Is Your Invoice a Deepfake? How to Protect Accounts Payable from Voice and Email Cloning Fraud

An invoice arrives from a trusted supplier.

The email looks legitimate. The wording sounds familiar. The payment details appear correct.

A few minutes later, a manager receives a phone call confirming the request. The voice sounds exactly like a senior executive.

Everything feels normal.

But what if none of it is real?

Artificial intelligence is changing how cybercriminals conduct financial fraud. Business email compromise (BEC) attacks have existed for years, but AI is making them more convincing, more scalable, and harder to detect.

According to the FBI’s 2025 Internet Crime Report, business email compromise cost U.S. businesses more than $3 billion in a single year. That makes it one of the most financially damaging cybercrimes on record.

For accounts payable teams, the challenge is no longer simply identifying suspicious emails.

The bigger question is whether existing payment processes can stop fraud even when the request appears completely legitimate.

Why Accounts Payable Teams Are Prime Targets

Accounts payable sits at a critical point within every organisation.

AP teams manage supplier relationships, process invoices, update payment details, and approve financial transactions.

They also work under pressure.

Payments need to be processed quickly. Vendors expect prompt responses. Internal teams rely on suppliers being paid on time.

Attackers understand this.

They know that AP departments operate where trust and urgency meet.

That combination creates opportunity.

Most successful payment fraud does not involve hacking systems.

Instead, attackers rely on impersonation.

The FBI’s Internet Crime Complaint Center (IC3) has repeatedly found that business email compromise attacks succeed by convincing employees they are communicating with someone they already trust.

This may include:

• Senior executives
• Finance managers
• Trusted suppliers
• Business partners
• Internal colleagues

The objective is simple.

Convince someone to send money or change payment details before the fraud is discovered.

Artificial intelligence is making that process easier than ever.

How AI Is Changing Financial Fraud

Traditional business email compromise attacks required significant effort.

Attackers needed to research their targets, write convincing messages, and understand business processes.

That work limited scale.

AI changes the equation.

Today, cybercriminals can automate much of the research, writing, and customization required to create convincing fraud attempts.

Modern AI tools can:

• Generate realistic business emails
• Match writing styles
• Analyze public company information
• Create convincing payment requests
• Produce human-like voice clones

This allows attackers to produce highly targeted communications in far less time.

By mid-2024, researchers estimated that roughly 40 percent of business email compromise phishing emails were already AI-generated.

That percentage is expected to continue growing.

What AI-Enhanced Fraud Looks Like Today

Many business owners still picture phishing as poorly written emails full of spelling mistakes and obvious red flags.

Modern fraud often looks very different.

AI-generated attacks are designed to blend into normal business operations.

Emails That Match Everyday Communication

AI can generate messages that sound remarkably authentic.

Instead of generic requests, attackers can create emails that mirror the communication style of executives, suppliers, and colleagues.

These emails may include:

• Correct names and job titles
• Current projects
• Recent conversations
• Invoice references
• Expected payment schedules

For busy AP teams processing hundreds of messages, these emails often appear routine.

That familiarity is exactly what attackers want.

The more normal the request feels, the less likely someone is to question it.

Invoice and Payment Redirection Fraud

One of the most common forms of accounts payable fraud involves payment redirection.

In these attacks, criminals attempt to reroute legitimate payments into attacker-controlled bank accounts.

The process often starts with a seemingly harmless request.

An email arrives claiming a supplier has changed banking details.

Alternatively, attackers may resend a legitimate invoice with modified payment information.

The invoice itself often looks authentic because it may contain information taken from genuine communications.

The only difference is where the money is being sent.

If the change is approved without verification, the funds can disappear before anyone realizes there is a problem.

Voice Cloning and Executive Impersonation

Email is no longer the only communication channel attackers exploit.

AI-powered voice cloning introduces a new challenge.

Modern tools can recreate a person’s voice using only a short audio sample.

That sample may come from:

• Public presentations
• Video content
• Interviews
• Social media clips
• Recorded meetings

Once the voice model is created, attackers can generate convincing audio that sounds like the original speaker.

This creates serious risk for organisations that rely on verbal approvals for payments.

An AP employee may receive a call that appears to come from a senior executive requesting an urgent payment.

The voice sounds familiar.

The request sounds reasonable.

The urgency feels genuine.

Yet the caller may be entirely artificial.

Why Traditional Fraud Detection Is Becoming Less Effective

Security awareness training remains valuable.

Employees should continue learning how to identify suspicious activity.

However, AI has fundamentally changed what fraud looks like.

Many traditional warning signs are disappearing.

Older phishing campaigns often contained clues such as:

• Poor grammar
• Misspelled words
• Generic greetings
• Inconsistent branding
• Unusual formatting

AI-generated content can eliminate many of these indicators.

Messages may appear polished, professional, and contextually accurate.

They may reference real suppliers, actual invoice values, and ongoing projects.

As a result, asking AP teams to simply “spot the scam” is becoming less realistic.

The problem is no longer just identifying suspicious communications.

The problem is preventing fraud when suspicious communications no longer look suspicious.

Why Process Matters More Than Instinct

Many organisations still rely heavily on employee judgment to stop fraud.

That approach worked better when fraudulent messages were easier to identify.

Today, process matters more than instinct.

The most effective defence is creating controls that work regardless of how convincing a request appears.

If a payment request can only be approved after proper verification, the quality of the deception becomes less important.

Strong processes reduce the opportunity for human error.

They also reduce the pressure placed on employees to determine whether every message is genuine.

Building Stronger Accounts Payable Controls

Businesses do not need complicated technology to reduce risk.

Many of the most effective protections involve simple, consistent procedures.

Make Out-of-Band Verification Standard Practice

Any request involving:

• Bank account changes
• Urgent payments
• New supplier details
• Large financial transactions

Should require verification through an independent communication channel.

This means confirming the request using information already on file rather than responding directly to the message.

For example:

• Call a supplier using an existing phone number
• Speak directly with an executive
• Verify details through a known contact

This simple step can stop many impersonation attempts.

Strengthen Authentication Controls

Multi-factor authentication remains important.

If attackers compromise an email account, MFA can make it harder for them to gain access to financial systems.

Businesses should enforce MFA across:

• Email accounts
• Finance systems
• Payment platforms
• Vendor management portals

Authentication alone will not stop every attack, but it adds valuable friction.

Limit Access to Financial Systems

Not every employee needs access to every financial function.

Restricting permissions reduces the impact of compromised accounts.

Businesses should review:

• User permissions
• Administrative privileges
• Vendor management access
• Payment approval rights

Access should align with business responsibilities.

Nothing more.

Create Clear Approval Processes

High-risk financial actions should require multiple levels of review.

This is particularly important for:

• Large payments
• Supplier banking changes
• International transfers
• Urgent payment requests

Multiple approvals create additional opportunities to identify problems before funds are transferred.

Building a Culture That Supports Verification

Technology alone cannot solve fraud.

Culture matters too.

Employees need to feel comfortable slowing down when something affects money movement.

That includes questioning requests from senior leadership.

Too often, urgency becomes the attacker’s greatest advantage.

Employees worry about delaying business operations or challenging authority.

Attackers understand this pressure and use it deliberately.

Leadership should clearly communicate that verification is expected.

Employees should never feel punished for confirming details before approving financial transactions.

A short delay is far less costly than a fraudulent payment.

AI Makes Fraud More Convincing, Not More Powerful

The FBI’s 2025 Internet Crime Report included a dedicated section on AI-enabled fraud for the first time.

The report documented more than 22,000 complaints and nearly $893 million in losses connected to AI-enabled scams.

Those numbers highlight a growing challenge.

However, AI does not fundamentally change the goal of financial fraud.

Attackers still need someone to approve a payment, change account details, or bypass verification.

That means strong business processes remain highly effective.

When organisations consistently verify requests through independent channels, AI loses much of its advantage.

The technology may improve.

But a verified phone call, a documented approval process, and a culture that supports questioning high-risk requests remain powerful defences.

Shift the Burden from People to Process

Accounts payable teams should not be expected to identify every sophisticated fraud attempt on their own.

Modern attacks are designed to look legitimate.

Many will succeed if detection relies entirely on human judgment.

The organisations that reduce risk most effectively do something different.

They build processes that make fraud difficult regardless of how convincing the request appears.

They require verification.

They enforce approvals.

They strengthen access controls.

And they create a culture where slowing down is viewed as responsible, not disruptive.

AI-enhanced fraud will continue to evolve.

Your payment verification processes should evolve with it.

If you would like to assess your current accounts payable controls and identify areas where fraud risk can be reduced, contact Caldera Cybersecurity for a consultation.