A brief story 

I recently got a call from my bank’s fraud prevention number. Had I opened a new checking account and Zelled someone $1k? Bought an iPhone in socal? No, and no. My heart started pounding. 

"Don't worry, we flagged them," the rep said, and transferred me to dispute the charges. Case numbers were given, and we disabled Zelle "to prevent further fraud." No one asked for any personal info or codes. 

Then, I was asked to confirm with their supervisor - to a Gmail address. "Shouldn't that be a bank email?" “I assure you it is." "Can I call you back to confirm?" They hung up.

I’d spent 15 minutes with impersonators in a multi-part scam! I was embarrassed, impressed, and terrified to think how AI will make these operations even more convincing, at massive scale.

‍

A $150 billion industry scaled by people… until now

The Consumer Federation of America puts the annual cost of fraud at ~$150 billion, a 5x increase since 2020. Most victims don’t report due to feelings of shame or embarrassment - and they do, financial recovery is very difficult.

Most likely to fall for and report a scam: shockingly, the most digitally savvy - Gen Z, Millennials and Gen X, who might fall for a crypto or a job scam. But older adults report losing much more, because they have more wealth, and more to lose.

Impersonation is the most common scam (impersonations include deepfake celebrity endorsement ads, imposter voice calls, spoofed phishing emails and more). A particularly painful version is a long con. A fabricated persona builds trust over weeks of messages, offers to help the victim invest, pays out early returns, entices larger investments, then disappears. We’ve unfortunately seen this first-hand here at Cowboy. Impostors claiming ties to us have lured dozens of older adults into fake crypto funds, taking millions of dollars from retired teachers, farmers and lawyers.

What has constrained the damage till now was labor. Many long cons have been run out of industrial scam compounds where workers (many of them trafficked), are forced to work scamp scripts for hours a day. 

‍

AI makes scamming cheaper, better, and faster 

A convincing scam needs a fluent speaker, research on the target, and hours of patience. AI unlocks those bottlenecks. AI-enabled fraud is estimated to be 4.5x (seems low!) more profitable than human-powered methods, driven by 5 compounding vectors: 

• Crypto and instant transfers like Zelle settle in seconds and are hard to reverse, making it easier for bad actors to escape. For example - crypto enabled a crew posing as Google support to steal $245 million from a single victim.

• Scam infrastructure is productized and sold as a service - including stolen-identity databases, phishing templates, bots to con victims to share one-time passcodes, and software to run a scam operation. Frauds can also be run using open models and AI agents at low cost, high scale.

• AI-powered personalization makes touchpoints convincing across all modalities, increasing scam conversion rates.‍
  
  • Text: In a 2024 study by Harvard researchers, AI-generated spear-phishing emails got a 54% click rate, against 12% for generic phishing and emails written by human experts.
  • ‍Voice: A short clip from social media is now enough to realistically clone a “grandchild” calling for bail money, with personal details to match. A great quiz to see if you can tell real vs voice AI fakes is here, from Jacana.‍
  • Websites: AI has made it easier than ever to quickly manufacture fake websites to con consumers into purchasing goods that don’t exist, and to share payment credentials with criminals.‍
  • Video: In February 2024 a finance employee wired $25 million after a video call with what he thought was his CFO and colleagues. Every face on the call was fake. The same tools produce fake job candidates and landlords showing apartments that don’t exist.

• AI-powered multi-modal campaigns using spoofed emails, texts, calls and forged documents are coordinated over days or months. AI makes it cheap to run thousands of highly personalized, multi-part long-term scams in parallel.

• New attack surfaces (e.g., agents) like personal agents such as Muse and Instinct will spend money on our behalf, and are susceptible to scams. A hidden instruction on a webpage or a convincing fake storefront can trick an agent into a bad purchase or to reveal sensitive information (e.g., credit card numbers). Shared standards like the personal agent protocol will be important to run agents we can trust with sensitive personal information.

‍

Consumers and SMBs are easy targets 

Large enterprises are having a hard time keeping up, but have the resources to invest in employee anti-fraud training, enhanced verification protocols, deepfake detection tools, and security teams & technology. Consumers and SMBs don’t yet have the resources or tools to come close. 

Traditional defenses are weakening as well. Bots are increasingly convincing phone victims to share their SMS two-factor authentication one-time codes. AI-forged IDs, pay stubs and bank statements can also con landlords or lenders who use paper documents as verification.

‍

The time is right for new consumer & SMB security startups

Consumer and SMB security and anti-fraud solutions have historically had tough adoption and market size challenges. Many haven’t bought protection until after an incident, been skeptical of paid products, or settled for free products offered by their laptop, OS, or phone vendor. With AI, four factors could make it more attractive for startups to build solutions, and more important to have independent, trusted 3rd party products for purchase.

• A growing population of wealthier, older targets: People over 70 hold 31% of US household wealth, up from 19% in 1989, and Americans over 60 reported $7.7 billion in losses to the FBI in 2025 - 60% more than the year prior. This vulnerable population has more wealth at stake than ever, and it will be important for them to have better protection.

• Earned media and embarrassment drive word-of-mouth distribution: By now, half of American adults know someone who has lost money to a scam. Many share their stories with family, friends and media, which can lower the cost of customer awareness & adoption, which has been a historical challenge for startups. Word-of-mouth can also grow among local and parent communities.

• Liability shifting to institutions: Push-payment fraud, in which victims are coerced into sending the money themselves, is a common fraud type (22% of cases according to Alloy) in the US and UK. In 2024, UK banks became required by law to reimburse victims up to £85,000 per claim. This isn’t yet the case in the US - victims still bear most of the loss. If that shifts, banks will likely spend to protect consumers, and SMBs should follow.

• The CFPB may be weakened, putting the onus on consumers to get more protection: In contrast, the independent agency charged with enforcing laws and protecting consumers from unfair, predatory or illegal practices has been targeted for shutdown in recent years (despite returning over $21Bn to consumers since its inception). A gutted CFPB means more need for private solutions.

‍

Areas we’re looking to invest in: consumer & SMB scam protection

The same models that make scams cheap should lower the cost to build new defenses. We’re looking for founders building in five areas:

• Multi-modal scam defense: scams are often multi-modal, but most tools judge each message in a silo. Always-on, on-device protection could follow a conversation across channels and step in before any transfer of PII or funds. Customer acquisition channels could include banks, carriers, credit bureaus, employers and insurers, not just direct-to-consumer marketing.

• Pooled scam intelligence and payment interception: Every scam leaves a trail of phone numbers, mule accounts and wallets, split across banks, carriers and platforms. A network could pool signals in real time and flag them in payment flows, pausing a transfer to a bad actor and flagging suspicious accounts before money moves. 

• Agent-ready “secrets” management: Consumers often treat passwords the way engineers once treated API keys: long-lived, reused and shared. There’s opportunity for new password vault solutions that issue single-use card numbers and logins that expire when a task is done. As agents start shopping for us, a vault can also act as a gateway for payment requests.

• Scam-loss protection bundled with detection: As liability for scams shifts, there’s a need for new cyber insurance. We are looking for products that pair coverage for scam losses with the detection that prevents them. 

• Impersonation takedown of impostor accounts and posts: Many cons start with a fake account or deepfake of a real person or brand, including ones using Cowboy’s name. Brand-protection tools for consumers and SMBs are very limited; low cost self-serve tools should exist to find and remove impersonations of a person, family or business before scammers put them to work.

‍

B2B fraud protection is also an area we’re deeply interested in finding new ai-tested solutions for, but that’s for another post.

‍

If you’ve read this far, you can tell - we are very excited to back teams building solutions for the turbo-charged fraud problems that will be created by AI. 

‍

If you’re building a better mousetrap for combatting AI-powered fraud, or have better ideas for what we should be looking for and where - please reach us at aileen@cowboy.vc and rohan@cowboy.vc

‍