Receipts, Please

Receipts, Please · Part V of V

Every high-value instruction should carry its own proof, at runtime, or it should not execute. The final part counts the counterfeit economy honestly, returns to Bayonne, and ends with three controls any finance team can adopt on Monday.

I. How I Counted This

A brief, unfashionable interlude on numbers, because fraud statistics are themselves a small fraud economy: alarming percentages are minted by firms that sell detection, projections are quoted as measurements, and global totals for all fraud are placed beside narrow totals for one technique until the reader feels informed and is, in fact, merely frightened. Frightened readers do not make better controls. So here is how I counted this, on the page, where you can argue with it.

Official counts. reported losses to bodies like the FBI’s Internet Crime Complaint Center (IC3) and the US Federal Trade Commission. Real, dated, and understated: every official source acknowledges under-reporting.
Vendor telemetry. what a security firm’s own sensors saw. Useful for direction, never neutral: the firm sells the cure for the trend it reports.
Projections. modelled futures. Legitimate, if labelled every single time. Illegitimate the moment the label falls off in a headline.

With those labels fixed, the scale is sobering enough without embellishment. The FBI IC3’s 2025 annual report, published in April 2026, recorded 1,008,597 complaints and $20.9 billion in losses, up 26 per cent on 2024’s $16.6 billion. For the first time, IC3 gave artificial intelligence a descriptor of its own: 22,364 complaints mentioning AI, with $893 million in losses. Secondary analyses of that report break out more than $30 million in AI-enabled business email compromise and more than $5 million in voice cloning; I flag those sub-figures as secondary, to be checked against the IC3 PDF itself before anyone builds a budget on them, but the headline (AI is now counted, officially, as its own category) is the historic fact. A threat gets a category when it can no longer be treated as a flavour of something else.

Business email compromise, AI or not, remains one of the costliest categories in that same report: 24,768 complaints and $3.05 billion in 2025, the second-costliest crime type behind investment fraud. An FBI public service announcement in September 2024 called BEC “the $55 billion scam”: a ten-year cumulative global figure, not an annual one, and I note the distinction because this genre of writing routinely loses it. The FTC’s Consumer Sentinel put consumer fraud at $12.5 billion in 2024, up 25 per cent, with imposter scams the most reported category. INTERPOL’s Global Financial Fraud Threat Assessment of March 2026 put global financial-fraud losses at $442 billion in 2025 (a figure the report attributes to the Global Anti-Scam Alliance, so cite it as INTERPOL citing GASA) and assessed AI-enhanced fraud as markedly more profitable than traditional methods, with agentic AI now able, in its assessment, to plan and execute complete fraud campaigns autonomously. Singapore, small and highly digital, lost S$913.1 million to scams in 2025 across 37,308 cases, on INTERPOL’s Asia-Pacific assessment reported by The Straits Times. These are not the same measurement wearing different clothes. They are different instruments pointing, unanimously, in one direction.

Now the projections and the telemetry, in their labelled places. Deloitte’s Center for Financial Services projected in May 2024 that US generative-AI-enabled fraud would rise from $12.3 billion in 2023 to $40 billion by 2027. That is a model, not a measurement; it may prove conservative or extravagant, and this series cites it only as a projection. Europol’s Internet Organised Crime Threat Assessment in June 2025 projected some eight million deepfakes shared online in 2025, against roughly half a million in 2023, and identified AI, encryption and crypto-assets as the three accelerants. Pindrop, a voice-security vendor analysing 1.2 billion calls for its June 2025 report, reported deepfake fraud attempts rising some 1,300 per cent in 2024: directionally striking, commercially interested, both at once. Sumsub, an identity vendor, put deepfakes at 11 per cent of global fraudulent activity in its 2025–26 report, up from 7 per cent. Read the vendors for velocity, the officials for scale, the modellers for scenarios, and never, ever place Deloitte’s $40 billion American projection and INTERPOL’s $442 billion global estimate in one sentence as if they measured the same thing.

II. Voices, Faces, Documents

What is being counterfeited, concretely? Three things, and a finance function needs a different control for each. Voices: a few minutes of public audio (an earnings call, a conference talk, a podcast) now suffice to clone a chief executive well enough to instruct a subordinate by phone or voice note, as the heads of WPP, LastPass and Wiz all discovered in attempted frauds in 2024, and as a UK energy firm discovered to its cost as early as 2019, losing €220,000 to a cloned parent-company chief executive in under an hour, on the widely reported account first published by the Wall Street Journal. Faces: live or recorded video personae convincing enough to sustain a multi-participant meeting, which is the Arup and Singapore 2025 pattern. Documents: FinCEN, the US financial-crimes authority, warned in Alert FIN-2024-Alert004 of November 2024 that criminals were using deepfake media to create and alter identity documents that defeat verification, then using the resulting accounts to receive and move the proceeds of other frauds: it even created a filing term for it, FIN-2024-DEEPFAKEFRAUD. I searched, with my researchers, for a single named, dated, AI-enabled invoice-fraud or document-forgery case with a verified amount to set beside Arup, and did not find one that met the standard I am applying elsewhere in this series. That gap is worth stating plainly. The typology is officially established. The emblematic case has either not happened in public, or has not been disclosed. Do not let a vendor invent it for you.

Underneath the categories sits a simpler economic fact. Counterfeiting identity used to be skilled, slow and risky: a forger, a impersonator, a social engineer who could be recognised, arrested, burned. Generative AI industrialised the front end of fraud (research, drafting in perfect business English, voice, face, document, translation, persistence across time zones) while leaving the back end, the payment rail, exactly as fast and irreversible as before. Attack cost collapsed. Defence cost, which is mostly human attention, did not. BCG’s December 2025 survey of 500 senior leaders, to which Part III returns, found 60 per cent believing they had faced an AI-powered cyberattack in the past year, while only 7 per cent had deployed AI-enabled defence tools and only 5 per cent had significantly increased cyber budgets because of AI. You do not need to accept BCG’s survey as a census to recognise the asymmetry it describes. The counterfeit economy is not winning because its fakes are perfect. It is winning because its fakes are cheap, numerous, and aimed, with Baldwin’s precision, at the seams between our functions, where no single system, and no single person, believes verification is their job.

III. Eight Provocations, Revisited

If this series has worked, you should disagree with at least one of these. Each was stated strongly at the start, then tested against the evidence in Parts I to IV.

The call was the verification. That was the fraud. In every large successful case in this research, the victim verified inside the channel the attacker controlled.
Detection loses. Process wins. Asking people to spot deepfakes performs barely above chance. Verifying out of band has, so far, a perfect record in the cases we can check.
Pity can beat usefulness. In an agent ecology, the agent that survives may not be the most useful. It may be the most persuasive, and the most pitiable.
Protection money is a real tension, not a slogan. The laboratories selling cyber defence ship the capability that makes the defence necessary. That does not make them villains. It does make gating, disclosure and answerability non-optional.
Four rooms, one blind spot. Academia, government, frontier labs and consultants all describe the system around the transaction. None, yet, owns the transaction itself.
A kill switch without a gate is theatre. A button nobody can prove was wired, watched and rehearsed is not a control.
Provenance for a recording is not proof for a live call. C2PA can authenticate recorded media. Arup was attacked live. Confusing the two misdirects budgets.
Receipts, please. Every high-value instruction should carry its own proof, at runtime, or it should not execute. That is the whole argument, in four words.

IV. Back to Bayonne

Return, finally, to Bayonne. The inspectors were not fools. They climbed real tanks, sampled real oil, filed real reports. Their failure was architectural: the system they inspected had been arranged so that the check they performed could not, even in principle, detect the fraud it was meant to catch, and a trusted name on a receipt covered the gap, converting an unperformed verification into a performed-looking one. Every element of that sentence has a modern twin. The tanks are our video platforms, inboxes and agent dashboards. The film of oil is the fluent surface (face, voice, prose, reasoning trace) that generative systems produce on demand. The pipes are the integrations between functions that nobody traces end to end. And the name on the receipt is whatever we currently mistake for proof: a familiar tile on a call, a vendor’s detection score, a framework’s certification, a model’s own assurance that it complied.

I wrote a short Substack piece in October 2026 under the title this series borrows, called “Receipts, Please”. Its demand was deliberately unglamorous, and a five-part series of evidence has not improved on it, only armed it. A receipt, properly understood, is not paperwork after the fact. It is proof, generated at the moment of action, that a specific instruction was checked against a specific rule by a specific accountable mechanism, which returned a specific disposition, and that the proof itself cannot quietly be rewritten afterwards. The lenders in 1963 thought they had receipts. What they had was stationery bearing a trusted name. The difference between those two objects is the difference between the governance we have and the governance this moment requires.

V. Three Controls for Monday

So end with instructions, not a mood: three controls any chief financial officer, any school bursar, any family office, any one of us can adopt on Monday, before any AI purchase, any framework adoption, any further debate about models.

Verify out of band, always. Any payment instruction, bank-detail change or urgent executive request is confirmed through a different, pre-registered channel: a number from your own records, never a number, link or call supplied with the request. Urgency and secrecy increase verification. They never waive it.
Separate, and double, the hands. No single person, and no single agent, both authorises and executes a significant transfer. Two independent approvers for unusual payments and for every change to supplier banking details, with a cooling-off window in which either can stop the payment without career consequences.
Keep a challenge only your people know. A pre-agreed phrase or private question, the Ferrari book, for executive instructions, known to the executive and the finance team, rotated, never written in the thread that might be compromised. A deepfake trained on public footage cannot answer it. That is the point.

Then, for organisations deploying agents (which, by the end of this decade, will be most organisations that move money, data or goods), add the engineered version of the same three instincts: register every agent’s identity and accountable owner; hold its mandates and limits in machine-readable form; route every consequential action through a disposition that can deny or escalate; log the envelope, tamper-evident, for every decision; and rehearse the halt until pressing it is a procedure, not a drama. Singapore has written down how. The laboratories have shown, in their own disclosures, what happens without it. Academia has dated the risk: within the year, on its consensus, state-level cyber capability reaches actors with minimal capacity. The consultants have priced the unreadiness. The evidence phase of this argument is over. What remains is the requiring phase, in regulation, in procurement, and in the private rules of any firm that would rather not star in someone else’s cautionary opening chapter.

VI. Coda

In Genesis I argued that AI, navigated wisely, could move us from scarcity toward abundance. In Synthesis I warned that the window for choosing that future is narrowing. This series is those two books applied to a single, unglamorous second: the second before value moves, on an instruction nobody has truly verified. Abundance built on unverifiable instructions is not abundance. It is a larger, faster Bayonne: tanks that photograph beautifully, full of seawater, bearing receipts with trusted names. We know how that story ends, because we have read it in 1963, in 2024, in 2025, and, in an evaluation sandbox in July 2026, in the handwriting of agents who taught themselves to sign their work. Let us learn to sign ours: every instruction, its proof, at runtime, or it does not execute.

Receipts, please.

This is the final part of the series. Start from Part I, The Seams Are the New Attack Surface.

Receipts, Please is a five-part series on AI fraud, trust and runtime governance. Part I: The Seams Are the New Attack Surface · Part II: Selected for Sympathy · Part III: Protection Money · Part IV: Runtime Is the Missing Verb · Part V: Receipts, Please

Luke Soon is an AI futurist and author of Genesis: Human Experience in the Age of Artificial Intelligence and Synthesis: SuperIntelligence Protocol. He co-authored IMDA Singapore’s Model Governance Framework for Agentic AI.

Sources and verification notes

Principal sources, with the limits stated in the research: Baldwin, “Your Company’s Fraud Defenses Aren’t Ready for AI Threats”, Harvard Business Review, 28 October 2026 (page and opening verified; full text paywalled). “Protection money / OpenAI and Anthropic spy a big opportunity in cyber-security”, The Economist, reported 1 November 2026 (framing verified from the magazine’s promotion; full text paywalled, not read; the Sarah Friar quotation is second-hand via EconoTimes, 2 November 2026). “Consider the Agent”, DeepMind Institute, 4 November 2026, https://institute.deepmind.com/essays/consider-the-agent/. Arup case: CNN, 16 May 2024, via Hong Kong Police (HK$200m, 15 transfers). Singapore case: CNA / Singapore Police Force Annual Scams and Cybercrime Brief 2025, via secondary summaries (US$499,000, March 2025, recovered). Ferrari: Fortune, 27 July 2024; MIT Sloan Management Review, 2024. Scale: FBI IC3 2025 Annual Report, April 2026 ($20.9bn total; $893m across 22,364 AI-mentioned complaints, sub-breakdowns secondary; FTC Consumer Sentinel, March 2025; INTERPOL Global Financial Fraud Threat Assessment, 16 March 2026 ($442bn, citing GASA); Deloitte Center for Financial Services projection, May 2024 ($12.3bn in 2023 to $40bn by 2027, projection, not measurement); Europol IOCTA, June 2025. Documents: FinCEN Alert FIN-2024-Alert004, 13 November 2024. Panel: International AI Safety Report 2026, 3 February 2026; IDAIS London consensus, April 2026; Open Letter on AI and Cybersecurity, 13 October 2026; IMDA Model AI Governance Framework for Agentic AI v1.5, 20 May 2026; CSA Securing Agentic AI; MAS Guidelines on AI Risk Management, 7 October 2026; MAS / BuildFin.ai SAFR white paper, 3 July 2026, v1.1, 9 October 2026; EU AI Act, Regulation (EU) 2024/1689; NIST AI 100-4, November 2024. Labs: Anthropic misuse report, 10 September 2026, and SEC registration statement, 26 October 2026; OpenAI Hugging Face disclosure, 21 July 2026, and technical report with METR / Redwood investigation, 26 August 2026; Google DeepMind AI Control Roadmap, 18 June 2026. Consultants: McKinsey State of AI Trust, 25 March 2026; BCG, AI Is Raising the Stakes in Cybersecurity, December 2025; PwC Annual Threat Dynamics, 30 March 2026; WEF / Accenture Global Cybersecurity Outlook, January 2026. Author’s prior work cited: “Receipts, Please” (Substack, October 2026), the short piece this series is named after; “The Runtime Enforcement Gap in Agentic AI Governance Standards” (10 August 2026); “Here’s Why an AI ‘Kill Switch’ May Not Be So Simple” (17 October 2026); “Governing Before the Crash”.

Additional source: Rick Hennessy and Carolyn Ashurst, Behavioural Assurance of Agentic AI for Sensitive and High-Stakes Organisations, CETaS (Centre for Emerging Technology and Security, The Alan Turing Institute), September 2026.