How is AI changing payment fraud?
AI is making existing fraud methods such as business email compromise, vendor impersonation and invoice fraud more convincing and easier to scale. It also helps defenders analyse patterns and anomalies, so the outcome depends heavily on the surrounding controls and response process.
AI changes the economics of payment fraud
AI will not eliminate payment fraud. It changes the contest between attackers and defenders. Treasury teams can use better analytics to identify anomalies and patterns, while criminals can use the same class of technology to make deception cheaper, faster and easier to scale.
The immediate problem for finance is asymmetry. A company has to evaluate security, compliance, governance and operational impact before introducing new technology. A fraudster only needs a tool to make the next attack more convincing.
That does not mean defenders are powerless. Corporates, banks and payment providers have transaction history, established processes and the ability to redesign controls across the full payment lifecycle. The advantage comes from using those assets systematically rather than assuming AI itself will make payments safer.
AI-enabled fraud often looks like normal business
The most dangerous AI-enabled fraud may not look particularly technical. Business email compromise, vendor impersonation and invoice fraud already work by exploiting trust, timing and routine. AI makes those familiar patterns more credible.
A payment request can arrive in natural language, use the right tone, refer to a real business situation and include a plausible document. A phone call or synthetic voice can reinforce the message. Each signal may look ordinary on its own, which is exactly why the combination is difficult to challenge.
Treasury should therefore be careful about focusing only on deepfakes. The broader risk is multi-channel deception in which email, documents, voice and urgency all point in the same false direction.
Familiarity is becoming a weaker control
Several traditional trust signals are losing strength. A well-written email is not proof of identity. A professional-looking document is not proof that the underlying instruction is legitimate. A familiar voice is not enough to confirm authority.
The same applies to callbacks if the contact details come from the suspicious message itself. Replying within a compromised email thread can also keep the employee inside the attacker's channel.
This shifts the emphasis toward independent verification: pre-registered contact details, a separate verification channel, controlled vendor portals and stronger checks for unusual or high-risk changes.
Payment fraud often begins before the payment is created
Many fraud scenarios become visible only when money moves, but the manipulation can start earlier. A change to vendor or beneficiary master data may be the real point of compromise.
That makes upstream governance part of payment fraud prevention. Treasury and finance should know who can create a vendor, who can change bank details, how those changes are verified and how quickly a changed beneficiary can receive funds.
A tightly controlled payment approval cannot compensate for weak beneficiary-data controls if the fraudulent account has already become the accepted destination.
Segregation of duties still matters, but independence matters more
Segregation of duties remains one of the strongest control principles in treasury and finance. AI does, however, raise a new question: are the control points genuinely independent?
If the same AI-generated narrative, document or supporting information influences the preparer and the approver, different people may still be relying on the same manipulated evidence. Treasury should look beyond who clicks approve and consider where the information used for the decision came from.
The strongest approval process combines separate roles with independent data, independent verification and clear escalation when the request falls outside normal patterns.
Internal fraud belongs in the same risk discussion
External attackers have to gain access or trust. Insiders may already have both. They can understand payment timing, thresholds, process weaknesses and the explanations that will appear normal to colleagues.
AI can make preparation and concealment easier by helping someone produce consistent documentation or a convincing explanation across several steps. That is another reason to manage fraud across the full lifecycle, including onboarding, master-data changes, payment initiation, approval and release.
Good controls are not an accusation against employees. They protect the organisation and reduce the pressure placed on individuals who might otherwise become the single point of failure.
The strongest fraud controls combine technology with permission to slow down
Anomaly detection and behavioural analytics can help identify unusual amounts, timing, beneficiary changes and other patterns that deserve attention. Those tools are most useful when they feed a clear escalation process.
Culture is equally important. Employees need explicit permission to stop or delay an unusual payment even when the request appears to come from a senior executive or arrives with a strong sense of urgency.
A useful review for treasury is therefore broader than the fraud-detection tool itself: identify where the process still depends on trust signals that AI can fabricate, then strengthen the verification around those points.
About the interview
This article is based on Nomentia's interview with Joonas Helenius, Senior Manager at Accenture Finland, specialising in financial crime, fraud prevention, payment risk, AML, KYC and sanctions.
