How AI changed fraud
The fraud schemes themselves are not new. Fake vendors, diverted payments, and executives issuing urgent payment instructions have existed for decades. What changed is speed and believability.
In 2026, fraudsters use AI to generate convincing deepfake video and voice, clone supplier invoices with correct logos and reference numbers, and craft phishing messages without the spelling errors and awkward phrasing that used to give them away. Industry surveys report that more than half of businesses saw fraud attempts increase over the past year, with over 40% saying attacks are growing more sophisticated. Finance teams that relied on spotting suspicious cues in emails are finding those cues gone.
For SMEs, the risk is acute. Smaller businesses often route payments through one or two people, verify suppliers informally, and trust familiar voices on the phone. Each of those habits is now a vulnerability.
Six red flags for AI-enabled fraud
1. Urgent payment instructions from an executive
The classic business email compromise now arrives as a voice note or video call that sounds and looks like the owner or a director. Urgency is the weapon: the fraudster wants payment released before anyone verifies.
2. Changed supplier banking details
A supplier emails new banking details, and everything looks legitimate — correct letterhead, correct contact names, correct invoice history. AI makes it easy to replicate a supplier’s full identity. Any request to change payment details deserves independent verification.
3. New vendors with perfect paperwork
Fraudsters generate complete vendor profiles: registration documents, tax numbers, reference letters, and websites. Paperwork alone no longer proves a vendor is real. Verification must go beyond documents to people and physical presence.
4. Invoices just below approval thresholds
AI tools can study your approval patterns if they gain access to your inbox. Invoices pitched just under the amount that triggers dual authorisation are a sign that someone understands your controls.
5. Refusal to use verification channels
A supplier who insists on email-only communication, avoids video calls, or becomes evasive when you propose an independent callback may not be who they claim to be.
6. Pressure to bypass process
Any request — from anyone — to skip the normal approval process because of urgency, confidentiality, or executive instruction should be treated as suspicious until verified through an independent channel.
Five controls that still work
1. Out-of-band verification with a code word
Agree a code word or challenge phrase with directors and key staff. Before releasing any unusual payment, the finance team confirms identity using this phrase through a separate channel — a callback to a known number, not a reply to the message that requested payment. Analog verification defeats digital deception.
2. Dual authorisation on every payment above a threshold
No single person should be able to release a payment alone. Dual authorisation means a fraudster must compromise two people, not one. Set the threshold low enough that meaningful payments always require a second pair of eyes.
3. Independent supplier onboarding
Verify new suppliers through channels you initiate: call a publicly listed number, check the business address, confirm banking details with a callback — never with details from the email that requested the change. Document every verification step.
4. Complete audit trails
Modern finance systems record every document upload, edit, approval, and payment. These trails let investigators reconstruct events quickly and act as a deterrent. If your system does not produce them, that is itself a control weakness worth fixing.
5. AI-assisted detection of your own
Fraudsters use AI to find patterns in your processes. Use the same approach in defence: anomaly detection on payment flows, duplicate invoice checks, and alerts on changed vendor details. Even basic rules — flagging first-time payments above a threshold — catch schemes that human review misses.
When to call a forensic auditor
If a payment has already left your account under suspicious circumstances, act within hours, not days. Contact your bank to attempt a recall, preserve all messages and documents exactly as received, and engage a forensic auditor to trace the funds and document the evidence. Do not confront suspects or alter your finance system before the investigation begins, as either step can destroy evidence or alert perpetrators.
A forensic audit after an AI-enabled fraud focuses on reconstructing the communication chain, tracing fund flows through bank records, and identifying which controls failed. The findings support recovery action and, critically, show what must change before the next attempt.
The bottom line
AI has not invented new fraud. It has made old fraud faster, cheaper, and harder to spot. The defences that worked two years ago — watching for suspicious email addresses, trusting a familiar voice — are no longer enough. Out-of-band verification, dual authorisation, independent supplier checks, audit trails, and anomaly detection form the control set that holds up in 2026.
SC Audit is an IRBA-registered audit firm based in Bellville, Cape Town. SC Audit’s partners Niel Schoeman, Simone Coetzee, and Hennie Meyer support businesses with fraud prevention, internal controls, forensic audits, and risk assessments. Contact SC Audit to review whether your payment controls hold up against AI-enabled fraud.
Frequently Asked Questions
What is AI-powered fraud?
AI-powered fraud uses artificial intelligence to make traditional schemes more convincing — deepfake voice and video impersonating executives, cloned supplier identities, and phishing messages without the errors that used to expose them.
How can a small business verify a payment instruction?
Call back on a known number, use an agreed code word, and require dual authorisation. Never verify using contact details from the message that requested the payment.
What should I do if we already paid a fraudulent invoice?
Contact your bank immediately to attempt a recall, preserve all evidence untouched, and engage a forensic auditor. Time matters: recovery chances fall sharply after the first 24 to 48 hours.
Are traditional internal controls still effective?
Segregation of duties and reconciliations remain essential, but they are no longer sufficient on their own. Add out-of-band verification and anomaly detection to cover the gaps AI has opened.
Does my auditor check for AI-enabled fraud?
A statutory audit is not designed to detect all fraud, and AI-enabled schemes are specifically built to evade normal procedures. If fraud is suspected, a dedicated forensic audit is the appropriate response.