What Finance Teams Can Learn from Banks about AI Fraud: 5 Fast Tests

AI-generated document fraud is the use of generative AI to create or alter invoices, bank-detail change letters and identity documents so they pass a normal visual check.

AI fraud matters to finance leaders now because the paperwork behind payment fraud has become cheap to fake.

AI Fraud Rises

The 2026 AFP Payments Fraud and Control Survey found that 76% of US organizations faced attempted or actual payment fraud in 2025, and 74% experienced business email compromise (BEC). The FBI’s 2025 Internet Crime Report recorded $20 billion in reported losses, about $3 billion of it from BEC. It also reported AI-related complaints separately: 22,364, with $893 million in losses.

My view is simple. Stop judging a payment document by how it looks, and check it against evidence that the sender doesn’t control. Banks reached that conclusion first.

What Banks Learned When Fake IDs Reached Account Opening

In November 2024, the U.S. Financial Crimes Enforcement Network (FinCEN) issued an alert on fraud schemes involving deepfake media. Banks had reported a rise since 2023 in identity documents altered or created with generative AI, some of which were used to open accounts that received the proceeds of other scams. The alert also notes criminals using generative AI to impersonate executives and push staff into large payments, which is the BEC pattern finance teams already know.

The most useful part is how banks caught the fakes. FinCEN says they quite often found them by reviewing the documents again against other information or the customer’s profile. They also found customers who couldn’t confirm details like their income. A very good fake will survive a close look. But it really struggles when it has to match a record that the fraudster never even saw.

A similar pattern appeared at Bugni Labs when the team included checks for AI-generated identity documents in a know-your-customer pipeline. Rather than depending on the score from a single detector, the team compared every document with the application itself and also the credit bureau’s answer then sent the uncertain cases to an analyst along with all the evidence.

The first version flagged far too many actual clients because their phone photos were poor, so the team switched to risk bands and looked over previous cases before making any adjustments to the threshold. What really works is having several checks given to a person who actually makes the decision, and keeping a full record of how that decision was made.

5 Checks that Carry Over to AP

Each of these tests a document against something the fraudster can’t easily see or change.

• Call back on a number you already hold. Confirm any detail change through your vendor master file rather than the number or e-mail on the request itself. A forged letter will carry a forged phone number.
• Match invoices to records your team created. A three-way match against your purchase order and goods receipt stops invoices for items you never ordered. Consider an invoice without a purchase order higher risk.
• Check suppliers against sources they don’t normally supply. Use a relevant business registry and look for a company or VAT number that is different between documents. Repeat this check every time details change because BEC fraudsters usually impersonate suppliers you’ve trusted before.
• Try the Fed’s payee name verification. You might consider the Federal Reserve Financial Services optional Payee Name Verification tool that allows certain institutions to evaluate whether an intended payee’s name is consistent with the title on the account (using routing and account numbers). It’s an opt-in service.
• Have AI highlight payments for you, but let people make the final decision. Monitoring systems are good at detecting the first time a payee is used or when two suppliers share one bank account. Set it up so those payments go to a reviewer who still has the final approval and is able to pick up the phone.

1 Fake Request, 5 Chances to Stop It

This scenario is quite illustrative. An accounts payable clerk receives an e-mail from a long-standing packaging supplier, sent from a domain just one letter off the actual one. Attached is a letter on the proper letterhead presenting new bank details, signed by the finance director. A day later, an “overdue” invoice for a regular amount follows. All seems right since generative AI could replicate a letterhead from an old, actual invoice.

The callback reaches the supplier, which hasn’t changed anything. The new account’s name differs from the registered company name. The invoice refers to a purchase order that your system has never seen before. Monitoring flags a first-time payee for an established supplier. The audit trail then shows who rejected the change and why. The fraudster had to overcome numerous records held where they couldn’t be reached – and they failed at the very first one.

Before You Pay a New or Changed Supplier …

Hold the payment until you’re able to say “yes” to each of these questions:

• Have we confirmed the change on a phone number we already had?
• Is the invoice identical to a purchase order that we issued and a delivery that we recorded?
• Do the supplier’s details match on all our documents and from at least one other, independent source?
• Has anybody or any system highlighted this payment for review? Has someone actually looked at it?
• Are there written records of who did what and when?

Consider any request to sidestep a step “just this time” itself a cause for concern. If you do make one alteration this quarter, start by changing bank details, since that is where a false request would result in lost funds.