A board member at Infrabuild, one of Australia's largest steel manufacturing, recycling and distribution groups, recently handed Tariq Mushtaq's team an AI-generated invoice and asked them to prove it wouldn't clear the company's accounts payable process. It wasn't a hypothetical exercise. As Australia's Scams Prevention Framework Act continues its sector-by-sector rollout, finance leaders are under growing pressure to show their controls hold up against exactly the kind of fraud regulators are now writing rules around.
Most finance teams don't test themselves this way. They wait for an external audit, a near-miss, or a headline about someone else's fraud to trigger a review of their own defences. Infrabuild's board went looking for the gap before a fraudster did.
"We had to go through and do the exercise of how many controls we had in place to ensure it wouldn't go through our systems," says Mushtaq, Group Financial Controller at the Australian steel and manufacturing group. The test mattered because of what Infrabuild's finance function actually looks like day to day: an accounts payable and group accounting operation that touches everything from four-person distribution depots to sites with a thousand staff, spanning manufacturing, recycling, steel production and distribution under one group.
"Any change you make will have a much bigger impact across all the businesses," he says.
At that scale, no financial controller can personally check every payment before it goes out, so the real test of a control environment is whether it holds up without them in the room. For Mushtaq, that means a culture where the process doesn't bend for seniority rather than more oversight from head office.
"It doesn't matter where the request is coming from, it has to follow the same process," he says, describing how Infrabuild's finance team pushes back on non-routine payment requests regardless of who sends them, backed by internal audit recommendations they can point to when challenged.
That posture matters more than most finance leaders admit. Only 25% of Australians say they would feel comfortable challenging a payment request from someone senior, according to Eftsure's 2026 Australian payment security research, exactly the structural weak point that hierarchy-based fraud is designed to exploit. For a finance function spread across a large site network, that's not an abstract number: it's a single AP officer, hundreds of kilometres from head office, deciding in the moment whether to push back on an instruction that looks like it came from the top.
The timing of the board's test wasn't coincidental. Our research also found 90% of Australians believe AI-generated scams are harder to detect than traditional fraud attempts, a view that matched what Mushtaq's team found when they pulled the test invoice apart. It also matches what even digital forensics experts are saying about deepfake media.
The tell wasn't in the document. A well-made AI-generated invoice can look identical to a genuine one, right down to formatting and tone. The tell was whether the surrounding approval chain caught a request that looked legitimate but wasn't. That's the shift AI forces on finance teams: the document itself stops being a reliable signal, so the process around it has to do more of the work.
Scale also shapes how Infrabuild approaches new technology. Mushtaq's team allocates 10 to 15% of its time to process improvement and transformation work every year, and even with that dedicated capacity, he's cautious about how quickly AI gets folded into live financial processes. "Start small, start using into smaller projects, smaller processes, and gradually build over a period of time," he says. "It is not a big bang one day solution."
For a business where one change can touch a thousand-person site and a four-person site in the same rollout, that caution isn't slow-moving bureaucracy. It's a proportionate response to how much a misstep can cost when it's amplified across hundreds of locations at once. A control gap that would be a minor inconvenience at a single-site business becomes a much bigger exposure once it's replicated across a network this size.
The mindset has to keep up with how fast the threat is changing
For other finance leaders, Mushtaq's advice is less about acquiring a new skill and more about a change in posture: "They need that mental and physical capacity to pay enough attention to what changes are coming along the way and make sure they are keeping up."
Controls that were sufficient 12 months ago aren't a guarantee of anything today, and waiting for a regulator, an auditor or a fraudster to point that out is the expensive way to find it out.
The board member's invoice test was Infrabuild checking that for themselves, on their own terms, rather than waiting for someone outside the business to find the gap first.
Read more about what continuous controls for outgoing payments look like and how to embed them in your organisation.
Tariq Mushtaq is Group Financial Controller at Infrabuild.
