WEX anti-financial crimes executive William Fitzgerald revealed that cheap AI tools and automated agents are supercharging fleet fraud risks, prompting the company to invest millions in machine learning and voice biometrics defenses.
- Surging Threat Landscape: Account-takeover (ATO) cases have spiked 200% year-over-year, driven by phishing, fake websites, and business email compromise that allows threat actors to quietly study fleet spending habits for months.
- The Role of Artificial Intelligence: Generative AI tools and deepfake technology have eliminated technical barriers, enabling malicious actors to bypass security controls, mimic human voices and accents, and swarm obscure system vulnerabilities at scale.
- Advanced Technological Defenses: WEX invested nearly $8 million over 30 months into DataVisor's machine-learning platform—running intraday model retraining to boost fraud capture rates by 35%—alongside deploying Pindrop voice biometrics to eliminate call-center social engineering.
- Essential Best Practices: Fleet managers are urged to enforce robust security protocols, including mandating multi-factor authentication and passkeys, auditing user access controls, eliminating weak card PINs like 1234, and verifying unexpected requests through established callback channels.
Artificial intelligence has turbocharged financial fraud, lowering technical barriers and fueled a 200% year-over-year surge in account-takeover (ATO) cases, according to William Fitzgerald, vice president of anti-financial crimes at WEX.
Speaking at the WEX OTR Summit in Ponte Vedra, Fla., this week, Fitzgerald warned that fraudsters are leveraging cheap generative AI tools and automated agents to exploit vulnerabilities at an unprecedented scale.
"Anyone who wants to be a fraudster can pay $20 for an account and ask it how to commit fraud, and it will tell you in excruciating detail how to beat every control," Fitzgerald said. "The barrier to entry is gone."
The threat of account takeovers
Fitzgerald highlighted account takeover as the most dangerous and pervasive threat facing fleets today, contrasting it with traditional card skimming. While a skimmed card can typically be shut off and replaced, a compromised account acts like a professional thief operating inside the business while the owners are away.
Often targeting smaller fleets utilizing unprotected email domains, attackers frequently use business email compromise to gain initial access, then lay dormant for weeks or months to study spending habits before launching attacks. Once inside, fraudsters make subtle modifications to user profiles, swapping characters like an "l" for a "1" or an "e" for a "3" to evade visual detection during audits before draining funds via money codes.
Human error and social engineering remain major catalysts. Fitzgerald cited instances where pressured fleet managers surrendered credentials out of fear for their jobs, compounded by a lack of organizational culture empowering employees to pause and verify requests. Furthermore, threat actors are increasingly using AI-generated deepfakes—replicating voices, faces, and accents—to deceive staff.
Recommended best practices
Fitzgerald urged organizations to immediately adopt rigorous internal security controls:
Enable passkeys and MFA: Administrators should mandate single sign-on (SSO) with multi-factor authentication and enable optional passkeys immediately.
Audit user access: Regularly review permissions in tools like vManager and limit high-privilege actions, such as issuing money codes, to the absolute minimum number of personnel.
Enforce unique PINs: Eliminate easily guessed card-in-hand PINs—such as 1234, 0000, or truck numbers—which suffer exponentially higher fraud rates.
Verify unexpected requests: Implement strict callback verification protocols rather than responding directly to unsolicited texts, emails, or calls.
Defenses and machine learning upgrades
To combat evolving threats, WEX has invested nearly $8 million over the last 30 months into implementing DataVisor's fraud platform. By combining account-origin data, access logs, and authorization patterns, the system evaluates transactions in context rather than in isolation.
Fitzgerald noted that the platform utilizes supervised machine learning, running roughly 17 online and offline models, to process thousands of features simultaneously without violating the strict 500-millisecond window required for transaction decisions. Model retraining, which previously took up to 45 days, can now be deployed intraday, leading to a roughly 35% improvement in fraud capture rates and a 20% boost in precision.
WEX deployed Pindrop across its call centers around 2024 or 2025 to detect VoIP manipulation and AI-generated voices using voice biometrics. The technology has successfully reduced call-center social engineering to "almost nothing" by blocking malicious voices or redirecting them into endless interactive voice response (IVR) loops.
