AI fraud: fake invoices and CEO fraud aimed at finance teams

AI-powered invoice and CEO fraud tricks finance staff into paying criminals, using fake supplier emails, cloned voices or deepfake video of senior managers. The scams themselves are old; AI makes the messages more polished and the impersonations more convincing. The defence is a payment process that does not rely on anyone recognising a fake.

What are invoice fraud and CEO fraud?

Both are authorised push payment (APP) fraud: your own staff make the payment, believing it is genuine. Take Five to Stop Fraud, the UK Finance campaign, defines them as follows.

Criminals often get in by intercepting emails, taking over a supplier’s mailbox or spoofing an address. Take Five says they may spend months learning who authorises payments, and use your website to find real suppliers to copy.

How does AI make these scams worse?

AI lets criminals write fluent emails in your suppliers’ style, clone a voice from a short recording, and fake a video call. The plain typing errors that used to give scams away are disappearing.

The best-known case is Arup, the British engineering firm. Building reported on 17 May 2024 that an employee in Hong Kong sent HK$200 million, about £20 million, after a video call with fake voices and images of people “posing as senior officers of the company”. Arup said none of its internal systems were compromised.

UK Finance’s Fraud report 2026, published on 15 June 2026, recorded £1.28 billion of payment fraud in 2025. APP fraud losses were £576.4 million, up 19%, from 248,070 cases. In the same release, Nasdaq Verafin said “criminals are exploiting advances like AI to industrialise operations”. The NCSC also warns leaders to plan for AI-specific threats.

Warning signs finance teams should spot

Train staff to pause when they see any of these:

• a supplier says its bank details have changed, especially by email
• a director asks for an urgent or confidential payment outside normal channels
• the request arrives on a call, voice note or video, with no written trail
• the sender discourages you from checking with anyone else
• the email address or domain is slightly different from usual
• the payment is to a new payee, an overseas account or a personal account
• timing is near a holiday, a month end or when the director is known to be away

Payment controls checklist

These checks stop most invoice and CEO fraud, whatever technology the criminal uses.

1. Call back on a known number. Verify every bank detail change and urgent request using a number you already hold, never the one in the message.
2. Use two people. One person sets up or changes a payee and another approves the payment.
3. Agree a code word. Directors and finance staff share a phrase to confirm genuine requests by phone or video.
4. Test new payees. Take Five suggests sending a small amount first and confirming it arrived.
5. Check Confirmation of Payee. Stop if your bank warns that the name does not match.
6. Confirm paid invoices. Tell suppliers when you have paid, so a diverted payment shows up quickly.
7. Lock down email. Use multi-factor authentication on every mailbox.
8. Limit what you publish. Take Five advises limiting what you share about your business online.
9. Make challenge normal. Staff must feel safe questioning a request from a senior colleague.

Which protection applies to you?

Reimbursement depends on who made the payment. UK Finance sets out the rules for UK Faster Payments and CHAPS payments made on or after 7 October 2024:

• If the payment came from a personal account, then the bank must usually reimburse up to £85,000.
• If your business is a micro-enterprise, meaning fewer than 10 employees and turnover or balance sheet of no more than 2 million euros, then you are covered too.
• If you are a charity with income under £1 million, then you are covered.
• If you are a larger business, then the mandatory scheme does not apply. Your own controls, and any cyber or crime insurance, are your protection.

Claims must be made within 13 months of the last fraudulent payment. Banks may deduct an excess of up to £100.

What to do if you think you have paid a fraudster

1. Call your bank immediately. Speed improves the chance of stopping the money.
2. Report it. Take Five directs victims to report to the police at reportfraud.police.uk or on 0300 123 2040.
3. Keep the evidence. Save emails, invoices, call logs and payment records.
4. Secure your systems. Change passwords and check mailbox rules in case an account was taken over.
5. Tell your insurer. Cyber and crime policies often have short notification deadlines.

What accountants should do now

Review your own payment controls, then offer the checklist to clients, as many small businesses have no call-back rule. Read our guides to phishing protection, two-factor authentication, cyber insurance and HMRC scam calls and texts.

Frequently asked questions

What is CEO fraud?

CEO fraud is a scam where a criminal pretends to be a director or senior manager and asks staff to make an urgent payment. It often uses a hacked or spoofed email account, and now sometimes a cloned voice or deepfake video.

How do I check a change of supplier bank details?

Call the supplier on a number you already hold, not one in the email or invoice. Companies rarely change bank details, so treat every change as suspicious until confirmed.

Will my bank refund an invoice fraud payment?

Under the mandatory APP reimbursement rules, personal accounts, micro-enterprises and charities with income under £1 million can claim up to £85,000. Larger businesses are not covered by those rules.

Where do I report invoice or CEO fraud?

Call your bank straight away, then report it to the police at reportfraud.police.uk or on 0300 123 2040.

Can a deepfake really fool a finance team?

Yes. Arup lost about £20 million in 2024 after an employee joined a video call with deepfaked senior staff. A call-back rule and a shared code word protect against this.