Is Your Invoice a Deepfake?

Accounts payable sits at a specific intersection of trust and timing. AP teams process invoices, manage supplier banking details, and execute payments – often under pressure to keep things moving. For attackers, that combination is close to ideal.

Most successful fraud doesn’t involve into systems. It involves impersonation: posing as a trusted executive, a known supplier, or a familiar internal colleague to redirect a payment or update bank details before anyone notices.

AI has made that impersonation dramatically more scalable. Where it once took skill and time to craft a convincing request, tools are now widely available that automate the research, writing, and contextual tailoring that makes fraud blend into normal AP workflows.

Emails that blend into normal workflow

Traditional phishing relied on volume and imperfection. AI has changed that. Modern business email compromise arrives grammatically correct and written in the specific tone of whoever is being impersonated. Emails reference active projects, current invoice numbers, and real supplier relationships. For AI teams processing high volumes of routine communications, that level of familiarity is exactly what lowers the guard.

Invoice and payment redirection

One of the most common patterns involves payment redirection. Attackers intercept a legitimate invoice exchange and quietly alter the destination account – then send a brief message claiming a supplier has updated its banking details. The surrounding content looks entirely legitimate because in many cases it’s drawn from real correspondence. 

Voice cloning and the removal of the last reliable check

Email isn’t the only channel being exploited. AI voice cloning tools can replicate a person’s voice from a short audio sample, making it impossible to leave convincing voicemails or place calls that sound exactly like a known executive. For AP teams accustomed to verbal approvals on high-value or urgent payments, this removes one of the few remaining verification methods that email security alone cannot address.

By mid-2024, an estimated 40% of business email compromise phishing attempts were already AI-generated. That share has grown since.

Security awareness training still matters and remains worthwhile. But AI has changed what AP teams are actually up against. Modern fraud attempts no longer contain the signals that training programs once focused on: awkward phrasing, mismatched branding, generic greetings, or obvious urgency.

When a fraudulent request is indistinguishable from a legitimate one, placing the burden of detection on an individual team member puts it in the wrong place. The organizations that reduce this risk are not asking staff to be more suspicious. They’re building verification processes that work independent of how convincing a message looks.

Any request to change banking details, or to approve an urgent payment outside the normal cycle, should require secondary confirmation through a known independent channel – not a reply to the same email thread. Calling a supplier on a number already on file, or confirming with a colleague directly, breaks the impersonation chain regardless of how convincing the original request appeared. This step doesn’t require technology. It requires a written procedure and the team’s habit of following it.

Restricting access to financial systems and enforcing multi-factor authentication limits the damage a compromised account can cause. If an attacker gains access to a vendor’s email, MFA requirements on the receiving end creates a friction that can slow or stop a fraudulent charge before any money moves.

Fraud prevention improves when staff feels safe questioning requests – including from senior leadership. A team member who pauses a payment to verify it is not being obstructive. They are doing exactly what good process requires. Building that culture starts with leadership making clear that slowing down on high-risk actions is always the right call.

Article adapted from The Technology Press.