J.P. Morgan: AI fraud hits authorized B2B payments

J.P. Morgan's argument starts from a shift in where fraud enters the payment lifecycle. Traditionally, transaction-level controls looked for an unusual amount or activity outside an established pattern. But the bank notes that a carefully constructed attack can avoid those signals: the invoice may be real, the amount expected, and the request may arrive at the expected time.

The more revealing evidence tends to sit around the transaction. An account change shortly before payment, or a verification call that relies on details supplied in the request rather than a separately maintained source, can point to a compromise that happened well before approval. J.P. Morgan frames the full chain of trust behind a payment — especially the steps used to establish or change payment instructions — as part of the customer's control environment.

The stakes come down to coordination. Procurement, accounts payable, treasury and security each hold part of the picture, and when those signals remain separated a legitimate-looking request can move through the gaps. The bank's suggested test is whether firms can challenge a suspicious change before funds move, rather than relying on recovery afterward. It also notes AI is being used defensively, through bot detection, deepfake detection and layered biometric controls, so the outcome may hinge on how well those earlier signals are joined up.