Executives warn of rising fraud risks in business payments

Security and payments executives have warned that fraud risks are rising across service desks, hiring processes and business payments ahead of International Fraud Awareness Week.

A recurring theme was identity verification, alongside the growing risk of criminals combining social engineering with access to legitimate business accounts and processes.

Darren James, Senior Product Manager at Specops Software, pointed to risks at IT support desks, where attackers seek password or device resets by impersonating employees. He cited reported tactics linked to high-profile UK retail breaches.

"Before you reset a password or an MFA device for someone on the phone, check a government-issued ID against a live selfie. The attackers behind last year's M&S and Co-op breaches reportedly got in by calling the IT service desk and posing as staff," said Darren James, Senior Product Manager at Specops Software.

James also highlighted hiring fraud in remote work, arguing that identity checks should not end once a candidate appears in a video interview.

"Verizon's latest breach report estimates that North Korean IT worker schemes leveraged 15,000 possible stolen identities to get hired. In remote hiring, the person on the video call may not be the one who sets up the new laptop, so verify identity at both points," he said.

Payment Checks

Mariana Paun, Chief Business Resilience Officer at Zepto, focused on payment fraud and redirection scams. She highlighted the speed of modern payments and the shrinking window for businesses to detect errors or deception before funds leave an account.

"Payment fraud thrives on money moving before anyone has checked where it's going. Australians lost $166.8 million to payment redirection scams in 2025, typically via business email compromise or fake billing scams where a bad actor impersonates a legitimate recipient.

"The proliferation of AI has not only increased the volume of these threats, but also made them harder to identify. Zepto's 2026 A2A Payments Index highlights the importance of checking bank details. Zepto Validate, an intelligence layer built on the industry-wide Confirmation of Payee service, found that a third (33.1%) of bank account name-check lookups between January and July 2026 were not a full match. For business lookups, this rose to 59.9%, warranting further checks before processing business-to-business supplier payments.

"For regulated industries, the cost of getting this wrong is about to rise sharply. From 31 March 2027, banks, telcos and digital platforms face penalties of up to AUD $50 million per contravention under the Scams Prevention Framework.

"Robust safeguards are no longer optional as accountability and security requirements increase alongside payment volumes and real-time fund transfers. In practice, that means risk controls that scale: pre-send verification on every payment, real-time exception handling rather than next-day reports, automated reconciliation, an audit trail at the individual payment level, clear escalation paths when funds do not land, and governance reviews that keep pace with the increasing velocity of payments.

"International Fraud Awareness Week should be a reminder that every transaction is an act of trust: that the details are right, the counterparty is genuine and the funds land where they should. When close to 60% of business lookups surface something worth a second look, that trust cannot be assumed. It has to be earned," said Mariana Paun, Chief Business Resilience Officer at Zepto.

Email Risk

Reece Appleton, Regional Director APAC at Huntress, said some of the most damaging fraud attempts begin inside familiar email threads. He described a pattern in which criminals study communications and relationships before sending altered payment requests.

"The biggest fraud risk isn't always an obvious cyberattack. Sometimes, it's an email from someone you know, asking you to update payment details or approve an urgent transfer.

"What makes these attacks particularly dangerous is that criminals do not necessarily act immediately after compromising an account. They may spend time reading emails, studying business relationships and learning how employees communicate before making their move. By the time a fraudulent invoice arrives, it can look like part of a perfectly normal conversation.

"The Huntress Tragic Quadrant identifies account takeover and mailbox manipulation among the most common and potentially damaging threats businesses face. It's a reminder that legitimate accounts can become a vehicle for fraud, often without the obvious warning signs businesses have been trained to recognise.

"My advice is to treat identity security as an ongoing process, not just a login check. Verify changes to payment instructions through a separate channel, monitor for unusual account behaviour and unexpected email forwarding rules, and ensure human security experts are available around the clock to investigate and contain threats. The email might be genuine, but the person behind it might not be," said Reece Appleton, Regional Director APAC at Huntress.

Taken together, the comments point to a broader shift in fraud prevention. Businesses are under growing pressure to verify people and payment details at more stages of a process, particularly where remote access, remote hiring and real-time payments leave less margin for error.