Incode launches cryptographic fraud network to break bank data deadlock

Incode Technologies, the San Francisco-based identity verification firm that serves eight of the top ten US banks, has launched TrustGraph: a peer-to-peer cryptographic network that allows competing financial institutions to cross-reference fraud signals in real time without any customer records leaving their walls. The launch, timed to coincide with growing regulatory scrutiny of UK banking fraud, which the industry estimates costs over £1.3 billion a year, places cryptography at the centre of a problem that traditional data-sharing frameworks have failed to solve.

The core dilemma TrustGraph targets is structural. Fraud rings operate across dozens of institutions simultaneously, yet privacy law in both the UK and the EU constrains the direct exchange of customer data between banks. The result is a persistent blind spot: a synthetic identity or hijacked credential that triggers a rejection at one bank can sail through onboarding at a competitor the same afternoon. Traditional network-intelligence approaches have required pooling customer records in a central repository, itself a high-value target for attackers and a compliance liability for participants.

Cryptography as the regulatory workaround

TrustGraph sidesteps the pooling problem using secure multi-party computation (SMPC), a cryptographic technique in which institutions compare one-time-use derived tokens rather than raw data. No bank sees another's customer records; the network returns only a fraud or trust signal. The architecture is peer-to-peer, meaning there is no central data lake to breach. Incode developed the underlying protocol over more than a decade, incorporating technology from Identiq, a cryptographic identity validation specialist it acquired in June 2026.

In an early-access programme covering 12.2 million onboarding and authentication sessions, institutions using TrustGraph detected up to 53% more fraud cases than their existing single-institution models alone. The trial also surfaced fraud rings within individual institutions' own data, linking seemingly unrelated applications that shared a device fingerprint, near-identical address strings, or document details. Interac, the Canadian payments network connecting nearly 300 financial institutions, has already endorsed the approach. "How do you expect every single business to keep up with deepfakes, synthetic identities, and romance scams on its own? It is impossible," said Navjeet Grewal, Managing Director of Verification and Digital Credentials at Interac. "If Company A experiences an attack and the same actor later targets Company B, Company B doesn't have to face that attack as if it were the first time."

The agentic fraud escalation

The launch is explicitly framed around a threat vector that did not exist at scale three years ago. Incode projects that agentic fraud, in which autonomous AI agents construct synthetic identities, forge documents and retry after each rejection across hundreds of targets simultaneously, will account for 60% of all fraud attempts by the end of 2026. That figure is unverified beyond Incode's own modelling, but the directional concern is consistent with observations from fraud analytics firms and national crime agencies across the UK, EU and North America.

The convergence angle here runs deeper than a fintech product launch. The same large-language-model infrastructure that banks are deploying to streamline customer onboarding is simultaneously being weaponised to defeat the fraud controls those banks built in an earlier era. TrustGraph is, in effect, a collective infrastructure response to a collective AI threat: one institution's detection model, however sophisticated, cannot track an agent that distributes its attempts across fifty institutions. The network model that TrustGraph proposes mirrors the logic behind threat-intelligence sharing in cybersecurity, where sector-wide information sharing bodies have long argued that defenders must operate at network scale to match networked attackers.

For capital allocators watching the identity-verification and fraud-prevention space, the launch signals a potential platform shift. If SMPC-based network intelligence becomes the de facto standard, the competitive moat migrates from individual AI model quality to network size: the institution with the most participants surfaces the most repeat patterns. That dynamic favours early incumbents, raises the stakes of interoperability decisions, and introduces a new regulatory question, how authorities in the UK, EU and beyond will treat cryptographic signal-sharing networks that, technically, share no personal data but whose outputs may still carry privacy implications at scale.