AI-Enabled AP Fraud Surged 1,200%: Why Standard Internal Controls Are Failing Finance Teams

September 13, 2026 • 7 min read

Most finance teams think they can still spot fraud by trusting their instincts and reviewing documents carefully. They can't. AI-powered scammers just pulled off a $39 million deepfake video call. Another fake meeting cost a global company $25 million. AP fraud surged 1,200% in two years. The problem isn't employee carelessness. It's that AI eliminated the skill barrier to commit fraud. Perfect invoices, realistic vendor websites, and photorealistic documents now take minutes to create, not weeks. Standard OCR reads fake invoices without warning. Manual "gut checks" fail against computer-generated forgeries. And new Nacha rules arriving in March 2026 will make inadequate fraud detection a compliance violation, not just a financial risk. This article explains why traditional controls collapsed and what investigative approach actually works now.

AI-Enabled AP Fraud Surged 1,200%: Why Standard Internal Controls Are Failing Finance Teams

AI-Powered Fraud in Accounts Payable Jumped 1,200%: Why Normal Safety Checks Aren't Working Anymore

1. Introduction: The Days of Easy-to-Spot Scams Are Over

For many years, CFOs could protect their companies by relying on employees to notice when something looked suspicious. A misspelled email address or a message full of typos was usually enough to spot a scam. That doesn't work anymore. Clumsy scammers have been replaced by AI-powered attackers who work at computer speed, and traditional safety checks are now completely outmatched.

The damage is already showing up in company finances. In Hong Kong, someone in finance got tricked into sending $39 million after a fake video call with what looked like company executives. In another case, an employee at the global company Arup was fooled into wiring $25 million through a deepfake video meeting. These aren't just "technology issues." They show that the skills needed to commit fraud have basically dropped to zero. With deepfake-related losses expected to reach $40 billion by 2027 and the average fake invoice costing companies $133,000, finance teams are learning that "good enough" protection is really the same as no protection at all.

2. Takeaway 1: You Can't Trust Your Gut Anymore

Finance departments have always counted on the "gut check." An email that just felt wrong or had a weird tone would raise red flags. AI language models have completely eliminated this defense by creating perfect grammar and copying the exact professional writing style of a real vendor or CEO.

Because AI can gather publicly available information to fake someone's identity, being skeptical needs to change from a feeling into a fact-checking process. Detective-level skills are now required. As Jonathan Marks from BDO explains, employees need to be trained to test whether someone claiming to be a vendor or executive knows non-public details about social events or work history. AI can't scrape this information from the internet yet, so it's a good test before approving any unusual payment requests.

3. Takeaway 2: Fake Vendors Now Look Completely Real

The effort needed to create a "ghost vendor" scam has disappeared. In the past, building a convincing fake business took weeks of work. Today, AI tools like Anthropic's Claude Code and OpenAI's Codex let scammers build complete, professional-looking vendor identities in just minutes.

Scammers are now using:

AI-Generated Websites: Complex, professional-looking sites created automatically to mimic real companies.
Fake Documents: Photorealistic tax forms, W-9s, and business registration papers.
Voice Bots: Automated phone answering systems that sound like real people.

When anyone with a laptop can create what looks like a multi-million dollar business instantly, your vendor approval process isn't just paperwork anymore. It's a serious investigation that needs to happen every single time.

4. Takeaway 3: Standard Document Scanning Can't Spot Fake Documents

Many teams using standard Optical Character Recognition (OCR) software feel safer than they should. OCR is designed to read and pull data from documents, not check whether those documents are real. It assumes the document is legitimate, which makes it the perfect weakness for scammers to target.

Catching modern forgeries requires looking past the text to examine the actual image. Scammers now use AI to age documents artificially or edit invoices so they look real, but these changes leave digital clues. Advanced analysis can find image compression errors, unusual pixel patterns, and file information that shows when a logo was copied in or a bank account number was digitally added. Standard OCR will read these fake details without any warning, essentially paving the way for stolen money to leave your accounts.

5. Takeaway 4: Employees Can Now Fake Receipts Easily

While external deepfake scams make the news, fraud from inside the company has become a massive problem. Photoshop skills used to limit how many employees could fake receipts successfully. Today, mainstream AI tools like Google Gemini make it easy for any employee to alter receipts.

An employee can now create a receipt for whatever amount they want and use AI to make it look like an old, wrinkled paper scan. Because the technical skills required have vanished, the number of internal fraud cases is growing faster than human review teams can keep up. Controllers need to start using "tamper heatmaps," which are visual highlights that show which parts of a document have been changed, to keep employee spending under control.

6. Expert Perspective: The Voice of Skepticism

"This threat landscape we're in right now has evolved so quickly and is so dangerous. In the last two years, it's the convergence, the confluence of generative AI, deepfake technology, and synthetic identity capabilities."

— Jonathan Marks, CPA/CFF/CITP, Principal at BDO

7. Takeaway 5: New Rules Are Coming in 2026 (Nacha Requirements)

"Best practices" are officially becoming legal requirements. The Nacha Operating Rules are putting in place a new risk management system to fight fake transactions.

Phase 1 (March 20, 2026): Applies to non-consumer payment initiators and third-party service providers with 2023 transaction volume of 6 million or more.
Phase 2 (June 19, 2026): Extends these requirements to all other non-consumer payment initiators.

These rules require risk-based systems to watch for fraudulent entries. For the Corporate Controller, this means failing to upgrade fraud detection isn't just a money risk. It's also an upcoming compliance violation.

8. Strategic Response: Moving Toward "Lean Financial Operations"

To protect the company against computer-speed attackers, finance teams must shift to a proactive, investigative approach:

Strengthen the "Master File": Go beyond vendor-provided information. Put in place a check that verifies Tax IDs and physical addresses against government portals before any new entity gets added to your system.
Independent "Out-of-Band" Verification: Any request to change payment information must be confirmed through a separate, independent communication method, specifically a known phone number from the master file, never the number provided in the suspicious request.
AI-Enhanced Three-Way Matching: Traditional matching is too slow and can't spot unusual patterns. AI-enhanced matching can cut overpayments and duplicate invoices by over 80% by identifying behavioral oddities and image-level forgeries.
Adopt Virtual Cards (vCards): Move more payments to secure, randomly generated virtual cards for specific dollar amounts. Unlike ACH transfers or checks, these can't be reused, eliminating the risk from data breaches or fraudulent overspending.

9. Conclusion: The Double-Edged Sword

Technology is both the reason for this 1,200% jump in fraud and the only realistic defense against it. While AI lets scammers operate at a scale no human team can watch, it also provides the investigative tools needed to catch digital clues that human eyes would definitely miss.

However, the final responsibility stays with people. AI isn't going to approve your financial statements, and it won't testify in court if a $39 million loss happens. You will. The era of the "gut check" is dead. The era of investigative financial operations has started.

Is your team still relying on manual "gut checks" in a computer-speed fraud environment?

AI-Powered Fraud in Accounts Payable Jumped 1,200%: Why Normal Safety Checks Aren't Working Anymore

Sources