AI revolution boosting cyber threats for accountants: Eftsure

Niek Dekker, VP of marketing at payment fraud prevention firm Eftsure, says that accounts payable teams should be aware of increased fraud risks as cyber criminals use AI to streamline their attacks.

“Where the criminals are using [AI], they are speeding up their way of execution and making it way more sophisticated as well, so their attacks will be way faster, more automated. There's less risk and more reward for those people, so there's more incentive for other people to get involved in it,” Dekker told Accounting Times.

“We reckon there will be more attacks and more sophisticated attacks, so it will become harder for accountants to navigate that.”

While cyber security is typically viewed as a responsibility of the IT team, Dekker warned that accounts payable teams can act as a ‘back door’, enabling criminals access to a business’s finances.

“Finance teams don’t really see it as their own responsibility. Yet they are holding the cash of a business, and that's what these criminals are after,” Dekker said.

“Our mission is to really make sure that finance teams and accountants fully understand that they are responsible, and also fully understand the ramifications of when money goes lost.”

Australian businesses lost almost $84 million in 2023–24 to business email compromise (BEC) scams, the Australian Signals Directorate's annual cyber threat report found. The ACCC found $91.6 million was lost to payment redirection scams in 2024.

BEC scams occur when a scammer poses as a colleague, boss or vendor to extract money from a firm. The scammer would ask the recipient to make a wire transfer, divert payroll or change banking details for future payments.

Detecting scams such as fake invoices has become increasingly difficult, Dekker said. AI has enabled scammers to speed up the process of accurately copying invoices.

“When it comes to fake invoices, it's becoming harder and harder to pick them out,” he said.

However, accounts payable teams can mitigate these risks by having strong control systems and procedures.

“Instead of looking for red flags, it's more looking at solutions. And solutions include being disciplined about accounting practices like segregation of duties and doing call-back controls,” Dekker said.

“Usually, when accountants stick to their guns about their controls, it doesn't really matter how good the invoice looks. They just have to do their manual checks.

“Don't call the number on the invoice; that might have been changed by the scammer. Call the phone number that might be on their Google listing or in the white pages,” he advised regarding call-back controls.

Businesses often underestimate the total costs associated with fraud, which go beyond the initial financial hit of the scam.

“[When] money goes to the wrong supplier or vendor or bank account,” Dekker said, “you still have to pay [the original] supplier for goods or services delivered.”

Additional costs are imposed on businesses, including legal fees, operational costs as payments are paused, and costs associated with investigating breaches and communicating with vendors.

“You need to do forensics in your system, trying to find out where the breach came from, then you need to probably have legal fees as well,” Dekker said.

“All these costs and totals are estimated to be five times the value of the money that is lost [in the initial scam].”

Dekker predicted an uptick in fraud risk as cyber criminals take advantage of AI innovations at a rapid rate.

“These cyber criminals, they have the best tech in the world. They're working with very sophisticated tools, and then, as an accountant, we're still relying on the good old phone and the manual work and sussing things out yourself.”

“Cyber crime has always been a bit of a cat and mouse game.

“The good teams have been winning most of the time. But with the tech adoption of AI and the rate that it is happening in places like the dark web, it's hard. It's not set that we're going to be winning for the next four or five years.“