Last Mapuranga
FRAUD has evolved from physical theft to schemes exploiting digital identities, connected systems and human trust. Criminals misuse connectivity, automation and artificial intelligence organisations rely on for growth.
Forensic AI combines investigation, advanced analytics and governed AI to identify suspicious patterns, connect evidence and strengthen controls. It does not let algorithms declare guilt; it helps investigators test hypotheses and build defensible accounts of events.
Leaders must ask whether their defences address physical, digital and AI-enabled threats while preserving evidence integrity, fairness, privacy and accountability.
The evolution of fraud: one interconnected threat
Fraud’s evolution can be summarised as “steal the card”, “steal the data” and “steal at scale”. These are overlapping threats, not separate eras. Physical compromise may enable digital intrusion; stolen data may support synthetic identities; and AI-generated voices or videos may make fraudulent instructions more convincing.
Transaction reviews, surveillance and witness accounts remain important. Digital fraud adds phishing, one-time-password scams, identity theft and account takeovers. AI-enabled deception can scale synthetic identities, deepfakes, tailored communications and automated interactions.
A convincing voice, video, anomaly or model alert is not proof of fraud. Investigators must assess provenance, validate identity signals and corroborate findings with independent evidence.
The fraud imperative
The Association of Certified Fraud Examiners’ 2026 Occupational Fraud Report analyses 2 402 occupational fraud cases across 143 countries and territories, involving more than US$3,4 billion in losses. These figures describe the cases in the study; they are not a complete measure of global fraud and should not be interpreted as an estimate of AI-caused fraud.
Fraud is a material organisational risk. Prevention needs connected data, clear escalation paths and disciplined processes not one control or retrospective investigation alone.
The forensic AI intelligence framework
Forensic AI is not a single product or a magic fraud detector. It is an evidence-led operating framework combining reliable data, analytical methods, investigative expertise, governance and human oversight. It follows four connected steps:
Detection identifies unusual transactions, altered or duplicate records, unexpected behaviour and anomalous access patterns. Thresholds should be evaluated for false positives, false negatives and practical value.
Connection uses entity resolution and link analysis to examine relationships among accounts, people, devices, addresses, transactions and business processes. Shared details may have legitimate explanations and are not proof of wrongdoing.
Investigation reconstructs timelines, validates source records and data lineage, seeks independent corroboration, tests alternative explanations and documents reasoning. An alert is a lead, not a finding.
Prevention turns findings into stronger controls, access management, targeted monitoring, staff training and escalation protocols. Actions should have accountable owners and be verified.
Evidence fusion and defensible findings
A credible investigation brings together relevant transaction and ledger data, identity and entity records, digital traces, communications, contracts, approvals and physical evidence. Evidence fusion is not simply collecting more information. It requires reliable provenance, accurate timestamps, consistent identifiers, secure handling and a clear explanation of how each source supports or contradicts a hypothesis.
A defensible process preserves original records where possible and documents collection methods and chain of custody. It validates timestamps, time zones, transformations and source reliability; records analytical assumptions and model versions; corroborates alerts; maintains an audit trail; and applies independent quality review to high-impact decisions. An anomaly, investigative lead, substantiated finding and legal conclusion are different categories and must not be conflated.
Responsible AI and board accountability
AI systems can reflect historical bias, inherit poor-quality data, produce false confidence or generate scores that are difficult to explain. The National Institute of Standards and Technology’s AI Risk Management Framework offers a voluntary, risk-based resource for managing trustworthiness throughout the AI lifecycle. It should be considered alongside applicable local law and sector requirements.
Responsible forensic AI requires a lawful and proportionate purpose, privacy and security safeguards, explainable alerts, fairness testing, routes to challenge errors, performance monitoring and auditable records of model versions and analyst decisions. A model score alone must never determine guilt, dismissal, denial of service or another serious outcome.
Boards and executives should ask whether suspicious patterns can be identified across the organisation; whether data used for decisions is reliable; whether controls address deepfakes and synthetic identities; whether digital evidence can be preserved quickly; and whether investigations lead to measurable control improvements. South African organisations should assess alignment with the applicable King Code. Organisations in Zimbabwe and other jurisdictions must separately assess their local laws, regulatory requirements and governance codes.
A practical implementation roadmap
Map priority fraud scenarios, systems, data owners, controls and legal obligations. Select a focused use case, such as duplicate payments or procurement anomalies. Set data-quality, access, security, provenance and retention requirements. Pilot with human review, measure errors, integrate alerts into case management, and monitor fairness, drift, costs and outcomes.
Measure investigative and control outcomes, not alert volume alone.
Useful indicators include alert-triage time, case cycle time, evidence completeness, false-positive and false-negative estimates where reliable ground truth exists, supported financial recoveries, remediation completion, repeat incidents, human overrides and audit findings. Interpret measures together and establish baselines using validated organisational data.
Conclusion: intelligence must serve evidence
Physical, digital and AI-enabled threats operate simultaneously. Isolated controls and reactive investigations can miss complex schemes.
Forensic AI connects fragmented intelligence, but depends on investigative scepticism, evidence integrity and human judgement. Technology can show where to look; evidence must establish what happened.
l Mapuranga is a Technical Director & Global Forensics & Analytics Consulting CEO, DBA AI/ML Candidate (USA) | MSc Data Analytics (UK) | TSCM (SA) | Certified AI/ML BlackBelt Plus (India) | Diploma in Accountancy (Zimbabwe.) He can be contacted on: lastmapuranga@gmail. com, phone: +263772255656, linkedIn: https://www.linkedin.com/in/last-mapuranga-994297103