Fraud is the risk businesses least like to think about, which is exactly why it flourishes.
Occupational fraud studies routinely estimate that organizations lose a meaningful percentage
of revenue each year to internal and external fraud—and small businesses, with thin controls
and trusted long-tenured employees, are disproportionately hit. The median scheme runs for
over a year before discovery. This week: what modern fraud looks like, and why AI has become
the most effective early-warning system available.

The common schemes haven’t changed much: billing fraud through fake or inflated vendor
invoices, payroll ghosts, expense report padding, check and ACH tampering, and—
increasingly—business email compromise, where a fraudster impersonates an executive or
vendor to redirect a payment. What has changed is the defense.

Traditional fraud detection relied on rules: flag any payment over $10,000, flag round numbers,
flag weekend transactions. Rules catch amateurs. Sophisticated fraud is designed to live just
under the thresholds. Machine learning takes a different approach: instead of defining what
fraud looks like, it learns what normal looks like for your business—every vendor’s typical
amounts, cadence, and bank details; every employee’s expense patterns; every approval flow—
and flags deviations.

That behavioral approach catches things rules never will. A vendor whose bank account
changed the same week an invoice doubled. An employee expensing meals on days badge
data shows they weren’t traveling. Two vendors sharing an address. A pattern of invoices
always approved by the same person, always just below the review threshold. Each is innocent
alone; AI is good at noticing when several mildly odd signals cluster.

Generative AI has also armed the attackers. Fraudulent invoices are now flawless. Deepfaked
voice calls impersonating CEOs to authorize wire transfers have moved from hypothetical to
documented reality. The defense is procedural, not technological: mandatory out-of-band
verification (call the known number, not the number in the email) for any change to payment
details or any unusual payment request—no exceptions, including for the CEO.

Three controls every business should have regardless of size: segregation of duties (the person
who approves payments shouldn’t reconcile the bank account), mandatory vacations (many
schemes require daily tending), and a genuinely anonymous tip channel—tips remain the
number-one way fraud is discovered, ahead of any technology.

AI won’t replace those fundamentals. But paired with them, it turns fraud detection from an
annual-audit lottery into continuous monitoring. The best fraud case is the one that ends in week
two, not month fourteen.

Next week: Q4 begins—let’s talk about closing your books faster