Outsmarting payment fraud

How has fraud targeting treasury teams changed in recent years, and what role is AI playing in making attacks harder to detect?

Back in the days, fraudsters were not very prepared when it came to setting up a fraud. It was quite easy to detect emails that were poorly written, full of mistakes, and obviously suspicious. Things have evolved considerably thanks to AI. Fraudsters now rely on the latest trends, such as deepfake voice scamming, and they are going to study your processes for months before planning an attack. They map out your suppliers, your approval chains, the tone of your internal communications. When the attempt comes, it looks legitimate. It becomes harder and harder for treasurers to verify what lands in their inbox and to make sure they have reliable bank account verification processes in place. Technology is evolving on our side, but the technology used by fraudsters is evolving just as fast, and sometimes faster. That is why detection alone is no longer enough. Treasury teams need to shift their mindset from reacting to suspicious payments to building controls that make fraud impossible upstream, before the payment chain even starts.

Verification of Payee is now an EU requirement. What problem does it solve, and where does it fall short?

It is a very good initiative taken by VoP, and I want to acknowledge that first. But it falls short when it comes to the moment this verification is made. VoP operates the control just before payments, and that is too late. If at payment stage VoP tells you "impossible match," "close match," or "no match," you have to go back to your AP team or your shared services centre. They perform the control again, and you try once more to execute the payment. It creates operational inefficiency inside the company. It also relies on company names, and usually you do not have the correct company name for your vendor, never exactly as registered. The last thing to consider is that VoP only applies to SEPA payments. If you have a vendor in the US or in Asia, they will not be covered by VoP. So it is an improvement, but it is not enough to detect every type of fraud, and it arrives a bit too late in the chain to be really productive.

Detection alone is no longer enough.

Concretely, how does Sis ID complement existing controls, and what does working with a new client typically look like?

What we do at Sis ID is operating a check at different steps of the payment chain, not only at the end. We perform a first check during the onboarding of vendors, which helps eliminate the bank certificate callbacks that companies typically have to handle manually. Automating this step already removes a huge amount of operational friction. Then we run checks directly on the vendor master data, for example once a week or once a month, to make sure your vendor database stays clean over time. Master data drifts, vendors change accounts, and without regular verification your referential becomes a vulnerability. Finally, we also perform checks at the payment phase, at treasury level, just before the payments are sent, thanks to the connectors we have with the biggest TMS on the market. We control along the entire chain of processes, from onboarding to execution, which closes the gaps that isolated controls leave open.