Each month, the team at Eftsure monitors the headlines for the latest accounts payable (AP) and security news. We bring you all the essential stories in our cyber brief so your team can work safer and smarter.
Schwab and JPMorgan block outside AI agents from moving client money
Charles Schwab and JPMorgan Chase are blocking outside AI agents that try to move customer money, The Next Web reports, citing comments to Bloomberg. Schwab CEO Rick Wurster said the blocks happen "in the tens and twenties" each week: "We can't control it, the client can't control it, something could go wrong and who's liable?"
JPMorgan's Jamie Dimon warned of "rogue agents." Experts quoted by CFO Dive recommend narrow agent permissions and human approval for payments, with the approval naming the recipient and amount.
Reuters: AI agents breached more than 100 company websites for about $50 each
A Chinese-speaking hacker used open-source AI agents to break into the websites of more than 100 companies, according to a Reuters report on new research from Norwegian security firm NorForge.
The campaign began in late September and targeted e-commerce sites in the US, Canada, Australia, and Japan, with more than 1,200 sites attempted. Successful intrusions typically took around 23 hours, and NorForge researcher Snorre Fagerland estimated the cost at about $50 per successful breach. "It's not script kiddie stuff," he said.
Reuters also reports another hacker using the same tool stole a trove of credit card data. The risk extends to vendors: Cummins said the affected site was operated by one of its third-party vendors.
Mobile, Alabama loses nearly $15 million to suspected payment fraud
The City of Mobile transferred nearly $15 million to a fraudulent entity earlier this month in a payment linked to construction of its downtown arena, FOX10 reports. Officials haven't confirmed how the scam worked, and Mayor Spiro Cherigotis said cyber insurance "won't make Mobile whole."
The FBI is investigating. Grady Fisher of the FBI's Birmingham Division said: "The first thing we would tell any business or local government entity is to build a culture of verification." Mobile isn't alone. Liberty, Texas lost about $600,000 this month after paying a request from an email domain impersonating a vendor the city genuinely owed. Because the request matched a real debt, nothing looked out of place.
Bloomberg: AI helps push global scam losses to an estimated $442 billion
A Bloomberg investigation finds AI is helping scam operations grow into an economy bigger than the global cocaine trade, with an estimated $442 billion lost to scams across 42 countries, according to the Global Anti-Scam Alliance.
Nearly two-thirds of victims pay within 24 hours of first contact, and Bloomberg reports that phishing pages hosted on the free tiers of developer and AI app-building platforms rose more than fourfold to 10,600 over two years. That speed shortens the window finance teams have to catch a fraudulent request before money leaves the account.
Read our full write-up on what Bloomberg's findings mean for finance teams.
Alameda County agency sues insurer over $500,000 email fraud loss
The Alameda County Transportation Commission is suing its insurer after a claim for a $500,000 email fraud loss was denied, the San Francisco Standard reports.
A scammer took over a contractor's email account and asked the commission to send payments to new bank details. In September 2024, staff sent a $500,000 check to an Illinois address, which was cashed and converted to cryptocurrency. A second check for $2.5 million was frozen. The insurer, an AIG subsidiary, argues the loss isn't forgery.
Nacha: Same Day ACH volume up 37% as demand for faster payments grows
Same Day ACH volume rose about 37% year over year in the third quarter of 2026 to 470.4 million payments, with value up 32% to $1.3 trillion, according to Nacha figures reported by PYMNTS.
B2B ACH volume grew 9.7% to around 2.3 billion payments as organizations continue moving away from checks. Nacha President and CEO Jane Larimer said the figures "show the significant role that Same Day ACH plays in helping to meet the nation's faster payment needs." As more B2B payments settle the same day, finance teams have less time to recall a payment sent to the wrong account.
Datarails: AI verification eats up 26% of finance teams' workweek
Finance teams spend an average of 26% of their working time checking or correcting AI-generated outputs, according to a new Datarails survey reported by CFO Dive.
The survey of 270 CFOs and finance leaders at large US organizations found 96% spend at least a tenth of their time on this work. Lack of auditability is the biggest barrier to trusting AI with mission-critical tasks (75%), followed by accuracy and hallucination concerns (71%). Only 7% say their finance function is fully ready to use AI across all workflows.
