The final weeks of the year can put finance teams under considerable pressure. Payment runs increase, approvers take leave and suppliers push to settle outstanding invoices before the holiday shutdown. For fraudsters, these conditions create opportunities to slip fraudulent payment requests into an already busy workflow.
In Eftsure's November webinar, Fraud on the frontline: End-of-year scams to watch for, Michelle Cram, VP of Customer Operations at Eftsure, shared insights from the company's frontline fraud prevention team. The discussion explored the tactics appearing in recent payment fraud attempts, why seemingly routine supplier requests can carry significant risks and how finance leaders can strengthen their controls before the end of the year.
One message stood out: effective fraud prevention depends less on spotting suspicious-looking requests and more on having consistent, independent verification processes that hold up under pressure.
Key takeaways from the webinar
Year-end pressure creates opportunities for fraud. Higher payment volumes, staff leave and urgent supplier requests can make fraudulent instructions harder to detect.
Fraudulent requests often look routine. Compromised supplier emails, convincing invoices and apparently legitimate bank detail changes can conceal payment redirection attempts.
Contact detail changes are a significant warning sign. A fraudulent email address or phone number can allow an attacker to intercept subsequent verification attempts.
Approval isn't the same as verification. Internal authorisation and supporting documents don't necessarily confirm that the receiving bank account belongs to the intended supplier.
Consistent controls matter most under pressure. Independent verification, documented approval arrangements and reviews of recently changed supplier details can help reduce exposure before the holiday shutdown.
Why payment fraud risk increases at year-end
The holiday period brings changes to normal finance operations. Payment volumes can rise as businesses settle outstanding invoices, while leave arrangements mean employees may be approving transactions or managing supplier relationships outside their usual responsibilities.
Michelle described the combination as "more payments, more pressure, and fewer people checking." These conditions can make fraudulent requests harder to distinguish from legitimate business activity, particularly when teams are working against tight deadlines.
Eftsure's frontline experience suggests that fraud attempts frequently align with periods of heightened financial activity. During the webinar, Michelle noted that June was the busiest month for attempted fraud cases handled by her team in 2026, while October recorded almost A$8 million in prevented fraudulent payments.
For Michelle, the concern isn't necessarily that criminals are using entirely new tactics. It's that familiar fraud methods can become more effective when employees have less time to investigate unusual requests and fewer colleagues available to provide a second opinion.
The fraud tactics finance teams should watch for
Many payment fraud attempts now resemble ordinary supplier communications rather than obvious scams. Fraudsters may use compromised email accounts, convincing documentation or carefully timed requests to redirect payments without attracting attention.
Michelle highlighted three tactics that finance teams should be particularly alert to during the holiday period.
Business email compromise and supplier impersonation
Michelle explained that business email compromise remains a significant risk because fraudulent instructions can arrive through an email account that genuinely belongs to a trusted supplier.
"The email is real. It's just not the vendor sending it," she said, describing how criminals can take control of legitimate mailboxes and introduce fraudulent instructions into existing conversations.
Other attacks rely on lookalike email domains that closely resemble legitimate supplier addresses. These differences can be difficult to notice, particularly when employees review requests on mobile devices or during busy payment runs.
Both methods exploit the same weakness: the assumption that a familiar sender or existing email conversation is sufficient evidence that a request is genuine.
Fraudulent invoices and bank detail changes
A fraudulent invoice doesn't always contain obvious errors. It may reference legitimate goods or services, match an existing purchase order and carry the correct amount, with only the destination bank account altered.
Michelle described how criminals increasingly support fraudulent bank detail changes with convincing documentation, including signed letters, bank statements and apparent confirmation from senior executives. These materials may create the impression that a request has already been checked, even when the information originates from the attacker.
The Australian Competition and Consumer Commission's Scamwatch warns businesses about scams involving fraudulent invoices and altered payment details. Independently confirming changes before processing payments remains an important safeguard.
Contact detail changes that enable later fraud
One of Michelle's strongest warnings concerned changes to supplier contact information. While finance teams often scrutinise bank detail updates, requests to change an email address or phone number may receive less attention.
This creates an opportunity for fraudsters to redirect the verification process itself. If an attacker succeeds in replacing a supplier's legitimate contact details, future confirmation requests may be sent directly to the criminal, making subsequent fraudulent instructions appear genuine.
"Once I control the contact details, I control the conversation. Every check you try to do after that comes straight back to me."
The webinar highlighted cases in which attackers first attempted to alter contact details before introducing fraudulent banking instructions. By making the initial request appear routine, they could establish a seemingly legitimate communication channel for later transactions.
For finance teams, this means changes to supplier contact information deserve the same level of scrutiny as changes to bank account details.
Why AI makes familiar fraud tactics more convincing
Artificial intelligence is making impersonation attempts more difficult to identify through traditional warning signs. Fraudsters can use generative AI to produce convincing emails and documents, while voice cloning and deepfake technology can make fraudulent calls appear to come from trusted executives or suppliers.
Michelle emphasised that the underlying fraud method remains familiar. Criminals still need to convince someone to approve a payment or change account details, often by exploiting trust, authority or urgency.
"A voice or a face is no longer proof of identity," she said, reinforcing why independent verification matters even when a request appears to come from someone familiar.
The challenge is that employees can no longer rely on spelling mistakes, unusual phrasing or a recognisable voice to distinguish genuine requests from fraudulent ones. The Australian Signals Directorate's guidance on business email compromise reinforces the importance of independently confirming payment requests and changes to financial information.
For CFOs, this shifts the focus from training employees to recognise every possible impersonation technique towards ensuring that payment controls work even when a fraudulent request appears authentic.
Why approval alone isn't enough to prevent payment fraud
A recurring theme throughout the webinar was the distinction between approving a transaction and independently verifying its details.
Michelle explained that an invoice may have a valid purchase order, supporting documentation and the necessary internal approvals. Yet those checks don't necessarily establish that the bank account receiving the funds belongs to the intended supplier.
This becomes particularly important when a fraudster has manipulated supplier information earlier in the process. If the contact details used for verification have already been compromised, a seemingly thorough approval process may simply confirm information controlled by the attacker.
"Most traditional controls are point-in-time," Michelle said. "They validate information once. Fraud today lives in the gaps between controls."
Traditional controls often focus on individual stages of the payment process, such as supplier onboarding, invoice approval or payment authorisation. Fraud can occur between those stages, particularly when supplier details change after the original verification.
Continuous controls help address this exposure by applying verification and risk checks throughout the payment lifecycle, rather than relying solely on information confirmed at onboarding.
Five practical steps to strengthen payment security before the shutdown
Finance leaders don't need to overhaul their entire payment process before the holiday break. A focused review of existing controls can help identify weaknesses that become more significant when teams are operating with reduced capacity.
Drawing on the fraud attempts investigated by her team, Michelle recommended several practical measures businesses can implement before their final payment runs.
1. Tighten controls around supplier detail changes
Michelle recommended considering a temporary freeze on non-essential supplier bank detail changes during the shutdown period, or routing all changes through a designated person responsible for independent verification.
Any changes that must proceed should be confirmed using trusted contact information already held by the business. The same approach should apply to supplier email addresses and phone numbers, as seemingly minor contact updates can compromise the reliability of future verification attempts.
2. Document leave-period approval arrangements
Make sure employees know who has authority to approve payments while regular approvers are away, including transaction limits and escalation responsibilities.
Michelle highlighted the risks associated with informal leave arrangements, particularly when employees are covering unfamiliar responsibilities. Delegated approvals should preserve existing separation of duties, ensuring nobody can both amend supplier banking information and approve payments to the amended account.
3. Review recently changed supplier details
Before processing major year-end payments, Michelle suggested reviewing suppliers whose banking or contact information has changed within the previous 60 days.
Prioritise high-value payments, unfamiliar accounts and changes submitted shortly before payment deadlines. Where necessary, re-verify details through an independent channel rather than relying on the documentation or contact information supplied with the original request.
4. Establish a clear process for urgent requests
Urgency should never override payment verification requirements, even when a request appears to come from a senior executive or long-standing supplier.
Michelle encouraged finance leaders to establish a clear rule that unusual payment instructions must be independently confirmed. When verification isn't possible because a supplier has closed for the holidays, the payment should be held until the details can be confirmed safely.
5. Prepare an incident response plan
Even strong controls can't eliminate every risk. Finance teams should know exactly what to do if a suspicious payment is identified or funds are transferred to an incorrect account.
Michelle emphasised the importance of acting immediately when a fraudulent payment is suspected, particularly by contacting the bank as soon as possible. The Australian Cyber Security Centre provides guidance on reporting cybercrime, while Scamwatch offers resources for businesses affected by scams.
Building payment controls that hold up under pressure
The strongest fraud prevention processes aren't necessarily the most complicated. They're the ones employees can follow consistently, including during busy payment periods, staff absences and unexpected supplier requests.
Michelle highlighted three characteristics of businesses with effective payment controls: independent verification, consistent processes and visibility into changes or anomalies that may indicate fraud.
These safeguards are only effective when employees apply them consistently. Even organisations with established approval workflows can remain exposed if staff bypass verification steps to meet urgent payment deadlines.
"Most fraud that gets through isn't because there were no controls. It's because the controls weren't followed under pressure."
That requires more than a checklist completed at onboarding. Finance teams need reliable ways to identify changes, independently verify supplier information and confirm payment details before funds leave the business.
As the webinar reinforced, technology and human judgement work best together. Automated checks can help identify anomalies across large volumes of transactions, while independent verification provides an additional safeguard when information is inconsistent or a request requires further investigation.
For finance leaders, the end-of-year period is an opportunity to assess whether existing controls can withstand the pressures of a busy payment cycle. The objective is straightforward: ensure that every payment reaches the intended recipient, regardless of how convincing the original request appears.
Want to keep the conversation going? Here are further resources.
