Each month, the team at Eftsure monitors the headlines for the latest accounts payable (AP) and security news. We bring you all the essential stories in our cyber brief so your team can work safer and smarter.
Schwab and JPMorgan block outside AI agents from moving client money
Charles Schwab and JPMorgan Chase are blocking outside AI agents that try to move customer money, The Next Web reports, citing comments to Bloomberg.
Schwab CEO Rick Wurster said the blocks happen "in the tens and twenties" each week: "We can't control it, the client can't control it, something could go wrong and who's liable?" JPMorgan's Jamie Dimon warned of "rogue agents." Experts quoted by CFO Dive recommend narrow agent permissions and human approval for payments, with the approval naming the recipient and amount.
Reuters: AI agents breached more than 100 company websites for about US$50 each
A Chinese-speaking hacker used open-source AI agents to break into the websites of more than 100 companies, according to a Reuters report on new research from Norwegian security firm NorForge.
The campaign began in late September and targeted e-commerce sites in the US, Canada, Australia, and Japan, with more than 1,200 sites attempted. Successful intrusions typically took around 23 hours, and NorForge researcher Snorre Fagerland estimated the cost at about US$50 per successful breach. "It's not script kiddie stuff," he said.
Reuters also reports another hacker using the same tool stole a trove of credit card data. The risk extends to vendors: Cummins said the affected site was operated by one of its third-party vendors.
Bloomberg: AI helps push global scam losses to an estimated US$442 billion
A Bloomberg investigation finds AI is helping scam operations grow into an economy bigger than the global cocaine trade, with an estimated US$442 billion lost to scams across 42 countries, according to the Global Anti-Scam Alliance.
Nearly two-thirds of victims pay within 24 hours of first contact, and Bloomberg reports that phishing pages hosted on the free tiers of developer and AI app-building platforms rose more than fourfold to 10,600 over two years. That speed shortens the window finance teams have to catch a fraudulent request before money leaves the account.
Read our full write-up on what Bloomberg's findings mean for finance teams.
CommBank and ANZ warn businesses about payment redirection scams
CommBank says payment redirection scams are getting harder to spot as scammers use AI tools and compromised email accounts to blend into normal invoice traffic. "In some cases, they might monitor invoices for months before acting," said Shannon Brown, a senior fraud and scams manager at CommBank.
ANZ issued a similar warning, with Cosi De Angelis, General Manager of Specialist Sales, saying BEC, payment redirection, and impersonation scams "remain among the most significant threats facing businesses today." ANZ reported a 24% fall in customer scam losses but didn't separate business losses from consumer losses. National data tells a different story for businesses: reported payment redirection losses rose 9.3% to $166.8 million in 2025, according to the National Anti-Scam Centre.
IMF and World Bank launch "Bangkok Blueprint" against cyber-enabled fraud
The IMF and World Bank have released the Bangkok Blueprint, a global roadmap for fighting online financial fraud, developed with the Bank of Thailand and launched at the institutions' annual meetings in Bangkok on 14 October.
The framework sets out 12 policy considerations and calls for clear accountability across banks, telcos, digital platforms, and social media. Bank of Thailand governor Vitai Ratanakorn said Asia accounted for 67% of global fraud losses in 2024, and IMF managing director Kristalina Georgieva warned AI is putting "the potential of digital fraud on steroids."
