That Voicemail From the CEO? Verify It. Why AI Has Changed Invoice Fraud

A voicemail lands for someone in your finance team. It’s the boss, by the sound of it, asking them to push through an urgent payment to a supplier whose bank details have just changed. The voice is right. The context is right. The pressure is real. And it’s completely fake.

Business email compromise (BEC, where a criminal poses as someone you trust to redirect money) cost US businesses more than $3 billion last year, according to the FBI’s 2025 Internet Crime Report. That makes it one of the most financially damaging cybercrimes on record. AI has now made these attacks far harder to spot, and the question for any business handling payments is no longer whether your team can recognise a dodgy request. It’s whether the process around your payments makes fraud hard regardless of how convincing it looks.

Why finance teams are the target

Accounts payable sits right where trust meets time pressure. The people processing invoices, updating supplier details, and releasing payments are usually doing it quickly to keep things moving. For an attacker, that’s the ideal combination.

Most successful fraud doesn’t involve breaking into any system. The FBI has consistently found that BEC relies on impersonation: posing as a trusted executive, a supplier, or a colleague to redirect a payment or change bank details before anyone notices. AI has made that impersonation dramatically easier to scale. What once took skill and time to craft now gets automated, with tools that research the target, write in the right tone, and tailor the request to slot neatly into a normal workflow. By mid-2024, an estimated 40% of BEC phishing emails were already AI-generated, and that share is climbing.

What AI-enhanced fraud looks like in practice

Emails that blend into the workflow. Old phishing relied on volume and mistakes: awkward phrasing, dodgy logos, a generic “Dear Customer”. AI removed those tells. Modern BEC emails are grammatically clean, written in the specific tone of the executive or supplier being impersonated, and they reference real projects, current invoice numbers, and upcoming payment runs. For a team processing dozens of routine messages a day, that familiarity is exactly what lowers the guard.

Invoice and payment redirection. One of the most common patterns is quiet redirection. An attacker intercepts a genuine invoice exchange and alters the destination account, or sends a short note claiming a supplier has updated its banking details. The surrounding content looks completely legitimate, because in many cases it’s lifted straight from real correspondence.

Voice cloning. Email isn’t the only channel. AI voice tools can clone a person’s voice from a short audio sample, enough to leave a convincing voicemail or make a call that sounds like a known executive. For teams used to a quick verbal “yes” on urgent or high-value payments, that removes one of the last checks email security can’t help with. The FBI’s 2025 report included a dedicated AI section for the first time, logging more than $893 million in AI-enabled scam losses across more than 22,000 complaints. Closer to home, the ACSC’s ReportCyber continues to list BEC and invoice fraud among the costliest threats facing Australian businesses.

Why the old checks no longer work

Security awareness training still matters and it’s still worth doing. But AI has changed what your team is up against. The signals those programmes taught people to watch for, the typos and mismatched addresses, are gone. A fraudulent email can now name your organisation, your active suppliers, and your real invoice values, pulled from public sources or earlier intercepted mail.

When a fake request is genuinely indistinguishable from a real one, putting the burden of detection on the person in accounts is putting it in the wrong place. The businesses that actually reduce this risk aren’t asking staff to be more suspicious. They’re building verification that works no matter how convincing the message looks.

Build the process around the risk

The strongest defence isn’t sharper instincts. It’s removing ambiguity from the high-risk actions.

Out-of-band verification as standard. Any request to change supplier bank details or approve an urgent, off-cycle payment should require a second confirmation through a separate, known channel, never a reply to the same email thread. Calling the supplier on a number already on file, or confirming with the colleague directly, breaks the impersonation chain regardless of how real the original looked. This needs no technology. It needs a written procedure and the habit of following it every time.

Layered access and MFA. Restricting who can touch financial systems and enforcing multi-factor authentication (the second check after a password) limits the damage a compromised account can do. If an attacker gets into a supplier’s email, MFA on your side adds friction that can slow or stop a fraudulent change before any money moves.

A culture that supports slowing down. Fraud prevention improves when people feel safe questioning a request, including one that appears to come from the boss. Someone who pauses a payment to verify it isn’t being difficult. They’re doing exactly what good process demands. That starts at the top, with leadership making it clear that slowing down on high-risk actions is always the right call.

When verification is standard and questioning is encouraged, AI-enhanced fraud loses most of its advantage. The technology attackers use is advancing fast, but the controls that contain the damage don’t have to be complicated. They have to be consistent.

Shift the burden from people to process

We work with finance teams and accounting practices across the Northern Beaches, and the message is always the same: you’ll never out-spot a good deepfake, so don’t try to. Build the payment process so the fraud can’t get through even when it fools someone.

At Vaelis IT we help small businesses across the Northern Beaches and North Shore put these cybersecurity controls and Microsoft 365 protections in place, in plain English, without enterprise overhead. If your team still approves payments on a voicemail or a single email, that’s the gap worth closing first.

Worried about AI-enhanced fraud reaching your finance team? Book a free IT health check and we’ll review your payment controls with you.