Discussions of payment fraud usually center on how sophisticated the criminals have become. The more useful question runs the other way: why does a careful accounts payable team, reviewing every invoice, approve a fraudulent one?
Because the fraud that succeeds is designed to survive the exact review your team performs. Here is how that works, and which controls actually interrupt it.
The scale, in current numbers
The Association for Financial Professionals' 2026 Payments Fraud and Control Survey, covering 2025 activity, reports:
- 76% of US organizations experienced attempted or actual payments fraud.
- 74% were affected by business email compromise, up from 63% the previous year.
- 48% of organizations under $1 billion in revenue took actual financial losses, and smaller firms have the least capacity to recover them.
- Only 17% currently use AI for fraud mitigation.
Four structural blind spots in manual review
1. Bank detail changes are invisible in a single document. A vendor whose account number differs from the last payment is the highest-value fraud signal in AP. It cannot be seen by examining the invoice in front of you; it requires comparison against payment history. A reviewer has no way to hold that history in memory across hundreds of vendors.
2. Near-identical domains defeat reading itself. Human reading normalizes text: we perceive words as shapes rather than character strings. A sender domain altered by one letter reads as correct, particularly to someone processing dozens of documents in a sitting. This is not inattention. It is how reading functions.
3. Urgency is part of the attack design. Fraudulent requests arrive with deadlines attached, because speed pressure is the condition under which verification gets skipped. The tighter the queue targets, the better the attack performs.
4. Responsibility diffuses between roles. The approver assumes AP validated the vendor. AP assumes the approver recognized the request. Both trust a check neither performed. Fraud exploits the seam between functions, not a failure inside one.
Notice what unites all four: each is a question about patterns across documents and time, not about the document being reviewed. That distinction determines which controls work.
The controls that interrupt it
Out-of-band verification for bank detail changes. Any change to vendor payment details is confirmed by phone, using a number already on file, never a number supplied in the request. This single control blocks the most costly version of the fraud, and it costs nothing but discipline.
Restrict and log vendor master data changes. Name exactly who can alter vendor banking details. If several people can, that is your exposure. Log every change and review the log on a schedule.
Automated comparison against history. Flag bank detail changes, duplicate invoice patterns, and amounts that deviate from a vendor's norm, automatically, on arrival. This is the task where machine memory categorically outperforms human memory, and it is also what makes human review effective: judgment applied to ten flagged invoices rather than spread across a thousand unflagged ones.
Remove urgency as a valid override. State explicitly that no deadline justifies skipping verification and that nobody will be criticized for delaying a payment to confirm details. Attacks rely on the opposite culture.
Reduce exception noise. With industry exception rates averaging around 22%, genuine anomalies compete for attention with routine mismatches. A cleaner queue makes real signals visible.
Machines find the pattern, humans make the call
Human judgment, supported by deliberate procedure, remains the best defense. That is not an argument against automation; it is an argument for the correct division of labor.
Software should narrow what requires human attention: surfacing the bank detail change, the duplicate pattern, the anomaly against vendor history. The decision to release a payment stays with a person. In fraud prevention specifically, that is exactly where it belongs.
For what this looks like in practice, see how paying the right vendor, once, protects both your cash and your supplier relationships.