AI fuels low-value cybercrimes, use of ‘salami slicing’ | #cybercrime | #infosec

New Delhi: The booming digital economy and rapid spread of artificial intelligence (AI) are fuelling low-value cybercrimes rather than high-value scams, with fraudsters switching to targeting people instead of systems and increasingly employing “salami slicing” tactics to evade detection.

A salami slicing strategy refers to a series of incremental steps that are individually too small to trigger a strong response.

“Many times, fraudsters attempt to adopt a “salami slicing” approach. So, even though individual financial fraud is not of large value, it is carried out at scale,” said Atul Gupta, partner, KPMG, who also leads cyber security services.

Among the most widespread frauds nowadays is the fake electricity or gas supply scam, with perpetrators impersonating energy providers and threatening to shut off the power or gas supply unless they are paid immediately. “These scams are currently prevalent in the country and normally entail very insignificant amounts,” said Gupta.

Other common frauds include fake investment offers, account takeovers, spoofed calls, fraudulent payment requests and AI-generated voice or video impersonation, according to experts.

In 2025, 35% of the cases accounted for 76% of the overall money lost in cybercrimes in India, showed Union home affairs ministry data. “This gap is telling. It suggests criminals are now investing in trust-building the same way a legitimate advisor would, which is exactly what makes it harder for victims to spot them,” said Akshay Garkel, partner and leader-cyber, Grant Thornton Bharat.

More cases with flat-to-lower total losses reflect that the average ticket size per victim is shrinking, consistent with an increase in smaller frauds, said Garkel.Meanwhile, general cyber frauds, such as Unified Payments Interface (UPI) scams and investment schemes, are becoming a high-volume, low-value game, “while formal bank fraud is moving toward fewer but much costlier incidents”, he added.

Mfilterit, a financial cybersecurity firm, flagged 200,000-300,000 such accounts in January, a figure that spiralled to 1.5 million by August. “Cybercriminals now have a business case for petty fraud, courtesy AI,” said Dhiraj Gupta, co-founder and chief technology officer, Mfilterit. Earlier, it took about a week and significant investment to build a fake website, according to Gupta.