A payment request can now arrive with the right executive name, a plausible vendor conversation and a professional invoice. Microsoft says it detected a campaign that sent more than one million scam emails and used several indicators consistent with generative AI during template creation.
The lesson for Indian finance teams is operational. Better spam filtering helps, but a convincing message becomes harmless only when the payment process requires verification outside that message.
How The Campaign Was Constructed
Microsoft's threat-research report describes attackers impersonating company executives and ServiceNow, attaching a fabricated invoice and inserting a fake forwarded conversation to create a believable history. The requested Automated Clearing House payment was close to US$50,000.
The campaign used third-party email-delivery infrastructure and lookalike domains. Most messages targeted users in the United States, but the technique is not country-specific. Indian organisations face the same combination of executive urgency, vendor impersonation and payment pressure through email, messaging apps and compromised business accounts.
What AI Changes And What It Does Not
Generative AI can improve grammar, personalise names and produce several versions of a story quickly. It may also help attackers maintain tone across a fake thread. That removes some of the obvious language mistakes employees once used as a warning sign.
The basic fraud remains familiar: create trust, introduce urgency, change payment details and discourage independent checking. Defenders should therefore stop teaching staff to identify phishing only through spelling errors. Process signals are more durable than writing style.
The Highest-Risk Moments In Accounts Payable
Invoice fraud is most likely to succeed when a request falls between ownership boundaries. A business user knows the vendor, accounts payable controls the payment and IT controls the email system, but nobody owns verification of a changed bank account.
Risk rises when an invoice arrives near closing time, a senior executive appears to request secrecy or the normal approver is travelling. Attackers use ordinary business pressure. The control must work on a busy day, not only during a training exercise.
Use A Two-Channel Verification Rule
Any new beneficiary, bank-detail change or unusual urgent payment should be confirmed through a channel that did not come from the request. Staff can call a vendor contact already stored in the finance system, use an approved supplier portal or obtain confirmation from a second authorised employee.
Do not call a phone number printed on the suspicious invoice or copied from the email signature. If the mailbox has been compromised, the attacker can replace those details. The trusted contact record should be maintained separately.
A Practical Control Checklist
- Require dual approval for beneficiary creation and bank-detail changes.
- Place a short hold on high-value changes so another reviewer can examine them.
- Show the full sender and reply-to domains in the review screen.
- Alert when an invoice uses a new account for an existing vendor.
- Separate the employee who edits vendor details from the employee who releases payment.
- Keep a rapid escalation route for staff who feel pressured by an executive request.
- Record the verification method and approver with the transaction.
Controls should be proportional. A small business may not have a large security team, but it can still require a callback and second approval for a changed beneficiary.
Email Security Still Matters
Microsoft recommends layered controls including email authentication, spoof protection, investigation across related alerts and rapid removal of malicious messages. India's CERT-In advisory on threats targeting Microsoft 365 also warns about business email compromise, device-code phishing, token theft and abuse of trusted accounts.
SPF, DKIM and DMARC can reduce some forms of spoofing, but an authenticated message from a compromised account may pass those checks. Finance teams need identity and payment controls in addition to email filtering.
What To Do After A Suspicious Request
Do not reply to the message to ask whether it is genuine. Preserve the email, invoice and headers, and report them through the organisation's security process. Confirm the executive or vendor through the trusted channel. If a payment has already been released, notify the bank and incident-response contacts immediately; delay reduces the chance of stopping or tracing the transfer.
Security teams should examine whether the sender account, recipient or vendor record was compromised. Resetting one password may not remove malicious mailbox rules, stolen sessions or an unauthorised authentication method.
Build The Rule Into Everyday Work
Annual awareness training is not enough. Run short exercises using the actual approval path and include executives, procurement and finance. Senior leaders must make it safe for an employee to delay a payment while verifying it. If staff are punished for questioning urgency, the written policy will fail.
IndiaPress's website security checklist for new businesses covers foundational controls, while the guide to Zero Trust implementation explains why a familiar identity should not automatically receive trust.
Conclusion
AI can make an invoice scam more polished, but it does not defeat a payment process that verifies sensitive changes independently. Indian organisations should focus on beneficiary controls, two-channel confirmation, dual approval and fast incident reporting. The most important defence is a rule that still applies when the message appears to come from the most senior person in the company.
