AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
In invoice fraud, a criminal who has access to your email, your client's email, or a lookalike address sends a message saying your bank details have changed, and the client pays the new account. The first step is speed: the client should ask their bank to contact the receiving bank at once. The rule that prevents it is that any change of account number is confirmed by a phone call to a number already on file, never one in the email.
How the account details get swapped
This is a form of business email compromise. The criminal does not need to hack a bank. They need one email thread. Common routes are:
- Your mailbox is compromised. Someone has your email password, reads your invoices, and sends a "change of bank details" letter from your real address, sometimes deleting the client's replies so you do not see them.
- The client's mailbox is compromised. The criminal watches for your invoice arriving and replies, or edits the PDF, before accounts pays it.
- A lookalike address. An email from a domain one letter different from yours, or a free email account with your business name, joins the thread.
The message usually gives a believable reason: "our bank is undergoing an audit", "we have moved to a new account for tax reasons", "please use our subsidiary account". Nacha's guidance on business email compromise describes the same vendor-impersonation pattern, an invoice "with an updated payment address or payment account information", and notes that urgency is a key warning sign. It cites FBI figures of $2.9 billion in reported business email compromise losses in 2023.
What to do in the first hour
- Client calls their bank now. The payer's bank is the one that can raise a fraud report with the receiving bank. Give the amount, time, receiving account and session ID or reference.
- Report in writing too. Follow the call with an email or letter to the bank and ask for a complaint reference. Under the CBN complaints guide, the institution should acknowledge a complaint and issue a tracking number within 3 days.
- Secure the mailbox. Whoever was compromised should change the email password from a clean device, turn on two-step verification, check forwarding rules and remove unknown devices.
- Report to the police and the NPF National Cybercrime Centre portal with the emails (including full headers if you can export them) and the payment evidence.
- Warn your other clients that your bank details have not changed, by phone where the amounts are large.
A CBN circular of 2015 on industry fraud desks allows banks to block or place a no-debit restriction on accounts when a fraud complaint is received. Whether money is still there to freeze depends on how quickly the report arrives.
Who bears the loss?
This is the hard conversation. If the client paid an account you never gave them, they have not paid you, and in many cases they still owe the invoice. If your mailbox was the one compromised, the client may argue you share the blame. There is no single Nigerian rule that settles this for every case; the contract, the emails and how each side behaved matter. Treat this as information, not legal advice, and get a lawyer's view for large sums. In practice many businesses agree to pursue recovery together and settle the balance once the facts are clear.
The verification call rule
Put this in writing on every invoice and in your onboarding letter to clients:
And apply the same rule to your own suppliers:
- Call back on a number you already hold, not the one in the email. Caller ID can be faked.
- Use name enquiry before sending: the NIBSS instant payment system lets the sending bank check the beneficiary name for an account number. A name that does not match the business is a stop sign.
- Send a small test amount to a new account and confirm by phone that it arrived, before sending the rest.
- Require a second person to approve any payment to a new or changed account.
Worked example
Example only. A client owes Ada's design studio ₦1,250,000. Her client receives an email from "ada.studio-ng" (her real address has no hyphen) saying the studio has a new account. The client pays. The next day Ada calls about the invoice. The client's bank is told within 26 hours; ₦310,000 is still in the receiving account and is restricted. The remaining ₦940,000 had already been moved. Had the client called Ada's office number before paying, the loss would have been nil.
Signs an email thread has been hijacked
- A reply arrives from an address that looks like yours but differs by one letter, a hyphen or the ending.
- The tone changes: more formal, or more urgent, than the person usually writes.
- The "new account" is in a different name from the business, or at a bank you have never used.
- Attachments arrive as a fresh PDF of an invoice already sent, with only the bank details changed.
- Someone asks the client to keep the change confidential or to reply only by email.
Any one of these is a reason to stop and call before money moves.
Where Pryme fits
A Pryme Business Account uses an authenticator app rather than SMS codes and a transaction PIN, so a stolen email password alone does not move money (security). Invoices can carry your payment details and the call-back instruction, the Compliance agent records actions, and payments above a ceiling need a person to approve. Related reading: supplier changed bank details.
Questions people ask
My client paid a fraudster who pretended to be me. Do they still owe me?
Often yes, because they did not pay your account, but it depends on the contract and whose email was compromised. For large sums, take legal advice; many businesses agree to pursue recovery jointly.
Can the bank reverse a transfer sent to a scammer?
The bank can report the fraud to the receiving bank, which may restrict any money still in the account. It cannot reverse money already withdrawn. Report within minutes or hours, not days.
How do I know if my email was hacked?
Look for forwarding rules you did not set, sent messages you did not write, unknown logged-in devices and missing replies. Change the password from a clean device and turn on two-step verification.
How should clients confirm a change of bank details?
By phoning you on a number already in the contract or your records, never one in the email asking for the change, and by checking the account name through name enquiry before paying.
Sources
- Nacha: Business Email Compromise Action Plan (2024) · accessed Oct 2026
- Central Bank of Nigeria: How to Lodge a Complaint (CPD/GEN/GUIDE/03, 24 Jan 2022) · accessed Oct 2026
- NIBSS: NIBSS Instant Payment (NIP), updated 17 Apr 2026 · accessed Oct 2026
- Techeconomy: Nigeria Police launches platform for reporting cybercrime (31 May 2024) · accessed Oct 2026
- Mondaq (G Elias): CBN rules on erroneous and failed inter-bank transfers (8 Jul 2025) · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.