Transcript
Ryan: Picture this. Your AP team gets an email from a vendor you've worked with for fifteen years. Right sender, right signature, and they even reference an invoice that's actually due. They're updating their bank details and they've attached a signed letter from their CFO, a bank statement, and a phone number so you can call and confirm.
Your team runs every check-in the playbook. Everything comes back clean, but the payment still goes to a fraudster. I'm going to show you exactly how that happens. The three tactics fraud analysts say they see over and over and the gaps in your payment process that attackers are counting on.
First, forget most of what you've been taught about spotting scams, bad grammar, unusual urgency, obvious red flags. That era is over. Today's attackers operate like legitimate businesses. They have playbooks, KPIs, escalation paths, and dedicated tooling.
AI has given them speed and scale, but the technology is only part of it. Their real weapon is patience combined with social engineering. They study your business, your vendor relationships, your payment timing, your approval workflows, and they go after the people who actually move money. CFOs, finance leaders, and AP team.
Everything in this video comes from fraud analysts at payment protection platform, Fsure. In other words, the people who have a front row seat to these very fraud attempts. Tactic one is the entry level, but low cost move. A spoofed email address.
The fraudster emails your AP team from an address built to look like a real vendor's. One character changed or a domain swap you'd never catch at a glance. And the first request is deliberately boring. A remittance contact update, a change to the notification email, an invoice confirmation.
Nothing that triggers alarm bells because nothing is being asked for yet. Their goal is to establish legitimacy and start learning your payment timing. A spoof only needs to survive casual inspection, and most AP processes don't independently verify the sender. Once that small change gets logged and processed, the fraudster is inside your AP correspondence flow.
That right there is the foothold. Tactic two is a step up. The attacker registers their own domain that closely mirrors the vendors. The differences are tiny, maybe a single letter or a hyphen, a dot co instead of a dot com, for example.
The attacker builds the whole package matching email signatures, sometimes a basic website, consistent communication patterns. And once that lookalike domain lands in your AP team's address book or sender allow list, every future email passes without ScreenTeam. Same playbook as spoofing from there, but this foothold is a little more durable. Tactic three is more sophisticated.
The fraudster gains access to a legitimate inbox at your vendor, usually through phishing, credential stuffing, or multifactor bypass on a vendor's end, and operates inside it. Think about what that means for your team. Every email now comes from the real domain, the real sender, and the real signature. From your side, every external indicator is correct because it's the real account.
The attacker doesn't act right away. They watch. They learn who talks to whom, the normal cadence, when invoices go out, how payment changes get handled. They might even set up inbox rules to quietly hide their activity from the actual legitimate user.
So when the bank account change request finally lands, it comes from a trusted contact on a trusted domain with all the right context. Every surface level check returns a clean result. Across all three tactics, the playbook unfolds the same way. First, contact is pretty harmless, usually a small administrative Then over three to six months, the fraudster builds the relationship.
They're responsive, cooperative, and consistent. They mirror the vendor relationship you expect in tone, timing and behavior. By the time the bank change request arrives, they often know what payments are coming and the request shows up wrapped in validation signed letters from someone posing as the vendor CFO, bank statements, identity documents, even a phone confirmation from someone playing the vendor rep. On the surface, everything looks process compliant.
So where does this actually beat your controls? Four places. One, trust built over time. Once a contact feels familiar, your team naturally lowers its guard and the request feels routine.
Two, overreliance on surface level validation. Signed documents, bank statements, phone confirmations, all of them can be fabricated and none of them independently prove a request is legitimate. Three, inconsistent process adherence under pressure. Controls don't usually fail because they don't exist.
They fail because they aren't followed consistently during busy periods or with long standing vendors. And four, point in time checks. A lot of banking mechanisms or business registry validation, for example, can confirm that an account name lines up with an account. They don't tell you whether the person making the request is who they claim to be.
Attempts like this can be caught and there's a consistent pattern in how they fail when the payment process doesn't depend on a single check. Remember the individual artifact in these attacks can be faked. The documents, the sender, even the phone call. There are already widely reported cases where businesses have lost millions to deepfake videos and phone calls.
What's far harder to fake is everything at once. When verification runs across multiple independent layers, a fraudulent request has to be all of them. And in practice, it rarely does. The amounts at risk in attempts like these range from few hundred dollars to several million, and most would have been paid out if the request had only been checked at a single point in time.
So three principles verification has to be multilayered. No payment decision should rest on factor, one document, or one channel, no matter how complete the paperwork looks. Controls have to be continuous rather than point in time. Vendors verified every time they're added, changed, invoiced, or paid, not just once at onboarding.
And process adherence has to be consistent, especially at month end, including with vendors you trust because fraud doesn't live inside your controls. It lives in the gaps between them, between onboarding and payment between systems and human judgment and between compliance and true verification. If you want to see what independent continuous verification looks like in practice, the team at Fsure has a demo link below. And if this was useful, subscribe.
