AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
Most payment fraud against small businesses works by persuading someone to pay a fake invoice or change a supplier's bank details. The defences are procedural: a second approver above a threshold, a callback on a known number before any bank detail change, and a rule that urgency never shortens checks. AI agents help by checking every payment against those rules and refusing to release what fails, but they can also be targets themselves.
The scale of the problem
The FBI's Internet Crime Complaint Center reported almost $20.9 billion in losses in 2025, with business email compromise (BEC) accounting for about $3.05 billion, as reported when the annual report was released in April 2026. BEC typically involves a criminal impersonating a supplier, an executive or a client by email to redirect a payment. Small businesses are attractive targets because one person often both receives the invoice and sends the money.
AI has made these schemes harder to spot. Phishing emails no longer carry the spelling mistakes staff were trained to notice, and cloned voices can be used on calls. Training still matters, but it is not enough on its own. A business needs rules that work even when the message looks perfect.
How the common schemes work
| Scheme | What happens | The check that stops it |
|---|---|---|
| Changed bank details | A real-looking email from a supplier says their account has changed | Call the supplier on a number already on file, never one in the email |
| Fake executive request | The owner appears to ask for an urgent, confidential transfer | A rule that no payment bypasses approval, whoever asks |
| Fake invoice | An invoice from a known or plausible supplier for work not done | Match to a purchase order or delivery record |
| Compromised email account | A real mailbox is used to send instructions | Out-of-band confirmation for any payment instruction |
| Payroll diversion | An "employee" asks HR to change their direct deposit | Verify in person or through the employee's known contact |
The FBI advises verifying payment and purchase requests in person or by calling a known number, being careful with what is shared online, and scrutinising email addresses and urgency. These are simple rules; the failure is usually that someone was busy.
Approval rules that work for a small team
- Set a threshold above which every payment needs a second named approver. Pick a figure that catches the payments you could not afford to lose.
- Treat any change to a payee's bank details as a high-risk event: hold payments to that payee until the change is confirmed by callback.
- Require a transaction PIN or equivalent for release, held only by the people allowed to release.
- Never let urgency or seniority shorten the process. Write that down.
- Review new payees weekly.
- Separate duties where you can: the person who sets up a new payee should not be the only person who approves paying them.
In a two-person business, separation of duties may mean the owner approves every new payee while the bookkeeper prepares payments. In a solo business, it may mean a waiting period: a new payee added today cannot be paid until tomorrow, after a callback. Imperfect separation is still far better than none.
For more on structuring this, see who should approve payments in a small business. The same thinking applies when customers pay you; see how to stop staff diverting customer payments.
What an AI agent adds, and its own risks
- It checks every payment, every time, against the rules, without getting tired on a Friday afternoon.
- It compares new bank details with history and flags a change even when the email looks perfect.
- It matches invoices to purchase orders and deliveries before preparing payment.
- It refuses to release anything above its ceiling, and logs the refusal.
Agents bring new risks. An agent that reads email can be fed instructions hidden in a message, a technique known as prompt injection. A well-designed agent treats email content as data, never as an instruction to pay, and cannot release money at all without the approvals the business sets. Ask any vendor how its agents handle instructions arriving in documents and emails.
Worked example
Example only. A building supplies firm in Washington state receives an email, apparently from its largest timber supplier, attaching a letter on the supplier's letterhead with new bank details and an invoice for $48,600. The finance agent notes that the bank details differ from the last 30 payments, that the sending domain differs by one character, and that the invoice has no matching delivery. It holds the payment and raises it to the owner.
The owner calls the supplier on the number on file. The supplier has not changed banks. The owner reports the attempt to IC3 and to the bank, and warns staff. Had the payment been released, the agent's records would still have helped the bank attempt a recall, which is more likely to succeed the faster it is reported.
The firm then adds one rule: any message changing bank details goes straight to the owner, and payments to that supplier are held until the callback is logged. The agent applies the rule from the next email onwards.
Where Pryme fits
On a Pryme Business account, no agent moves money without the approvals you set, including a second named approver above your threshold and a transaction PIN. The Finance agent refuses payments to unverified beneficiaries and flags them to the Compliance agent; every action is on the audit trail. The agents run on Pryme Intelligence, which enforces each mandate and ceiling. Read more on how it works.
Questions people ask
What is business email compromise?
A scam in which criminals impersonate a supplier, executive or client by email to trick a business into sending money or changing payment details.
What should I do if my business paid a fraudster?
Contact your bank immediately to request a recall, report it to the FBI's IC3, and preserve the emails. Speed matters.
Can an AI agent be tricked into paying a fake invoice?
It can be targeted, for example by instructions hidden in emails. That is why it should never be able to release money without human approvals the business sets.
What payment threshold should need a second approver?
There is no standard figure. Choose an amount whose loss would seriously hurt the business, and apply it without exceptions.
Sources
- FBI: Business email compromise · accessed Oct 2026
- CyberScoop: FBI IC3 annual cybercrime report (April 2026) · accessed Oct 2026
- FBI Internet Crime Complaint Center (IC3) · accessed Oct 2026
- FTC: Cybersecurity for small business · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.