A familiar email conversation can give a fraudulent payment request all the credibility it needs.
A fraudster inside a business email account can study invoices, approval limits and payment timing, then join an existing conversation with instructions that divert the funds. Artificial intelligence helps criminals do that research in seconds, Bottomline Senior Risk and Fraud Officer Katie Elliott told PYMNTS, giving them the details needed to imitate routine business communications.
For finance teams, the danger extends beyond losing a payment. A compromised email account can damage the relationships that businesses depend on to get paid, purchase supplies and win customers. The apparent familiarity of a request also makes it harder for employees to recognize when those relationships are being exploited.
“They make fraud look operationally ordinary,” Elliott said.
AI has weakened familiar warning signs such as poor spelling and bad grammar. Elliott said it also accelerates the investigative work criminals undertake after gaining access to an account, helping them locate information that supports a convincing social engineering attempt.
The consequences reach beyond the diverted money. Businesses should count the staff time spent trying to recover funds, investigate the cause, and determine whether staffing, procedures or validation need to change, Elliott said. Preventing another incident can require further spending.
“Companies really underestimate the reputational cost of payment fraud,” Elliott said.
A customer or vendor who associates a company with a compromised email account and lost payments has a reason to warn others. Elliott described word of mouth as a source of damage that businesses should include when assessing the full cost of an incident.
Prevention also matters because recovery is difficult. Fraudsters often remove money as soon as it reaches the wrong account, Elliott said. A business that believes it paid correctly might learn of the diversion only when a vendor reports that the funds never arrived.
“You have the control,” Elliott said of the period before funds leave. Once the payment is sent, the opportunity to intervene can disappear.
Trust Moves Ahead of the Payment
Elliott’s framework begins with three checks, including establishing who the business is, validating who controls the receiving account and authenticating the payment instruction. A legitimate email account alone provides insufficient assurance because criminals can use it to enter a real invoice conversation.
Faster settlement puts those checks under more pressure. Authentication before a payment has to slow down as payments get faster, Elliott said. Businesses need controls earlier in the payment life cycle and must decide how to balance speed, efficiency and ease of use against their own risk tolerance. That requires a risk assessment rather than applying the same checks to every transaction. The aim is to identify where verification is needed while allowing legitimate payments to keep moving efficiently.
“When the money moves in seconds, because that’s how quickly we’re moving money nowadays, the prevention window is the most important window that you have,” Elliott said.
Trust also requires attention as a payment moves through the process. Businesses should examine behavioral and transactional signals and ask whether activity makes sense for the company and its communications, Elliott said. A departure from expected behavior warrants investigation.
“Good fraud controls shouldn’t make every payment harder,” Elliott said. “They really should just make the risky payment harder.”
Education supports that judgment. Businesses should treat fraud prevention as an ongoing risk assessment, using what they learn to define and reevaluate controls, Elliott said. Employees who do not understand a multifactor authentication code also lack the knowledge needed to protect it from fraudsters.
“Fraud prevention isn’t static,” Elliott told PYMNTS.
Watch the full interview with Katie Elliott to learn more about:
- How AI helps fraudsters imitate legitimate business conversations and redirect payments.
- Why faster settlement requires businesses to authenticate payment instructions earlier.
- How education, risk assessments and behavioral signals help businesses decide where to add scrutiny.
For all PYMNTS B2B coverage, subscribe to the daily B2B newsletter.
