GDPR does not have specific exemptions for fraud. It is often possible to process personal data for anti fraud purposes but it requires a full legal assessment in the same way as any other processing activity would.