AI Is Making Business-to-Business Fraud Cheaper. Only Seven Percent of Professionals Feel More Than Moderately Prepared

On August 26, Forrester analyzed Basware's acquisition of Trustpair as an example of a broader shift in the market for financial controls. According to analyst Meng Liu, generative AI is changing the economics of business fraud: an attacker can create convincing supplier communication more quickly, impersonate an executive, produce false documents and personalize an attack for a specific organization. Autonomous systems can also automate target discovery, message preparation and follow-up communication. The scale of the change is illustrated by data cited by Forrester. Seventy-seven percent of fraud professionals have observed an increase in social engineering using synthetic images or voices over the past two years. Seventy-five percent reported growth in forged documents created with generative AI. Only seven percent believe their organization is more than moderately prepared for these attacks. This exposes a weakness in traditional invoice controls. An accounting system may correctly confirm that an invoice matches the purchase order, is not a duplicate and has passed approval. The attacker, however, does not need to alter the invoice at all. It is enough to impersonate the real supplier and persuade the company that the supplier has changed its bank account. The payment can then pass every control and still end up with the fraudster. Trustpair therefore checks supplier identity and bank-account ownership during onboarding and whenever payment details are changed, and it reviews payment files before the actual transfer. According to Forrester, it supports verification in more than 190 countries. The combination with Basware also creates a large data base: Basware has processed more than 2.5 billion invoices across a network of more than 20 million suppliers, while Trustpair contributes more than ten million verified supplier-to-bank-account relationships and nine years of fraud history. The business impact concerns every company that still relies on email when bank details are changed. Generative AI reduces the value of visual and linguistic clues that employees previously used to identify a suspicious message. Correct grammar, a familiar signature or a convincing voice are no longer proof of identity. Control therefore needs to shift toward independent verification. A bank-account change should require confirmation through another channel, separate authorization and an auditable record. For significant amounts, a delay before the first payment to a newly entered account may also be appropriate. AI is not creating an entirely new type of fraud here. It is, however, sharply reducing the cost of preparation and enabling scale. Defenses therefore need to automate identity and payment-detail verification in the same way. Manual document review is no longer enough. Terms to explain Social engineering: Manipulation of a person to obtain information or access, or to induce the victim to perform a financial action. Synthetic impersonation: Artificially created image, voice or video that convincingly imitates a real person. Payment fraud: Fraud in which an attacker diverts an apparently legitimate payment to an account under the attacker's control.

AI Is Making Business-to-Business Fraud Cheaper. Only Seven Percent of Professionals Feel More Than Moderately Prepared

The full article is available to users registered at Hard Skills