Generative AI lets criminals create fake employees with real credentials to access bank systems. A DOJ case hit 100 companies. Over 1 million bank accounts were compromised by infostealers in 2025.
The account is real. The credentials are real. The employee is not.
Synthetic insiders use stolen identities, deepfake technology and remotely controlled devices to get hired, pass background checks and log in through approved accounts. The access looks legitimate because it is legitimate. The person operating it is not who the company believes it hired.
Generative AI makes that impersonation possible at scale. It has lowered the cost of building a fake employee identity to near zero. Artificial intelligence tools now deliver convincing video interview performances and fabricate government-issued IDs. The same technology generates fake resumes, portfolio websites and writing samples that back up a fabricated work history, Cloudflare reported in its 2026 Threat Report.
A Department of Justice case in April 2026 showed what that looks like at scale. Two U.S. residents were sentenced for running operations that placed fraudulent workers inside more than 100 U.S. companies using the stolen identities of more than 80 Americans, generating more than $5 million for the North Korean government, TechCrunch reported. DOJ's announcement does not specify whether the scheme triggered internal security alerts at the affected companies.
The immediate risk from synthetic insiders in financial services is not a fraudulent wire transfer. It is access to the systems that make wire transfers possible. A worker with approved access can reach fraud detection models, payment flow architectures, customer records, pricing data, merchant information and internal controls. That information does not trigger an alert when it is read. It gets copied and studied over months before anything visible happens.
Kaspersky found in an April 2026 report that more than 1 million banking accounts at the world's 100 largest banks were compromised by infostealers in 2025. Of those stolen payment card numbers, 74% remained valid as of March 2026. The shelf life of stolen identity data extends months past the breach.
That shelf life matters most when the access came from inside the company. Internal actors appeared in 12% of confirmed breaches analyzed in Verizon's 2026 Data Breach Investigations Report, which covered more than 22,000 confirmed breaches across 145 countries. That figure is down from 18% the prior year. The decline reflects overall insider-breach frequency, not the sophistication of synthetic-insider schemes specifically, which are not broken out separately in the report. Insider incidents are damaging because of dwell time. Frequency alone does not capture the risk. Access that looks legitimate at every layer does not trigger the controls built to detect illegitimate access. By the time the activity is flagged, the information has often already left.
A valid login used to mean a verified employee. Synthetic insider schemes answer the login check correctly while the threat operates behind it. Cloudflare's 2026 Threat Report found that traditional background checks and standard identity verification are struggling to keep pace with attackers who have adapted to pass them. Remote administration tools such as AnyDesk and TeamViewer let operators run company-issued devices from overseas, a tactic Skadden reported in a June 2026 publication as a hallmark of these schemes.
The verification gap is not confined to hiring. Outdated identity controls are costing businesses nearly $100 billion annually in fraud, according to PYMNTS Intelligence research conducted with Trulioo. Nearly 90% of enterprises said bot management is now a major challenge. That research measures bot traffic and AI agent activity in digital commerce rather than fraudulent hiring specifically. It points to the same underlying gap: identity controls built to verify humans are not built to verify what is operating behind a login.
The controls being deployed to address synthetic insiders go beyond checking whether a login is valid. They monitor behavioral signals: whether the working hours, location data and activity patterns of the person operating a device match the profile of the employee who was hired. The attack surface is the gap between the identity that was verified and the person now sitting behind it.
Drafted by a large language model from the source reporting linked above, then screened by automated publishing checks. It is not read by a journalist before publication. Some articles cite our Alpha Score. Verify prices and figures against the original source. Educational coverage, not personalized advice.