Across Asia-Pacific, fraudsters are using artificial intelligence to test new attack vectors, clone identities and move stolen funds through mule accounts before public agencies can respond, according to SAS Director of Fraud and Security Intelligence for Asia Pacific-Japan Keith Swanson. He said governments are still working through how AI should be regulated, governed and responsibly deployed, widening the gap between attack and response as digital services and real-time payments leave agencies little time to intervene. “Pay and chase” is less effective when funds can move almost immediately after payment, he said.

Swanson said fraud has professionalised across Asia, with scam operations running like enterprises that use contact centres, AI tooling and sophisticated infrastructure. As banks and financial institutions strengthened defences, criminal syndicates have increasingly targeted governments, where elderly citizens and digitally underserved people may be both more vulnerable and more likely to receive government payments. Account takeovers and synthetic identities are now prevalent in government, while AI lets criminals create fake images for fraudulent claims, clone voices to impersonate trusted people and scale attacks faster.

Public agencies often have large stores of data, but Swanson said the main problem is using that data to prevent fraud rather than only manage information. Many agencies have spent years building enterprise-wide data warehouses, lakes and fabrics, but he argued that stronger results come when departments can access and act on data directly without waiting for long transformation timelines. He stressed speed of access, speed of testing and speed of action.

AI is already helping governments detect and prevent fraud by prioritising cases, streamlining investigations and improving workforce productivity. Swanson said prevention depends on stopping a payment when it exceeds a risk tolerance or profile, which requires checking not only eligibility data submitted by a citizen but also the citizen’s device, behaviour and identity. Machine learning models can flag unfamiliar devices or unusual activity patterns, network graph analysis (mapping links between connected entities) can reveal relationships a human investigator might miss, and natural language processing can scan free-form text for risk signals.

Generative AI can act as a co-pilot for investigators by summarising complex information, surfacing relevant insights and helping staff handle large volumes of data. Governments remain cautious about sensitive citizen data, with concerns including data privacy, auditability, model bias and AI hallucinations. Swanson said agentic AI could later automate parts of investigations, such as requesting more information or checking trusted data sources, but many exceptions still require human review.

Swanson urged governments to pursue 3 responses: greater public-private collaboration on attack vectors, fraud typologies and emerging threats; a genuine architectural pivot toward real-time blocking when services operate in real time; and internal agility through governance frameworks that allow rapid, proactive response. He also said agencies should measure prevention with outcomes such as the percentage of transactions verified in real time, the share resolved without human intervention and whether social programmes achieve intended citizen outcomes, because traditional metrics such as fraud detected, amounts recovered and cases prosecuted may fall when prevention improves.

Across Asia-Pacific, fraudsters are using artificial intelligence to test new attack vectors, clone identities and move stolen funds through mule accounts before public agencies can respond, according to SAS Director of Fraud and Security Intelligence for Asia Pacific-Japan Keith Swanson. He said governments are still working through how AI should be regulated, governed and responsibly deployed, widening the gap between attack and response as digital services and real-time payments leave agencies little time to intervene. “Pay and chase” is less effective when funds can move almost immediately after payment, he said.

Swanson said fraud has professionalised across Asia, with scam operations running like enterprises that use contact centres, AI tooling and sophisticated infrastructure. As banks and financial institutions strengthened defences, criminal syndicates have increasingly targeted governments, where elderly citizens and digitally underserved people may be both more vulnerable and more likely to receive government payments. Account takeovers and synthetic identities are now prevalent in government, while AI lets criminals create fake images for fraudulent claims, clone voices to impersonate trusted people and scale attacks faster.

Public agencies often have large stores of data, but Swanson said the main problem is using that data to prevent fraud rather than only manage information. Many agencies have spent years building enterprise-wide data warehouses, lakes and fabrics, but he argued that stronger results come when departments can access and act on data directly without waiting for long transformation timelines. He stressed speed of access, speed of testing and speed of action.

AI is already helping governments detect and prevent fraud by prioritising cases, streamlining investigations and improving workforce productivity. Swanson said prevention depends on stopping a payment when it exceeds a risk tolerance or profile, which requires checking not only eligibility data submitted by a citizen but also the citizen’s device, behaviour and identity. Machine learning models can flag unfamiliar devices or unusual activity patterns, network graph analysis (mapping links between connected entities) can reveal relationships a human investigator might miss, and natural language processing can scan free-form text for risk signals.

Generative AI can act as a co-pilot for investigators by summarising complex information, surfacing relevant insights and helping staff handle large volumes of data. Governments remain cautious about sensitive citizen data, with concerns including data privacy, auditability, model bias and AI hallucinations. Swanson said agentic AI could later automate parts of investigations, such as requesting more information or checking trusted data sources, but many exceptions still require human review.

Swanson urged governments to pursue 3 responses: greater public-private collaboration on attack vectors, fraud typologies and emerging threats; a genuine architectural pivot toward real-time blocking when services operate in real time; and internal agility through governance frameworks that allow rapid, proactive response. He also said agencies should measure prevention with outcomes such as the percentage of transactions verified in real time, the share resolved without human intervention and whether social programmes achieve intended citizen outcomes, because traditional metrics such as fraud detected, amounts recovered and cases prosecuted may fall when prevention improves.