Fraud budgets are moving ahead of the loss data in Experian's survey of 200 firms

The seventeen points between the loss share and the budget share are where the decision sits. Experian puts fraud losses higher at a minimum of 60% of its 200 respondents and larger fraud-management budgets at 77% ^[1][2], which means that on the survey's own floor at least 17 points of the sample, about 34 companies, are funding a response they have not yet recorded a loss against ^[13]. The floor matters: the loss figure is published as "at least 60%", so if the real share is higher, that guaranteed gap narrows ^[15]. Money is moving before the damage is fully measured either way.

A skeptic would say 200 respondents reporting a direction of travel is not a budget case, and on the narrow question that is correct. The figures in the report are shares of respondents, not amounts ^[1][2], so they cannot tell a finance function how much to move or what return to expect. What they do tell it is that roughly three quarters of the surveyed peer set has already made the call ^[2], which changes the internal burden from proving the threat to explaining the exception.

The reason this reads as an operating cost rather than a security one is in the adoption number. Eighty percent of respondents already run machine learning or generative AI inside their fraud-management environments, for suspicious-activity detection and identity verification ^[4], which is spend sitting in the workflow that approves payments and onboards customers. Cody Tyler of EXOS argues that AI has not created new scam categories but supercharged existing ones ^[5], and that exposure tracks access to money and sensitive systems rather than seniority ^[6]. If he is right, the marginal dollar hardens accounts payable and the front desk rather than the perimeter.

The cheapest control described in the Forbes account also carries the most awkward invoice. Victor Smushkevich of CallSetter AI says a three-second voicemail greeting is enough to clone an executive's voice ^[8], and that the defence is a mandatory callback to a verified number on every financial request made by phone, with no exceptions ^[9]. That is close to free to buy and expensive to run, because every urgent payment now takes a second call, and the delay is absorbed by treasury and payables rather than by the function whose budget holds the tooling. Noe Ramos of Agiloft says several companies have lost hundreds of millions to a single phone call ^[7]; that is one practitioner's assertion in the same article, and it is the loss figure a callback rule gets priced against.

The case for buying procedure over awareness is that awareness depreciates. Olga Polishchuk of ZeroFox says the artifacts staff are taught to look for, lip-sync errors and plastic skin among them, are being patched in real time ^[10], and Scott Edwards of BOK Financial says fraudsters moved off older tactics as recognition of those tactics spread ^[11]. Stanislav Kazanov of Innowise describes the text-side version, with a target's LinkedIn profile fed into a model to reproduce a colleague's writing manner ^[12]. A callback does not depend on spotting the fake, which is why it survives the next model release. What the record does not settle is how long the unscripted follow-up question keeps working, since the only evidence offered is that synthetic voices still stumble on them ^[9], and that is a question for the decade rather than the quarter.