AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
If a supplier emails to say their bank details have changed, treat it as a possible fraud until you confirm it by phone on a number you already hold. Fraudsters hijack or copy email threads to send new account details just before payment is due. A simple call-back rule and two-person approval stop most of these losses.
How the fraud works
Business email compromise is a scam in which a fraudster either gets into a real email account or creates a near-copy of one, then sends instructions that look routine. For importers, the usual version is a message that appears to come from a supplier you already trade with, saying their bank has changed and the next payment should go to a new account. The invoice looks right, the amounts are right and the timing is right, because the fraudster has often read the earlier emails.
The FBI's Internet Crime Complaint Center reported more than US$55 billion in exposed losses from business email compromise worldwide between October 2013 and December 2023, across over 305,000 incidents. Small businesses are targets because they rarely have formal payment controls.
Warning signs
- A change of bank account announced by email, especially close to a payment date.
- A new account in a different country or a different company name from the supplier.
- Pressure to pay quickly, or a request to keep the change quiet.
- An email address that differs by a letter or uses a different domain ending.
- A different phone number in the signature from the one you have on file.
- Unusual grammar or tone from a contact who normally writes differently.
The checks that stop it
- Call back on a known number. Use a number from your records or the supplier's official website, never one from the email asking for the change. IC3 recommends using secondary channels to verify any request to change account information.
- Two people approve new payees. One person sets up the new bank details, another confirms them by phone before the first payment.
- Send a small test payment. For a new account, send a small amount and ask the supplier to confirm receipt by phone.
- Check the name. The account name should match the company on your Form M and proforma invoice. If it does not, stop.
- Protect your own email. Use two-factor authentication and unique passwords, and set email apps to show full sender addresses.
- Write it down. Put the rule in a short payment policy so staff know they will never be blamed for delaying a payment to check it.
Why the name check matters for importers
For Form M import payments, your bank pays the beneficiary named in your documents. A fraudster's account in another name should not match. But fraud also hits payments made outside that process, such as freight, agents and sample orders, so apply the same checks everywhere. Our guide on how to verify a company before you pay it covers the Nigerian side of the same problem.
A worked example
Example only. A Kano textile trader expects to pay a US$15,000 balance to a long-standing supplier. Two days before, an email arrives in the same thread: the supplier's bank is under audit, so please pay into a new account in a different country. The invoice is attached and looks perfect.
The trader's rule is to call back on a known number. The supplier's sales manager answers and says they have sent no such email. At an example rate of ₦1,500 per dollar, the call saved ₦22,500,000. The trader reports the email to the supplier, who discovers their mailbox was compromised.
A one-page payment policy
Small firms often skip written controls because everyone knows each other. That is exactly what fraudsters rely on: a junior staff member who does not want to delay the boss's payment, or an owner who pays from a phone between meetings. A short written policy removes the guesswork. It can be as simple as this:
- New payee or changed bank details: phone confirmation on a number on file, by someone other than the person who entered the details.
- Payments above a set amount: a second person approves before release.
- No payment instructions accepted by WhatsApp, text or email alone, from anyone, including the owner.
- Anyone may pause a payment to check it, and will not be criticised for doing so.
Review the policy each time you take on a new supplier or a new member of staff handles payments.
If money has already gone
- Contact your bank immediately and ask them to recall the payment. Speed matters.
- Tell the real supplier so they can secure their email and warn other customers.
- Report to the police and keep every email, invoice and transfer record.
- Review how the change got through and tighten the process.
Where Pryme fits
A Pryme Business Account is built so that no single message can move money on its own. The Finance agent prepares payments, and a person approves anything above the ceiling you set, with every action recorded. Sign-in uses an authenticator app rather than SMS codes, and payments need a transaction PIN; see Pryme security. When you pay, you can generate a verifiable receipt through Pryme's partnership with VerifyDoc.ai so the supplier can check it is genuine and unaltered, which helps settle any dispute over whether a payment was made. See also the Finance agent and how to pay a foreign supplier from Nigeria.
Questions people ask
My supplier sent new bank details by email. What should I do?
Do not pay until you have called the supplier on a number you already hold and confirmed the change with someone you know there.
Can my bank recover money sent to a fraudster?
Sometimes, if you act quickly. Contact your bank at once and ask for a recall of the funds. Recovery is not certain.
How do fraudsters know when I am paying?
Often they have access to a real mailbox, yours or your supplier's, and read the thread before sending fake instructions.
Is a test payment enough to confirm new details?
Only if the supplier confirms receipt by phone on a known number. A reply by email from a compromised account proves nothing.
Sources
- FBI IC3: Business Email Compromise, the $55 billion scam · accessed Oct 2026
- Supplier bank details changed scam: verify before paying (Bitdefender) · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.