Business Impersonation Fraud: When Trust Is the Target

Last month, someone used our business information to create what appeared to be a legitimate transaction through a third-party QuickBooks integration. The business details matched. The paperwork looked authentic. Nothing immediately raised suspicion.

Then came the refund request.

Instead of reversing the payment through the original transaction, the merchant was instructed to send the money through Zelle and Cash App.

They did.

No malware. No stolen passwords. No firewall alert. The attackers never broke into our systems. They simply studied how the business process worked and walked through the front door of trust.

This is the new shape of fraud.

The path the money took. No credential was stolen and no control failed, because the thing being exploited was the business relationship rather than a system.

For years, businesses approached security with a simple assumption: protect the network, secure credentials, enable multi-factor authentication, and the business will be safe. Those defenses remain essential, but they are no longer sufficient. The most effective attacks today often succeed while every technical control shows green. The credentials are valid. The user is authenticated. The paperwork looks legitimate. The only things that are wrong are the intent and the workflow.

Fraud is not new.

What has changed is the cost of executing it at scale.

AI didn’t invent fraud. It removed many of the constraints that once kept it expensive.

Generative AI has dramatically reduced the time and cost required to build convincing phishing campaigns, fake invoices, customer support conversations, and highly personalized social engineering attacks. A campaign that once required hours of research, writing, and coordination can now be assembled in minutes. That doesn’t just make fraud faster. It fundamentally changes its economics, allowing a single attacker to operate at a scale that previously required an organized team.

IBM’s X-Force team put a number on it. In one controlled test at a healthcare company, five prompts produced a phishing email in five minutes that their own social engineers had needed sixteen hours to write. The human version still won, a 14 percent click rate against 11, and staff flagged the machine-written one as suspicious more often. AI did not make the lie better. It made it almost free.

IBM X-Force, October 2023. Its own social engineers were tested against a model on 800 employees at one healthcare company. Staff also reported the machine-written email as suspicious more often than the human one, 59 percent against 52.

The result is a fundamental shift in how fraud is executed.

Attackers increasingly study workflows rather than infrastructure. They learn how accounting software integrates with payment providers, how vendors are onboarded, how refunds are approved, how employees verify requests, and where human judgment replaces automated controls. Once they understand the process, they don’t have to defeat the system. They simply behave like a legitimate participant inside it.

The real shift isn’t that AI has suddenly become malicious. It’s that automation has made believable deception inexpensive. The barrier to creating convincing scams has collapsed while the potential payoff remains high. Like every major technological leap before it, AI has changed the economics of an existing activity. In this case, that activity is fraud.

The old foundation of digital trust was identity. Correct credentials, multi-factor authentication, and recognized devices were treated as sufficient proof that a request was legitimate.

That assumption is beginning to fail.

Synthetic voices, AI-generated emails, convincing documents, and automated conversations can now closely resemble legitimate business activity. Identity alone no longer guarantees intent.

The next generation of security will need to move beyond verifying who someone is and begin verifying what they are doing.

The questions become different.

Does this payment follow historical patterns?

Has this vendor ever requested a refund through a peer-to-peer payment platform?

Why is money suddenly leaving an established workflow?

Does this sequence of events make operational sense?

These are not authentication questions.

They are behavioral questions.

Both columns run against records most companies already hold. The difference is not more data, it is asking what is happening rather than who is asking.

Companies that continue treating cybersecurity as a technology problem will increasingly find themselves exposed to attacks that never trigger an infrastructure alarm. The organizations that adapt will recognize that security is fundamentally a systems problem, where technology, operational design, human behavior, and continuous monitoring reinforce one another.

Every major technological shift changes what becomes inexpensive.

The internet made communication nearly free.

Cloud computing made scalable infrastructure inexpensive.

Artificial intelligence is making believable deception inexpensive.

The pattern is not new. Each shift collapsed the cost of something that used to be expensive, and the collapse is what changed behavior rather than the technology itself.

When deception becomes cheap, trust becomes the most valuable asset a business possesses.

The organizations that thrive won’t simply build stronger security controls. They’ll build operational systems that continuously validate behavior, not just identity.

In the next decade, the competitive advantage won’t belong to the companies with the highest walls. It will belong to the companies that design systems where trust is continuously earned, not automatically assumed.

A few questions that come up every time I describe this to another operator.

Frequently Asked Questions

What is business impersonation fraud?

It is fraud in which criminals use a real company’s identity and details to make a transaction look legitimate, then redirect the money that follows. Nothing is breached on the impersonated company’s side. The asset being spent is its reputation, which is why there is often no alert, no compromised account, and nothing to patch afterward.

Why don’t security tools catch this kind of fraud?

Because every technical control passes. The credentials are valid, the user is authenticated, and the paperwork looks legitimate. The only things wrong are the intent behind the request and the workflow it travels through, and neither is something a firewall, an endpoint agent, or multi-factor authentication is designed to evaluate.

Has AI made fraud more sophisticated, or just cheaper?

Mostly cheaper. In an IBM X-Force test in October 2023, five prompts produced a phishing email in five minutes that the team’s own social engineers had needed sixteen hours to write. Sent to 800 employees at one healthcare company, the human version still won on click rate, 14 percent against 11, and staff reported the machine-written email as suspicious more often. The quality did not jump. The cost of producing it collapsed, which is what allows one attacker to operate at the scale that used to require a team.

What should businesses verify instead of identity?

Behavior. Does this payment follow historical patterns, has this vendor ever requested a refund through a peer-to-peer payment platform, why is money suddenly leaving an established workflow, and does this sequence of events make operational sense. These are questions about what is happening rather than about who is asking, and they catch requests that valid credentials cannot.

Why do attackers push refunds toward peer-to-peer payment apps?

Because it moves the money onto a rail that is difficult to reverse. A transfer the sender was deceived into approving is still a transfer the sender approved, so the protections that apply to a disputed card payment generally do not apply. Redirecting a refund away from its original payment method is one of the strongest signals that a request should be stopped and verified out of band.