Summary: AI is making invoice fraud and payment redirection harder to spot. Criminals can now produce convincing emails, realistic invoices and cloned voices that look and sound familiar. For UK SMEs, schools, care providers and local organisations, the answer is not asking staff to become human fraud detectors. It is building payment checks that work even when the request looks genuine.
It is easy to think invoice fraud starts with a dodgy-looking email.
Poor spelling. Strange wording. A logo that looks a bit off…
That still happens, but the fraud hitting finance teams now can look much cleaner than that.
A supplier appears to email with new bank details. A senior manager asks for an urgent payment. A contractor sends an invoice that looks exactly like the ones you have paid before.
Nothing feels wildly out of place.
AI has made fraud easier to write, easier to tailor and harder to spot. For organisations that handle regular payments, supplier details or purchase approvals, the question is no longer “would we recognise a scam?”
The better question is:
Would our payment process stop one, even if the message looked real?
Why finance teams are being targeted
Accounts payable sits in a risky place.
It deals with invoices, supplier changes, payment runs, approvals, deadlines and people chasing money. In a school, that might sit with the business manager. In a care provider, it might be the office manager or registered manager. In a small business, it might be the owner doing it between jobs, calls and everything else.
Attackers like that pressure.
They are not always trying to “hack the system” in the film-style sense.
Often, they are trying to get a trusted person to do something that looks normal:
* change supplier bank details
* pay a fake or altered invoice
* approve an urgent payment
* send payroll or finance information
* bypass the normal process because someone senior appears to have asked
This is why business email compromise, invoice fraud and payment redirection can be so damaging. They sit in the gap between cyber security, finance processes and human trust.
What AI-enhanced fraud looks like
Emails that sound like the right person
Older phishing emails often gave themselves away.
They sounded clumsy. They used odd wording. They pushed a generic message to thousands of people and hoped someone clicked.
AI changes that.
A criminal can now produce a well-written email in the style of a supplier, manager, client or colleague. The message can be polite, calm and specific. It can refer to a real project, a known supplier, a payment date or a previous conversation.
For a busy finance team, that familiarity lowers the guard.
Not because people are careless.
Because the message fits the working day.
Invoices that look familiar
Invoice fraud often works because the invoice looks boring.
Same supplier name. Same sort of layout. Same type of language. Same payment terms.
The only meaningful change might be the bank details.
Criminals may use information from a compromised mailbox, leaked documents, a previous invoice, Companies House, LinkedIn, a website, or a supplier relationship that is easy to work out from public information.
In some cases, the email thread may even be genuine. The attacker has simply stepped into the conversation at the right moment.
That is why “does this look real?” is no longer enough.
Voice cloning and fake approval calls
Voice used to feel like a safer check.
If in doubt, ring someone.
That is still good advice, but only if you use the right number and the right process.
AI voice cloning means criminals can create audio that sounds like a known person. That could be a voicemail, a short call, or a message claiming to be from a director, headteacher, owner, finance lead or client.
The danger is not just the technology.
It is the pressure around it.
“Can you sort this today?”
“I’m in a meeting, but this needs paying now.”
“Don’t hold this up.”
That sort of pressure has always been part of fraud. AI just makes the impersonation more convincing.
Why old red flags are not enough
Security awareness training still matters.
People should know how invoice fraud works. They should understand phishing, account takeover, payment redirection and the risks around supplier bank changes.
But training has to move on.
If we only teach people to look for spelling mistakes and suspicious links, we are preparing them for yesterday’s scam.
Modern fraud can be well written. It can come from a real mailbox. It can include accurate details. It can sound calm and professional. It may not contain a link at all.
That means the burden cannot sit with one person staring at an email and trying to decide whether it “feels right”.
The safer approach is to build a process where certain actions always need verification.
Not because staff are not trusted.
Because the process protects them.
Where UK organisations should tighten up
Bank detail changes need a separate check
Any request to change supplier bank details should be treated as high risk.
That does not mean suspicious. It means important enough to verify properly.
Do not confirm by replying to the same email thread.
Use a known phone number already held on file, not the number in the email. Speak to a trusted contact. Record who checked it, when they checked it and how it was confirmed.
This one habit can stop a lot of damage.
Urgent payments need a pause point
Fraud loves urgency.
The payment has to go today. The supplier is upset. The director is waiting. The deal depends on it. The school trip, care contract, building job or client matter needs sorting now.
Urgency should trigger a pause, not a shortcut.
A simple rule helps:
If the payment is urgent, unusual or outside the normal process, it needs a second check.
That check should be expected, not seen as awkward.
Approval should not depend on one channel
Email alone is not enough for high-risk payments.
Neither is a voicemail.
Neither is a Teams message from an account that may have been compromised.
For sensitive actions, use a second channel that is independent of the original request. That could mean a phone call to a saved number, an in-person check, or a separate approval inside your finance system.
The point is to break the attacker’s control of the conversation.
Supplier records should be locked down
Changing supplier bank details should not be something anyone can do.
Access should be limited. MFA should be switched on. Admin accounts should be protected. Leavers should be removed quickly. Shared finance logins should be avoided.
This is where cyber security and finance controls meet.
A compromised email account is bad.
A compromised email account plus weak payment processes is much worse.
People need permission to challenge
This is the bit that often gets missed.
A junior member of staff may spot something odd, but still feel uncomfortable challenging a senior person.
A finance assistant may want to check a payment, but worry they are slowing everyone down.
A school business manager may be under pressure to keep things moving.
A small business owner may be juggling payments at night after a full day on the tools.
Leadership has to make the rule clear:
Pausing to check is doing the job properly.
Nobody should be made to feel difficult for verifying a payment, questioning a bank change or refusing to bypass a process.
That culture matters as much as the technology.
What a simple payment protection process could include
You do not need a huge policy document to make progress.
Start with the actions most likely to cause financial loss.
A practical process might include:
* written approval steps for supplier bank changes
* out-of-band verification using known contact details
* two-person approval for new payees or large payments
* a clear rule for urgent or unusual payment requests
* MFA on email, finance and banking systems
* restricted access to supplier records
* regular checks for mailbox forwarding rules
* staff training based on real scenarios, not scare tactics
* a simple incident plan if money is sent to the wrong account
This is not about slowing the organisation down.
It is about stopping one convincing email from becoming a very expensive mistake.
What to do if something feels wrong
If a payment request feels unusual, pause.
If bank details have changed, verify them independently.
If an email thread feels slightly off, do not reply to the thread. Use another route.
If a payment has already been made and you think it may be fraud, contact your bank immediately. Then report it to Action Fraud and preserve the emails, invoices, headers, phone numbers and any other evidence.
Speed matters once money has moved.
Calm matters before it does.
Shift the burden from people to process
AI has made fraud more convincing.
That does not mean your team has failed if they find it harder to spot.
It means the process needs to carry more of the weight.
Good cyber security is not just firewalls, antivirus and clever tools. It is also the boring, sensible checks that stop money leaving the organisation because one email sounded believable.
For small businesses, schools, care providers, charities, parish councils and professional services firms, that is where the real protection often starts.
Not with suspicion.
With a process people are allowed to follow.
Concerned about payment fraud or supplier impersonation?
Black Swan Cyber Security Solutions helps UK organisations reduce the risk of account compromise, invoice fraud and payment redirection.
We can review your Microsoft 365 security, email protection, MFA, supplier-payment process and staff awareness approach, then give you practical steps that fit your organisation.
Book a free call and we’ll help you find the gaps before someone else does.
Article FAQs
Why are finance and accounts payable teams targeted?
They handle payments, invoices and supplier details. That makes them a direct route to money, especially when criminals can impersonate suppliers, managers or clients.
Can awareness training stop AI-driven fraud?
Awareness helps, but it is not enough on its own. AI scams can look and sound genuine, so payment checks and verification steps are needed too.
What is payment redirection fraud?
Payment redirection fraud happens when criminals trick an organisation into sending money to the wrong bank account. This often involves fake supplier bank changes or altered invoices.
Is voice cloning a real risk for businesses?
Yes. AI voice cloning can be used to impersonate a known person, especially where verbal approval is part of the payment process. Any unusual or urgent payment request should still be checked through a trusted route.
What is the best way to check supplier bank detail changes?
Use contact details already held on file, not the details in the email asking for the change. Confirm the request with a trusted person and keep a record of the check.
