The urgent payment request from your CEO. The supplier email about updated bank details. The voicemail that sounds exactly like someone you know. Any one of these could now be generated by AI – and that’s the new reality for finance teams.
According to the FBI’s 2025 Internet Crime Report, business email compromise (BEC) cost businesses more than $3 billion last year, making it one of the most financially damaging cybercrimes on record. AI has made these attacks far harder to spot. The question for your accounts payable (AP) team is no longer whether they can recognize a suspicious request. It’s whether the process around payments makes fraud difficult, no matter how convincing it looks.
Why AP teams are in the crosshairs
Accounts payable sits at the intersection of trust and timing. Your team processes invoices, manages supplier details, and moves money – usually under pressure to keep things running smoothly. For an attacker, that’s the perfect target.
Most successful fraud doesn’t involve breaking into systems. According to the Crime Complaint Centre, it relies on impersonation: posing as a trusted executive, supplier, or colleague to redirect a payment or change bank details before anyone notices. AI has made that impersonation dramatically more scalable. What once took skill and time to craft is now automated – the research, the writing, the context that makes a fake blend into normal AP workflow. By mid-2024, an estimated 40% of BEC phishing emails were already AI-generated, and that share is climbing.
What AI-enhanced fraud looks like
Emails that blend right in
Old-school phishing relied on volume and mistakes – awkward phrasing, dodgy logos, generic greetings. Not anymore. Modern BEC emails are grammatically clean and written in the exact tone of the person being impersonated. They reference real projects, current invoice numbers, and upcoming payment runs. For a team processing high volumes, that familiarity is precisely what lowers the guard.
Payment redirection
One of the most common patterns: an attacker quietly alters the destination account on a legitimate invoice, then sends a short note claiming the supplier has “updated its banking details.” The surrounding content looks entirely genuine – because much of it is drawn from real correspondence.
Voice cloning
Email isn’t the only channel. AI tools can replicate a person’s voice from a short audio sample, making it possible to leave a convincing voicemail or place a call that sounds like a known executive. For teams used to verbal sign-off on urgent payments, that removes one of the last verification methods email security can’t cover.
Why traditional checks no longer work
Security awareness training still matters – keep investing in it. But AI has changed what your team is up against. The tell-tale signals training once focused on are gone.
When a fraudulent request is genuinely indistinguishable from a real one, putting the burden of detection on the AP team puts it in the wrong place.
The organizations that actually reduce risk aren’t asking staff to be more suspicious. They’re building verification that works regardless of how a message looks.
Building process around the risk
The strongest defence isn’t sharper instincts. It’s removing ambiguity from high-risk actions.
Out-of-band verification as standard
Any request to change supplier bank details or approve an urgent, out-of-cycle payment should require confirmation through a known, independent channel – not a reply to the same email thread. A quick call to a number already on file breaks the impersonation chain, no matter how convincing the request. This needs no technology. It needs a written procedure and the habit of following it.
Layered access and MFA
Restricting access to financial systems and enforcing multi-factor authentication limits the damage a compromised account can do. If an attacker gets into a supplier’s email, MFA on your side creates friction that can stop a fraudulent change before money moves.
A culture that supports slowing down
Fraud prevention improves when people feel safe questioning a request – including from senior leadership. Someone who pauses a payment to verify isn’t being obstructive; they’re doing exactly what good process requires. That starts with leaders modelling the behaviour and making clear that slowing down on high-risk actions is always the right call.
For context: the FBI’s 2025 report included a dedicated AI section for the first time, logging more than $893 million in AI-enabled scam losses across 22,000+ complaints. When verification is standard and questioning is encouraged, AI-enhanced fraud loses most of its advantage. The attackers’ technology is advancing fast – but the controls that contain the damage don’t have to be complicated. They have to be consistent.
Shift the burden from people to process
Worried about AI-enhanced fraud targeting your finance team? The good news is that the controls that stop it are practical – and we can help you put them in place.
Book a payment-process review with us. We’ll pinpoint where your accounts payable workflow is most exposed and give you a clear, prioritised plan to close the gaps. Get in touch today to get started.
FAQs
Why are AP teams targeted so often?
They manage payments and supplier details – a direct path to moving money without breaching any technical system.
Can awareness training alone stop AI-driven fraud?
No. It helps, but AI scams often look completely legitimate. Strong verification processes are essential.
Is voice-based fraud really a risk?
Yes. AI voice cloning lets attackers impersonate executives convincingly, which makes phone-based approvals vulnerable.