AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
Treat any email that changes a supplier's bank details as suspect until you have confirmed it by phone on a number you already hold, not one in the email. Invoice-redirect fraud works by taking over or copying a real email thread, so the message looks right. Check that the new account is in the supplier's registered company name, send a small test payment, and get the supplier to confirm receipt before paying the full amount.
The message arrives in the middle of a real conversation. The supplier in Kano or Aba has sent the proforma, you have agreed the order, and then: "Please note our bank has changed. Kindly use the account below for this payment." The tone, signature and invoice number all match. This is the pattern of invoice-redirect fraud, also called payment diversion or business email compromise. It is especially effective in cross-border trade because buyer and supplier rarely meet, payments are large and urgent, and nobody expects to speak on the phone.
How the fraud works
- Account takeover. The fraudster gets into the supplier's or the buyer's mailbox, reads the thread, waits for an invoice and sends the change of details from the real address.
- Look-alike domain. A new address one character off the real one (an extra letter, .co instead of .com) joins the thread. Replies go to the fraudster.
- Edited documents. The real invoice is copied and only the account details changed. Totals and references still match your order.
- Pressure. "Our account is under audit", "Pay today or the container misses the vessel." Urgency stops people checking.
The UK government's guide to exporting to Nigeria on business.gov.uk notes that fraud is common and advises caution. The same caution applies when you are the buyer. A request to pay a personal account rather than the company is a separate warning sign (see when a supplier wants payment to a personal account).
Verify before you pay: the steps
- Stop. Do not pay, and do not reply to the email to ask whether it is genuine. If the thread is compromised, the fraudster answers.
- Call back on a known number. Use the number from your original contract, an earlier invoice or the supplier's website, never one in the new message. Ask the person you normally deal with to read the new account number to you.
- Check the account name. The account should be in the supplier's registered company name. Confirm that name on the CAC register (see checking a Nigerian supplier on the CAC register). A different company or an individual's name needs a written explanation from a director you can reach by phone.
- Ask for a bank letter. A letter on the bank's letterhead confirming the account in the company's name, sent from the supplier's known address and then confirmed by phone.
- Send a test payment. Pay a small amount and have the supplier confirm the exact figure received before you send the balance.
- Record the check. Note who you spoke to, when and on which number. Your finance team then has a clear rule to follow.
If you have already paid
- Call your bank or payment provider immediately and ask it to recall the payment or contact the receiving bank. Speed matters more than anything else.
- Tell the real supplier on a known number, so the receiving account can be reported from the Nigerian side as well.
- In England, Wales and Northern Ireland, report to Report Fraud (formerly Action Fraud), run by the City of London Police, at reportfraud.police.uk or 0300 123 2040. In Scotland, contact Police Scotland on 101. Elsewhere, report to your national police fraud unit.
- Check whether your own mailbox was the one compromised. Change passwords and turn on app-based two-factor sign-in.
Do not assume insurance will cover the loss. The UK National Cyber Security Centre's guidance on cyber insurance notes that standard policies may exclude business email compromise fraud. Read the wording before you rely on it.
A worked example
Example only. A London importer owes a Lagos supplier ₦12,000,000 for a shipment. An email from the supplier's real address gives a new account. Following the steps above, the importer calls the number on last year's contract. The supplier's sales manager has never heard of the change. The importer has spent ten minutes and lost nothing. Without the call, the full ₦12,000,000 would have gone to the fraudster, and the importer would still owe the supplier.
Make it a written rule
Fraud succeeds when the check depends on one person remembering it on a busy day. Write a one-page payments rule for everyone who can pay suppliers: no change of bank details without a call-back on a number already on file, two people involved in any change, a test payment for every new account, and no exceptions for urgency. Tell your Nigerian suppliers about the rule too. A genuine supplier will expect a call, and a fraudster's "urgent" request then stands out at once.
Where Pryme fits
Pryme does not move money without your approval. On a Pryme Business Account, a person approves payments above a set ceiling, and actions are recorded. The Finance agent prepares supplier payments but cannot release them. Security uses an authenticator app rather than SMS codes, plus a transaction PIN. A new payee is still a new payee, though: the call-back above is your check, not ours.
Questions people ask
My supplier emailed new bank details. Is it a scam?
Possibly. Confirm by phone on a number you already hold, check the account is in the supplier's registered name, and send a small test payment before the full amount.
Does Confirmation of Payee check payments to Nigeria?
No. Pay.UK says Confirmation of Payee covers UK domestic CHAPS, Faster Payments and Bacs payments only, not international transfers.
Where do I report invoice fraud in the UK?
In England, Wales and Northern Ireland, report to Report Fraud (formerly Action Fraud) at reportfraud.police.uk or 0300 123 2040. In Scotland, call Police Scotland on 101. Contact your bank first to try to recall the money.
Will cyber insurance cover business email compromise?
Not always. The NCSC notes that standard cyber policies may exclude business email compromise fraud, so check the policy wording.
Sources
- Report Fraud service goes live (City of London Police, 4 Dec 2025) · accessed Oct 2026
- Confirmation of Payee FAQs (Pay.UK, modified 30 Mar 2026) · accessed Oct 2026
- Cyber insurance guidance (NCSC) · accessed Oct 2026
- Exporting to Nigeria (business.gov.uk) · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.