Fake bosses, fake vendors: payment fraud with AI
Business email compromise and fake invoices cost organisations real money. A few simple payment rules stop most of it.
In 60 seconds
Fake bosses, fake vendors: payment fraud with AI
Business email compromise and fake invoices cost organisations real money. A few simple payment rules stop most of it.
Common patterns
| Pattern | What it looks like |
|---|---|
| Fake boss | "This is the CEO. I need an urgent, confidential transfer for an acquisition." |
| Changed bank details | A 'vendor' says they have a new bank account and asks you to update it before the next payment. |
| Fake invoice | An invoice that looks real, for a service you may or may not have received, with slightly different payment details. |
| Invoice in a real thread | The attacker replies inside a real email conversation with a vendor, so it looks completely normal. |
| Payroll change | An 'employee' asks HR to change the bank account for their salary. |
| Gift cards | A 'manager' asks a staff member to buy gift cards for clients and send the codes. |
How AI makes this worse
- Invoices, letters and emails that copy a vendor's style perfectly.
- Quick summaries of a stolen mailbox, so the attacker knows who pays whom, and when.
- A cloned voice to 'confirm' the request by phone.
- Messages in the vendor's or employee's own language and tone.
Controls that work
- 1
Dual approval
Payments above a set amount need two people. The second person checks the details independently, not just the email. - 2
Verify bank changes by callback
Call the vendor on a number from your vendor records or contract, never from the email or invoice that asked for the change. - 3
Hold new payees
New or changed bank details wait a set period and get a second check before the first payment. - 4
No exceptions for urgency or secrecy
Urgent and confidential requests follow the same process. Write this down. - 5
Separate duties
The person who adds or changes a vendor is not the person who approves the payment. - 6
Confirm salary changes in person
Payroll bank changes are confirmed through the HR system or in person, not by email alone.
- Bank change accepted by email reply
- One person creates the vendor and pays
- "The CEO said so" skips approval
- Phone number taken from the invoice
- Bank change confirmed by callback to a known number
- Different people create, approve and release payments
- Every request follows the same rules
- Phone number taken from your own vendor master records
Watch and read more
Lab
A one-page vendor bank-change procedure, tested against two fake scenarios.
The problem
Write a one-page procedure for handling a change to a vendor's bank details. Use a made-up company if you prefer. Include:
- Who may receive the request and who must approve it.
- How to verify it (which number, from where).
- How long a new payee is held, and what happens during the hold.
- What to do if something looks wrong, and who to report to.
Then test your procedure on paper against two scenarios:
- A: A request arrives inside a real, months-old email thread with your vendor, with a perfect PDF letter on the vendor's letterhead.
- B: The 'vendor' calls first, sounding like your usual contact, then sends the email.
For each, write where your procedure would stop the fraud.
You are done when
Hard questions
Try to answer before you reveal. If you can answer these, you understood the lesson.
Q1Why is a request inside a real email thread so dangerous, and what does it tell you?Reveal
It looks completely normal: the right people, the right history, the right tone. It usually means a mailbox (yours or the vendor's) has been compromised, so the attacker can read and reply. Content checks fail here. Only an independent callback to a known number, and a report to IT so they can investigate the mailbox, will help.
Q2How could attackers get around a callback rule, and how do you protect against that?Reveal
They could try to change the phone number in your vendor records first (for example with an earlier "please update our contact details" email), or call the helpdesk to redirect a number. Protect the vendor master data itself: changes to phone numbers and emails need the same verification and approval as bank changes, and are logged.
Questions people ask
We are a small business with two people. How can we have dual approval?
Keep it simple: the person who enters a payment and the person who releases it should be different when possible. If you are alone, use a waiting period for new payees and always call back on a known number. Many banks also let you set approval rules or limits for new beneficiaries; ask yours.
The vendor is annoyed that we call to confirm. What do we say?
Explain that it protects them too: if fraudsters redirect payments, the vendor doesn't get paid. Most businesses understand. You can tell vendors in advance that you will always confirm bank changes by phone.
What if the attacker is inside a real email thread with the vendor?
That means someone's mailbox may be compromised, yours or theirs. The email will look perfect. That's why the callback must use a number from your own records, not from the thread. Tell the vendor and your IT team.
Can we get the money back?
Sometimes, if you report very quickly. Contact your bank at once and report at 1930 or cybercrime.gov.in. There is no guarantee, which is why prevention matters most.
Lesson test
5 questions. Get 3 right (60%) to pass and complete this lesson.