AI-powered fraud is breaking traditional controls. Finance leaders must adapt
I spend a lot of time thinking about fraud, worrying about the fallout that happens when an attempt succeeds. A company loses cash, good people are let go from their jobs, and in the worst cases, organizations have to consider bankruptcy.
Processing Content
When I watch how quickly AI is changing the tools available to fraudsters, I take it seriously. Finance leaders who haven’t yet updated their mental model of what fraud looks like in 2026 are operating with a set of assumptions that no longer holds.
The rules have changed and so has the risk
The conventional approach to payment fraud focused on training accounting teams to spot suspicious cues. We taught people to watch email addresses closely because fakers rarely get them exactly right, and to be skeptical of any request that creates urgency. Those were reasonable defenses for a world where fraudsters worked with limited tools, and where a poorly worded email or a slightly wrong domain name was usually the tell.
With AI, that world is gone. The phishing emails I receive now are written the way people actually write to each other. They’re casual, contextually appropriate and free of the grammatical giveaways that used to make them easy to spot. More significantly, the threat has moved beyond email entirely.
A few weeks ago, I came across a news story about a finance employee who joined what appeared to be a Teams meeting with the CEO. The face and voice were right. The executive onscreen asked them to wire money. It was a deepfake, generated entirely by AI, and convincing enough that a real person made a real payment.
What struck me most was the speed. The progression from obviously fake to nearly indistinguishable took months, not years. If you’ve seen the AI deepfakes of Will Smith circulating recently, you know how good the technology has gotten. The skin texture and the way the facial muscles move are nearly imperceptible from the real thing. If you’re relying on visual confirmation of identity to authorize a payment, that reliance is now a vulnerability.
Fraudsters are also doing their research. They know what software you use, what banks you work with, and how your executives communicate. A lot of that information is publicly available, and finance teams inadvertently make it easier to find than they realize.
What finance leaders need to do
Many fraud controls assume that trust is the default. As AI makes deception more sophisticated, organizations need to change their approach and operate on the assumption that trust will be tested and, if possible, exploited.
The first change finance leaders need to make is to establish identity verification that doesn’t depend on digital channels. If you don’t have a code word or challenge phrase that your finance team uses to verify executive identity before authorizing payments, create one now. This sounds almost quaint against the backdrop of AI-generated deepfakes, but it works precisely because it’s analog. A fraudster on a Teams call can look and sound like your CEO, but doesn’t know the challenge question. A policy of calling back on a known cell phone number before authorizing any large or unusual transfer creates the same kind of verification that email and video can no longer reliably provide.
Vendor setup and payment authorization should be assigned to different employees, removing the single point of manipulation on which fraudsters depend. Banking information updates should require independent confirmation through trusted channels, never verified using contact details provided in the invoice itself. These aren’t new ideas, but inconsistent enforcement is where fraud finds its way in.
Security awareness training needs to happen more than once a year. Teams that understand how current fraud schemes actually work are harder to exploit.
Creating continuous controls with technology
Operational discipline creates the foundation, but technology makes fraud controls continuous rather than periodic.
Modern finance systems can record every document upload, edit, approval and payment action, creating audit trails that allow investigators to reconstruct events quickly. Automated anomaly detection can flag unusual vendor payment patterns, unexpected changes to banking details, or invoice amounts that deviate from historical norms before a payment is ever authorized.
Forward-thinking teams are adopting
Standardized workflows and improved visibility allow teams to find exceptions more quickly. When something is off, they can act right away instead of discovering it at the end of the quarter.
The window is closing
No organization is fully protected from fraud, no matter how sophisticated the controls. Google and Facebook each lost more than
What I’m watching right now is a window closing. The defenses that worked reasonably well two years ago are working less well today, and the pace of change on the fraud side is faster than most organizations have anticipated. Fraudsters are using AI to make their schemes harder to detect and defend against. Finance teams need to fight fire with fire by adding AI-powered fraud detection to their tech stack, and they need to start now.
Finance leaders who are still relying on the old rules of watching the email address, verifying through a secondary channel, and training people once a year are all still important. But, used alone, they’re no longer enough. Finance leaders need to pair that awareness and analog discipline with technology that can catch what a person, however well-trained, can’t see in time. The threat has changed. Finance controls need to change with it.
