Fake payment requests now hide inside real email threads

A payment request that arrives inside an email thread you already know may not be real. Bottomline's Katie Elliott says criminals who get into a business email account now study the invoices and join the conversation with new payment instructions. The goal is to send your money to the wrong account.

What changed

Once inside an email account, a fraudster can read invoices, see approval limits and learn when payments usually go out. Elliott, a senior risk and fraud officer at Bottomline, told PYMNTS that AI helps criminals do that research in seconds. They then copy the timing and language of routine requests.

The old warning signs are fading too. Poor spelling and bad grammar used to give scams away. AI has weakened those clues. "They make fraud look operationally ordinary," Elliott said.

Why it matters

A real email account is not proof of a real request. Criminals can use that account to walk into a genuine invoice conversation, so a familiar name or thread is not enough on its own.

Recovery is hard. Elliott said fraudsters often move money out as soon as it lands in the wrong account. A business may only find out when a vendor says the payment never arrived. "You have the control" before the money leaves, she said. After that, the chance to step in can vanish.

The damage goes beyond the lost payment. Elliott pointed to several costs:

• Staff time spent trying to get the money back
• Time spent finding the cause and deciding what to change
• Possible new spending to prevent a repeat
• Harm to your reputation with customers and vendors

On that last point, she said companies underestimate it. A vendor who links you to a hacked account and lost payments has reason to warn others.

Who can ease up

Not every payment needs heavy scrutiny. Elliott's view is that good controls should not slow everything down. "They really should just make the risky payment harder," she said. Routine payments that fit your normal pattern can keep moving. The extra checks belong on payments that look unusual or risky.

What to do

The alert box above lists the steps. The main idea is to confirm who controls the receiving account before money goes out, and to train staff so they understand how security codes work.

What to watch

Payments are getting faster. Elliott said checks have to happen earlier as that speed rises, because when money moves in seconds, the time before it leaves is the most important window. She also said businesses should ask whether a payment makes sense for the company and its usual communications. The interview gives no figures on how common this fraud is.