How to Fight Fraud in the Generative AI Age: Protecting Your Business from New Financial Scams

For years, one of the simplest ways to recognize a phishing email was to look for spelling mistakes, poor grammar, or unusual wording. That advice is no longer enough.

Generative artificial intelligence (AI) has made it easier for criminals to create convincing emails, imitate business communications, produce realistic voice recordings, and even generate videos that appear to show a company executive or business partner. These messages can be professionally written, personalized, and difficult to distinguish from legitimate communications.

For businesses, the financial consequences can be significant. An employee may unknowingly transfer money to a fraudulent account, disclose confidential financial information, or provide access to company systems after receiving what appears to be a legitimate request from a manager, vendor, or client.

As AI-powered fraud becomes more sophisticated, businesses need to rethink how they verify financial requests and protect their internal processes.

At Velin & Associates, Inc., we help businesses evaluate accounting procedures, identify weaknesses in financial controls, and address irregularities that may expose an organization to financial loss. Understanding where fraud can occur is an important part of protecting your company’s finances.

1. Why Traditional Fraud Warning Signs Are No Longer Enough

Previously, employees were often advised to look for obvious signs of suspicious communications, such as grammatical errors, unfamiliar email addresses, unusual formatting, or generic greetings.

AI has made many of these warning signs less reliable. Criminals can now use publicly available information about a company, its employees, vendors, and business relationships to create highly personalized messages.

For example, an employee in your accounting department may receive an email that appears to come from the company’s regular supplier. The message uses the correct contact name, references an actual purchase order, and explains that the supplier has changed its banking information.

The email may look completely legitimate. However, the new bank account belongs to a criminal rather than the supplier.

Similar schemes can target business owners and executives. An employee may receive an urgent payment request that appears to come directly from the company’s president or financial officer.

The important lesson is that professional writing, familiar names, and convincing company details do not prove that a request is legitimate.

Businesses should evaluate what a message is asking them to do, particularly when it involves money, confidential information, access to financial accounts, or changes to company records.

2. Verify Financial Requests Before Sending Money

Payment-related fraud is one of the most financially damaging risks businesses face. AI-generated emails and messages can make fraudulent payment instructions appear routine and trustworthy.

Common examples include:

• A supplier requesting that future payments be sent to a new bank account.
• An executive asking an employee to make an urgent wire transfer.
• A customer requesting a change to the bank account used for refunds.
• A vendor sending an updated invoice with different payment instructions.
• An employee receiving a message asking for confidential banking information.

These requests should never be approved based solely on the email or message received.

For example, if a regular supplier sends updated banking instructions, an employee should contact the supplier using a phone number already stored in the company’s verified records. The employee should not use the phone number or contact information included in the new email until the request has been independently confirmed.

Businesses should also establish procedures requiring additional approval for large payments, unusual transactions, and changes to vendor banking information.

For higher-risk transactions, consider requiring two authorized employees to review and approve the payment before it is released.

These procedures are particularly important for businesses where one employee handles vendor communications, updates payment records, and processes outgoing transfers.

3. Deepfakes: When a Familiar Voice or Face Cannot Be Trusted

AI-generated audio and video, commonly known as deepfakes, introduce another level of risk.

A criminal may use publicly available recordings to imitate the voice of a business owner, executive, employee, or vendor. In more sophisticated schemes, a fraudster may participate in a video conference using a realistic AI-generated image of someone the employee recognizes.

Imagine an accounting employee receiving a video call that appears to come from the company’s owner. The person requests an immediate transfer to an unfamiliar account and explains that the transaction is confidential.

The employee recognizes the face and voice and assumes the request is genuine.

This is exactly the type of situation that can lead to significant financial losses.

Businesses should establish a rule that financial authorization cannot depend solely on a phone call, video conference, or voice message.

Instead, employees should:

• Verify unusual requests through a separate communication channel.
• Follow established payment authorization procedures, even when the request appears to come from senior management.
• Confirm large or unusual transactions directly with the authorized individual.
• Use predetermined verification procedures for confidential or urgent requests.

For particularly sensitive transactions, a direct conversation using a previously established contact method may be necessary.

The objective is to verify the person making the request, not simply decide whether the recording or video looks realistic.

4. Protect Your Business from Fraudulent Documents and Account Changes

AI can also help criminals create convincing invoices, contracts, payment confirmations, purchase orders, and other business documents.

A document may contain accurate company information, familiar formatting, and details copied from previous transactions. That does not necessarily mean it is authentic.

This creates risks beyond fraudulent payments. A manipulated document could be used to justify changing a customer address, updating vendor records, granting access to a financial account, or modifying payment instructions.

Businesses should not rely on a single document to authorize a high-risk change.

Instead, accounting and administrative teams should compare new information against previously verified records and confirm significant changes with an authorized contact.

It is also important to maintain appropriate access restrictions. Employees who can change vendor banking information should not necessarily have unrestricted authority to approve and release payments.

Separating these responsibilities makes it more difficult for one fraudulent request—or one compromised employee account—to result in an unauthorized transaction.

5. Strengthen Internal Controls Before Fraud Occurs

Employee awareness is important, but training alone cannot protect a business from every fraud attempt.

Even a careful employee can make a mistake when dealing with a convincing request, particularly during a busy period or when under pressure from management or a customer.

That is why businesses need internal controls that reduce the possibility of unauthorized transactions.

Important safeguards include:

Separate payment responsibilities. Whenever practical, the employee who creates or updates a vendor record should not be the only person authorized to approve and release payments.

Require independent approval. Large transfers, unusual expenses, new payment arrangements, and changes to banking information should require additional authorization.

Verify vendor information. Establish a consistent procedure for confirming new vendors and changes to existing vendor accounts.

Restrict financial system access. Employees should have access only to the accounting and banking functions necessary for their responsibilities.

Review financial activity. Regularly examine bank statements, vendor records, disbursements, and unusual transactions for inconsistencies or unauthorized changes.

Document approvals. Maintain records showing who requested, reviewed, and approved significant financial transactions.

These controls are not only relevant to large corporations. Small and mid-sized businesses can be particularly vulnerable because they may have limited accounting staff and fewer layers of approval.

A company does not need a complicated compliance department to improve its protection. It does need clear procedures, appropriate oversight, and consistent enforcement.

6. What Should Your Employees Do When They Suspect Fraud?

Businesses should give employees a clear process for handling suspicious communications or requests.

Rather than expecting employees to recognize every new AI-generated scam, establish a few consistent habits:

1. Pause before responding. Do not immediately follow instructions involving payments, passwords, confidential information, or changes to financial records.
2. Verify independently. Contact the supposed sender through a previously established phone number or another trusted communication channel.
3. Follow approval procedures. Never bypass payment controls because a request is urgent or appears to come from an executive.
4. Escalate suspicious requests. Report unusual communications to a supervisor, designated fraud contact, or IT/security department.
5. Preserve relevant records. Keep suspicious emails, messages, invoices, payment instructions, and transaction details for review.
6. Report suspected losses promptly. If a fraudulent payment has been made or account access has been compromised, notify the appropriate financial institution and internal security personnel immediately.

A business should also periodically review its fraud prevention procedures. Training materials that were effective a year ago may no longer address the methods criminals are using today.

7. Why Accounting Controls and Financial Oversight Matter

AI-powered fraud is not only a technology problem. It is also an accounting and financial management issue.

A convincing fraudulent email can become a financial loss when a company lacks procedures for approving payments, verifying vendors, monitoring transactions, or reviewing changes to financial records.

This is where professional accounting oversight becomes particularly important.

At Velin & Associates, Inc., we work with business owners and management teams to evaluate financial processes and identify areas where stronger accounting controls may be needed.

Our work may include:

• Reviewing accounting procedures and payment approval processes.
• Evaluating internal controls over cash disbursements and vendor accounts.
• Identifying weaknesses in financial recordkeeping and transaction oversight.
• Reviewing unusual transactions and potential accounting irregularities.
• Assisting with the financial review of suspected fraud or unauthorized payments.
• Recommending improvements to accounting procedures and financial reporting controls.

For businesses that have experienced a suspicious transaction or unexplained financial discrepancy, an independent accounting review may help determine what happened, identify the financial impact, and establish whether additional corrective measures are necessary.

The earlier weaknesses are identified, the better positioned a business may be to reduce its exposure to future losses.

Is Your Business Prepared for AI-Powered Fraud?

AI has changed the way criminals target businesses. Fraudulent communications can now look professional, sound familiar, and contain details that make them appear legitimate.

Businesses can no longer rely on spelling mistakes or suspicious formatting to identify potential scams. Stronger verification procedures, appropriate payment approvals, restricted access, and regular financial oversight are essential.

At Velin & Associates, Inc., we help business owners evaluate their accounting systems, strengthen internal financial controls, and review potential accounting irregularities. Whether your company wants to improve its existing procedures or needs assistance examining a suspicious transaction, our team can help assess the financial and accounting aspects of the situation.

Do not wait until a fraudulent payment or financial discrepancy exposes weaknesses in your accounting procedures. Contact Velin & Associates, Inc. to discuss an internal controls review and determine how your business can better protect its financial operations. For more information about our tax planning and tax compliance services, contact Velin & Associates, Inc. today.

Velin & Associates, Inc.

8159 Santa Monica Blvd STE 198/200
West Hollywood, CA 90046
📞 323-902-1000
📧 dmitriy@losangelescpa.org

This article is for general informational purposes only and does not constitute legal, cybersecurity, or tax advice. Businesses should consult appropriate IT and cybersecurity professionals regarding technical security measures and incident response. CPA for YouTubers | CPA for Shopify Store | CPA for Commerce | CPA for Creators | Shopify Store CPA | CPA for Filmmakers | CPA for Amazon Business | Amazon Business CPA | CPA for Dental Practice | Dentist CPA | Dental Business CPA | Online Commerce CPA | CPA for Doctors | CPA for Medical Practice | CPA for High Net Worth Individuals | Tax Services Healthcare | Tax Services for a Business | Tax Services TikTok | Tax Services for Commerce | Tax Services Los Angeles | Bookkeeping and Tax Services | Tax Preparation | Accounting Firm | Tax Services for Doctor | Tax Services for Entertainment | Online CPA | CPA Los Angeles