Rising AI Mortgage Fraud in Australia: Semper Secured’s View

When you find a flea on a dog, you don’t celebrate early detection and stop looking. You assume there are more. Then you check the bedding, the carpet, the yard, and every other animal in the house.

The same principle applies to fraud. Spotting a single suspicious loan or document is rarely an isolated incident. It often signals a broader pattern that may extend across systems, channels, or institutions.

That is the lens through which we must view reports that the Commonwealth Bank of Australia has referred a potential ~$1 billion of home loans for investigation, including reporting to police and regulators, amid concerns of sophisticated mortgage fraud and AI-generated documents.

Two points matter.

First, the alleged exposure is large enough to be systemically interesting, even if losses ultimately prove limited by property security and ongoing repayments.

Second, the reported methods used, including synthetic identities, forged documents, deepfakes and industrialised fraud processes, are precisely the kind of strategies that scale. They are unlikely to remain confined to a single institution.

Criminals Diversify Too

The hypothesis is straightforward. Criminal networks diversify risk and exploit opportunity in much the same way capital does.

If a sophisticated fraud syndicate has found a repeatable pathway through a major bank’s controls, whether via compromised insiders, broker channels, doctored documentation or identity weaknesses, it is improbable that the same strategy is limited to one bank. Incentives point the other way.

When a method works, it is repeated, refined and pushed to its limits. And when resistance builds, criminals adapt. Techniques that succeed are scaled, adjusted and redeployed to the widest possible margin of exploitation.

It is therefore rational to assume that other major banks may also face exposure, even if the size and loss outcomes differ. This is not an accusation. It is a risk inference based on how scalable fraud behaves.

APRA and the Pattern of Transfer

This is where prudential regulation becomes critical. The role of Australian Prudential Regulation Authority is not to manage one bank’s embarrassment. It is to reduce systemic fragility.

When a weakness is identified in one institution, regulators must consider whether the same pattern has transferred elsewhere. Non-financial risk failures are rarely isolated. They are often structural.

If the reported CBA matter crystallises a clear typology involving AI-forged documents, identity manipulation, income fabrication or collusive participants, it would not be surprising to see targeted reviews extend across the system. And once APRA begins, Australian Securities and Investments Commission is unlikely to be far behind, particularly where broker conduct, consumer lending obligations or distribution pathways are implicated.

NextGen, Aggregators and the Plumbing Question

We preface this by stating that we expect mortgage frauds to have occurred outside of NextGen’s plumbing. But it has to be said that attention will need to be paid to all mortgage administration flow-through plumbing. 

Broker-originated mortgages heavily concentrated through lodgement platforms can act as a control point (when they work) of a fraud superhighway when they down.

Integration points and/or verification steps that are incomplete, inconsistently applied or easily bypassed, become part of the problem.

Systems that have expanded digital verification tools, including digital verification of identity and Open Banking-based income verification, aimed at reducing reliance on manual documents and improving data integrity need reviewing to see whether these controls meaningfully reduce fraud risk or simply increase processing speed without strengthening the underlying chain of proof.

Aggregators also sit within this chain as scale multipliers. They do not approve credit, but they influence process discipline, broker training and, critically, what becomes normal within a submission pack.

Automation Without a Complete Data Chain Is a Liability

The key question is whether automation has reduced human interaction in ways that increase exposure.

Automation itself is not the problem. Incomplete automation can be.

If lenders digitise submission and decision workflows but fail to implement a tamper-resistant chain of verification, linking identity, income, liabilities, assets, transaction history, employment, valuation integrity and beneficiary checks, they risk creating the worst of both worlds:

• Faster throughput for legitimate borrowers
• Faster throughput for well-packaged fraud

Humans are not infallible. However, experienced credit officers apply judgement through questioning, recognising inconsistencies, challenging documents and identifying behavioural patterns. That accumulated experience functions as fraud detection. Removing it without replacing it with stronger, whole-of-chain, data-linked verification creates vulnerability.

Why This Matters Beyond the Majors

If reporting continues to bring similar fraud cases to the surface, scrutiny will not remain confined to banks. It will extend to second-tier lenders and non-banks. Attackers do not stop at the hardest target once a workable method exists.

For private credit and non-bank lenders, the lesson is simple. Assume the fleas are already in the carpet.

Because when a dog has fleas, it is never just one.