think the main thing is not completely relying on what the tools give you and being critical and looking at the results and asking questions or looking for trends. ‘gosh this cost really jumped over this year, what is going on?’ I also think if you look at a large number of items, it is still a good idea to take a couple and look at those annually so that won’t be a departure from how internal audits look at things, but I think you take what tech provides and what AI provides with a grain of salt,” he said.
However, Barham was hesitant on any specific prescriptions for action, as every company is different and has different goals. So rather than outline what controls should be implemented in response to AI forgeries, he instead said it’s important that professionals sit down with managers and discuss what controls specific to the organization might be needed.
“The biggest thing is making sure we’re having conversations … with management. Hopefully, they will do an annual risk assessment and maybe a quarterly mini-assessment. But you’d like to see some actions taking place from a risk assessment. So maybe that means adding or improving some of the controls in this elevated risk area. That could include more policies, more procedures, more controls, more reviews, more authentication methods when looking at receipts and understanding the source. So it falls to how the organization understands risk,” he said.
The Financial Accounting Standards Board met this week to discuss its projects on accounting for transfers of cryptocurrency assets and enhancing the disclosures around certain digital assets, such as stablecoins.
Processing Content
During Wednesday’s meeting, FASB’s board made certain tentative decisions, according to a
At a future meeting, the board plans to consider clarifying the derecognition guidance for crypto transfer arrangements to assess whether the control of a crypto asset has been transferred.
FASB also began deliberations on the
The board decided to provide illustrative examples in Topic 230, Statement of Cash Flows, to clarify whether certain digital assets such as stablecoins can meet the definition of cash equivalents. It also decided to include the following concepts in the illustrative examples:
- Interpretive explanations that link to the current cash equivalents definition;
- The amount and composition of reserve assets; and,
- The nature of qualifying on-demand, contractual cash redemption rights directly with the issuer.
FASB plans to clarify that an entity should consider compliance with relevant laws and regulations when it’s creating a policy concerning which assets that satisfy the Master Glossary definition of the term “cash equivalents“ will be treated as cash equivalents.
“I agree with the staff suggestion to look at examples,” said FASB vice chair Hillary Salo. “From my perspective, I think that is going to help level the playing field. People have been making reasonable judgments. I agree with that. And I think that this is really going to help show those goalposts or guardrails of what types of stablecoins would be in the scope of cash equivalents, and which ones would not be in the scope of cash equivalents. I certainly appreciate that approach, and I think it has the least potential impact of unintended consequences, because I do agree with my fellow board members that we shouldn’t be changing the definition of cash equivalents, and it’s a high bar to get into the cash equivalent definition.”
“I’m definitely supportive of not changing the definition of cash equivalents,” said FASB chair Richard Jones. “I believe that’s settled GAAP in a way, and we’re not really seeing a call to change it for broader issues. I am supportive of the example-based approach. The challenge with examples, though, is everybody’s going to want their exact pattern, but that’s not what we’re doing.”
The examples will explain the rationale for how digital assets such as stablecoins do or do not qualify as cash equivalents and give a roadmap for other types of digital assets with varying fact patterns to be able to apply.
“We really don’t want to be as a board facing a situation where something was a cash equivalent and then no longer is at a later date,” said Jones. “That’s not good for anyone, so keeping it as a high bar with certain rigid criteria, I think, is fine.”
Stablecoins are supposed to be pegged to fiat currencies such as U.S. dollars and thus provide more stability to investors. “In my view, while a stablecoin may meet the accounting definition established for cash equivalents, not every one of those stablecoins in the cash equivalent classification represents the same level of risk,” said FASB member Joyce Joseph.
She noted that the capital markets recognize the distinctions and have established a Stablecoin Stability Assessment Framework to evaluate a stablecoin’s ability to maintain its peg to a fiat currency. Such assessments look at the legal and regulatory framework associated with the stablecoin, and provide investors with information that could enable them to do forward-looking assessments about the stability of the stablecoin.
“However, for an investor to consider and utilize such information for a company analysis the financial statement disclosures would need to include information about the stablecoin itself,” Joseph added. “In outreach, the staff learned that investors supported classifying certain stablecoins as cash equivalents when transparent information is available about the entities at which the reserve assets are held. Therefore, in my view, taking all of this into consideration a relevant and informative company disclosure would include providing investors with the name of the stablecoin and the amount of the stablecoin that is classified as a cash equivalent, so investors can independently assess the liquidity risks more meaningfully and more comprehensively by utilizing broader information that is available in the capital markets and its emerging information.”
Such information could include the issuer, reserves, governance and management, she noted, so investors would get a more holistic look at the risks that holding the stablecoin would entail for a given company.
The board decided to require all entities to disclose the significant classes and related amounts of cash equivalents on an annual basis for each period that a statement of financial position is presented.
Entities should apply the amendments related to the classification of certain digital assets as cash equivalents on a modified prospective basis as of the beginning of the annual reporting period in the year of adoption.
FASB decided that entities should apply the amendments related to the disclosure of the significant classes and amounts of cash equivalents on a prospective basis as of the date of the most recent statement of financial position presented in the period of adoption.
The board will allow early adoption in both interim and annual reporting periods in which financial statements have not been issued or made available for issuance.
FASB also decided to permit entities to adopt the amendments to be illustrated in the examples related to the classification of certain digital assets as cash equivalents without the need to perform a preferability assessment as described in Topic 250, Accounting Changes and Error Corrections.
The board directed the staff to draft a proposed accounting standards update to be voted on by written ballot. The proposed update will have a 90-day comment period.
Senators introduced several pieces of tax-related legislation this week, including measures aimed at improving customer service at the Internal Revenue Service, cracking down on tax evasion and curbing the carried interest tax break, in addition to efforts in the House to repeal the Corporate Transparency Act.
Processing Content
Senators Bill Cassidy, R-Louisiana, and Mark Warner, D-Virginia, teamed up on introducing a bipartisan bill, the
The bill would establish a dashboard to inform taxpayers of backlogs and wait times; expand electronic access to information and refunds; expand callback technology and online accounts; and inform individuals facing economic hardship about collection alternatives.
“Taxpayers deserve a simple, stress-free experience when dealing with the IRS,” Cassidy said in a statement Wednesday. “This bill makes the process quicker and easier for taxpayers to get the information they need.”
He also mentioned the bill during a
“I’m happy to meet with the team … and do all I can to make it as good as you want it to be,” said Bisignano.
“My bill would equip the IRS with the legislative mandate to create an online dashboard so that taxpayers can monitor average call wait time and budget time accordingly,” said Cassidy. He noted that the bill would allow a callback for taxpayers that might need to wait longer than five minutes to speak to a representative, and establish a program to identify and support taxpayers struggling to make ends meet by providing information about alternative payment methods, such as installments, partial payments and offers in compromise.
“I know people are kind of desperate and don’t know where to turn for cash, so I think this could really ease anxiety,” he added. “This legislation is bipartisan and is likely to pass this Congress.”
Cassidy and Warner
“Taxpayers shouldn’t have to jump through hoops to get basic answers from the IRS — and in the last year, those challenges have only gotten worse,” Warner said in a statement. “I am glad to reintroduce this bipartisan legislation on Tax Day to ease some of this frustration by increasing clear communication and making IRS resources more readily available.”
Stop CHEATERS Act
Also on Tax Day, a group of Senate Democrats and an independent who usually caucuses with Democrats teamed up to introduce the Stop Corporations and High Earners from Avoiding Taxes and Enforce the Rules Strictly (Stop CHEATERS) Act.
Senate Finance Committee ranking member Ron Wyden, D-Oregon, joined with Senators Angus King, I-Maine, Elizabeth Warren, D-Massachusetts, Tim Kaine, D-Virginia, and Sheldon Whitehouse, D-Rhode Island. The bill would provide additional funding for the IRS to strengthen and expand tax collection services and systems and crack down on tax cheating by the wealthy.
“Wealthy tax cheats and scofflaw corporations are stealing billions and billions from the American people by refusing to pay what they legally owe, and far too many of them are getting a free pass because Republicans gutted the enforcement capacity of the IRS,” Wyden said in a statement. “A rich tax cheat who shelters mountains of cash among a web of shell companies and passthroughs is likelier to be struck by lightning than face an IRS audit, and Republicans want to keep it that way. This bill is about making sure the IRS has the resources it needs to go after wealthy tax cheats while improving customer service for the vast majority of American taxpayers who follow the law every year.”
Earlier this week. Wyden also
The Stop CHEATERS Act would provide the IRS with additional funding for tax enforcement focused upon high-income tax evasion, technology operations support, systems modernization, and taxpayer services like free tax-payer assistance.
“As Congress seeks ways to fund much-needed policy priorities and address our growing national debt, there is one common sense solution that should have unanimous bipartisan support: let’s enforce the tax laws already on the books,” said King in a statement. “Our legislation will make sure the IRS has the resources it needs to confront the gap between taxes owed and taxes paid – while ensuring that our tax enforcement professionals are focused on the high-income earners who account for the most tax evasion. This is a serious problem with an easy solution; let’s pass this legislation and make sure every American pays what they owe in taxes.”
Carried interest
Wyden, King and Whitehouse also teamed up on another bill Thursday to close the carried interest tax break for hedge fund managers that
Carried interest is a form of compensation received by a fund manager in exchange for investment management services, according to a
Under the bill, the
“Our tax code is rigged to favor ultra-wealthy investors who know how to game the system to dodge paying a fair share, and there is no better example of how it works in practice than the carried interest loophole,” Wyden said in a statement. “For several decades now we’ve had a tax system that rewards the accumulation of wealth by the rich while punishing middle-class wage earners, and the effect of that system has been the strangulation of prosperity and opportunity for everybody but the ultra-wealthy. There are a lot of problems to fix to restore fairness and common sense to our tax code, and closing the carried interest loophole is a great place to start.”
Repealing Corporate Transparency Act
The House Financial Services Committee is also planning to markup a bill next Tuesday that would fully repeal the Corporate Transparency Act, which has already been significantly
If enacted, the repeal would eliminate beneficial ownership reporting requirements, removing a transparency measure designed to help law enforcement and national security officials identify who is behind U.S. companies.
“This repeal would turn the United States back into one of the easiest places in the world to set up anonymous shell companies, something Congress worked for years to fix,” said Erica Hanichak, deputy director of the FACT Coalition, in a statement. “These entities are routinely used to facilitate corruption, financial crime, and abuse. Rolling back the CTA doesn’t just weaken transparency, it signals to bad actors around the world that the U.S. is once again open for illicit business.”
The Internal Revenue Service rarely penalizes taxpayers who have high balances in foreign bank accounts and fail to file the proper forms, according to a new report.
Processing Content
The
Taxpayers with specified foreign financial assets that meet a certain dollar threshold are also required to report the information to the IRS by filing Form 8938. Failure to file the form can result in penalties of up to $60,000. However, TIGTA’s previous reports have demonstrated that the IRS rarely enforces these penalties.
The IRS created an Offshore Private Banking Campaign initiative to address tax noncompliance related to taxpayers’ failure to file Form 8938 and information reporting associated with offshore banking accounts, but it’s had limited success.
Even though the initiative identified hundreds of individual taxpayers with significant foreign bank account deposits who failed to file Forms 8938, the campaign only resulted in relatively few taxpayer examinations and a small number of nonfiling penalties. The campaign identified 405 taxpayers with significant foreign account balances who appeared to be noncompliant with their FATCA reporting requirements.
The IRS used two ways to address the 405 noncompliant taxpayers: referral for examinations and the issuance of letters to them.
- 164 taxpayers (who had an average unreported foreign account balance of $1.3 billion) were referred for possible examination, but only 12 of the 164 were examined, with five having $39.7 million in additional tax and $80,000 in penalties assessed.
- 241 noncompliant taxpayers (who had an average unreported account balance of $377 million) received a combination of 225 educational letters (requiring no response from the taxpayers) and 16 soft letters (requiring taxpayers to respond). None of the 241 taxpayers were assessed the initial $10,000 FATCA nonfiling penalty.
“While taxpayers can hold offshore banking accounts for a number of legitimate reasons, some taxpayers have also used them to hide income and evade taxes,” said the report.
Significant assets and income are factors considered by the IRS when assessing whether taxpayers intentionally evaded their tax responsibilities, the report noted. Given the large size of the average unreported foreign account balances, these taxpayers probably have higher levels of sophistication and an awareness of their obligation to comply with the law.
TIGTA believes the IRS needs to establish specific performance measures to determine the effectiveness of the FATCA program. “If the IRS does not plan to enforce the FATCA provisions even where obvious noncompliance is identified, it should at least quantify the enforcement impact of its efforts,” said the report. “This will ensure that IRS decision makers have the information they need to determine if the FATCA program is worth the investment and improves taxpayer compliance.
TIGTA made three recommendations in the report, including revising Campaign 896 processes to include assessing FATCA failure to file penalties; assessing the viability of using Form 1099 data to identify Form 8938 nonfilers; and implementing additional performance measures to give decision makers comprehensive information about the effectiveness of the FATCA program. The IRS disagreed with two of TIGTA’s recommendations and partially agreed with the remaining recommendation. IRS officials didn’t agree to assess penalties in Campaign 896 or with implementing performance measures to assess the effectiveness of the FATCA program.
“From our perspective, TIGTA’s conclusions regarding IRS Campaign 896 are based, in part, on a misguided premise and overgeneralizations, including the treatment of ‘potential noncompliance’ as tantamount to ‘egregious noncompliance’ that warrants a monetary penalty without contemplating the variety of justifications that may exempt a taxpayer from having to file Form 8938,” wrote Mabeline Baldwin, acting commissioner of the IRS’s Large Business and International Division, in response to the report.
What that means for consumer loans
Checks and Balance newsletter: Of God and MAGA
Why software stocks, 2026’s market dogs, have joined the rally
Armanino adds Strategic Accounting Outsourced Solutions
New 2023 K-1 instructions stir the CAMT pot for partnerships and corporations
