What AI-Assisted Vendor Fraud Changes About Accounts Payable
What AI-Assisted Vendor Fraud Changes About Accounts Payable
Vendor payment fraud has become considerably more common. The Association for Financial Professionals reported in its 2026 survey that 76% of U.S. organizations experienced attempted or actual payments fraud during 2025, and that 74% of those organizations were affected by business email compromise. The FBI's Internet Crime Complaint Center logged 24,768 business email compromise complaints in 2025, with reported losses of roughly $3 billion. Host Merchant ServicesAldoMedia
The role of AI in this is specific and worth stating plainly. It has not produced a new category of fraud. What it has done is lower the skill required to produce a convincing fake invoice or impersonate a legitimate vendor. The schemes are the same ones finance teams have dealt with for years. What changed is that the signals people previously relied on to identify them are considerably less reliable. PathQuest Solutions
There is a further shift worth noting. Executive impersonation appears to be declining while vendor and third-party impersonation is increasing, which is generally read as finance teams having become better at recognizing a fake message from a CEO. A message from a vendor an organization pays every month receives less scrutiny than a message from the chief executive. Host Merchant Services
What stopped working
For a long time, the practical defense against a fraudulent invoice was that it looked wrong. Awkward phrasing, a logo slightly off, formatting that did not match previous invoices from the same vendor, an email address with a character substituted.
Those signals have weakened. A document can now be produced that matches a vendor's prior invoices closely, and correspondence can be written in a register that matches how that vendor normally writes.
The underlying point is that an invoice that appears entirely correct provides no assurance if the payment is directed to a fraudulent account. Appearance was never a control. It functioned as one because producing a convincing forgery used to be difficult. Host Merchant Services
The patterns that show up in account payable
Several scheme types recur: fake vendors submitting invoices or W-9s directly to an accounts payable email address, executive impersonation intended to initiate a payment, the same invoice resubmitted with small variations to avoid exact-match detection, fictitious vendors created in the vendor master file, vendor impersonation intended to redirect payment, and large invoices split into smaller ones to fall below an approval threshold. PathQuest Solutions
A fake vendor sends an invoice or W-9. The request arrives through the normal accounts payable channel and may include a professional-looking invoice, W-9 or both. Because these are documents AP teams routinely receive, the request can appear legitimate. A W-9 by itself does not establish that the vendor has a legitimate business relationship with the company.
An executive appears to forward a bill for payment. The message appears to come from the CEO or another executive and asks the AP team to pay an attached or forwarded invoice. Because executives legitimately send bills to accounting, the request may not initially appear unusual. The invoice should still go through the company's normal vendor verification and approval process.
A change to vendor banking details. The request arrives as an ordinary message, sometimes from a compromised mailbox belonging to the real vendor, which is what makes it credible. In the records, the change appears as an edit to the vendor master file, often with no documentation attached.
The controls that still work are procedural
These controls generally do not require new technology. They require consistency and a willingness to slow a payment down, since these schemes depend on urgency. Host Merchant Services
Verify banking changes through a different channel than the request arrived in. If the request came by email, confirmation happens by telephone to a number already on file, not a number provided in the message. This single step addresses the most common variant.
Treat the vendor master file as a controlled record. Additions and changes are documented, and the person who can modify vendor banking details is ideally not the same person who releases payments.
Require a W-9 and a contract before the first payment. This is the same record-keeping discussed in the context of 1099 reporting, and it serves a second purpose here: a phantom vendor is difficult to create when documentation is required at setup.
Review payments by payee, not only by transaction. Split invoices and duplicate submissions are visible in an annual total and generally not in an individual entry.
One survey finding is worth noting alongside this: only 17% of organizations reported using AI-based tools against payment fraud, while attackers are using it more extensively. That gap is real, though for most small and mid-sized companies the more accessible improvement is the procedural one rather than the software one. Host Merchant Services
Where it gets identified after the fact
Not every fraudulent payment is prevented. A well-run monthly close is often where one is identified, usually through one of three routes.
Bank reconciliation, where a payment appears that does not correspond to an expected obligation. Accounts payable review, where a bill shows as unpaid because the funds went elsewhere. And vendor balance review, where the total paid to a vendor does not agree with what that vendor's statement shows.
The interval matters here. A payment identified within two weeks of month-end is a different situation from one identified during tax preparation the following spring.
Where Toki Bookkeeping fits in
Toki Bookkeeping maintains accounts payable as part of ongoing monthly bookkeeping, with vendor bills tracked, due dates managed and payments scheduled, and vendor records kept current throughout the year. Before payments are processed, bills are submitted to the client's designated approver to verify that they are legitimate and approved for payment.
Each month-end close is prepared by one bookkeeper and reviewed by a second, and financial statements are delivered within 15 days of month-end. That structure is what makes the review routes above regular rather than occasional.
Payment authorization and information security controls sit with the company and its IT provider rather than with the bookkeeping function. The bookkeeping layer contributes accurate vendor records, a consistent bill approval process, consistent reconciliation and a review interval short enough for an unexpected payment to be identified while it is still recent.
This separation between preparing a payment and approving it provides an additional control against fraudulent or unauthorized bills.
If vendor records at your company have not been reviewed recently, that review is generally straightforward to complete.
Frequently Asked Questions
What is a business email compromise?
Business email compromise is a scheme in which an attacker uses email to persuade someone at a company to send a payment or change payment instructions. It often involves impersonating a vendor or an executive, and in many cases the message is sent from a genuine mailbox that has been compromised, which is what makes it credible. It generally does not involve malware, which is why security software alone does not reliably prevent it.
How can a business verify a vendor's request to change bank details?
The established approach is out-of-band verification, meaning confirmation through a channel different from the one the request arrived through. If the request came by email, the confirmation is a telephone call to a number already held in the vendor file rather than a number supplied in the message. Applying this to every banking change, without exception based on how routine the request appears, is what makes it effective.
Does AI-generated invoice fraud require new software to prevent it?
Not necessarily. Most of the effective controls are procedural: verifying banking changes out of band, restricting who can edit the vendor master file, separating that role from payment release, and requiring documentation before a new vendor is paid. Specialized detection tools exist and can add value at higher payment volumes, though the procedural controls generally address the most common scheme types.
Can a bookkeeper prevent payment fraud?
Bookkeeping contributes to detection more than to prevention. Payment authorization and email security sit with the company. What the bookkeeping function provides is an accurate vendor master file, reconciliation of every account each month, and a review cycle short enough that an unexpected payment is identified while the details are recent and recoverable action is still possible.