Moss Security Whitepaper_Feb 2026.pdf

CFE-25-74390 - Nufin-27001-Cert - Issue 1.pdf

Most people assume card fraud is the main event. It isn't. Cards get hit more often but each hit is small. Credit transfers in the EU get hit less often and for much bigger sums, which is why they top the total loss table.

Half of Germany still pays for their Döner with a crumpled tenner. Half of all point-of-sale transactions in Germany are still made in cash, according to the Bundesbank.

The logic is completely flipped. Under reverse charge, no VAT appears on the invoice at all. The buyer declares and pays it on their own VAT return, even though nothing was charged. Get this wrong and you are not just facing a posting error. You are looking at a compliance issue.

In early 2024, a finance employee in Hong Kong was tricked into transferring approximately USD 25 million after joining a video call where everyone on screen, including the CFO, was AI-generated. This is not a future risk. It has already happened, and the technology is getting cheaper and easier to use.

A £40 dinner here, a £15 taxi there, a receipt that is technically real. Expense fraud is the slow leak: about 1 in 8 cases overall per the ACFE, 1 in 5 in small businesses, fourth place behind corruption, billing and non-cash. The red flag rarely lives in one claim. It lives in the pattern.

The top way fraud gets caught isn't an audit. It's a tip. Per the ACFE 2024 Report, tips catch 43% of cases, internal audits just 14%, and more than half of those tips come from colleagues. Your team is statistically your best fraud detector. Reassuring and a little unsettling.

Benford's Law states that the digit 1 is the most common leading digit, appearing around 30% of the time in organic financial data. When auditors see too many transactions starting with 7, 8, or 9, that deviation flags a potential manipulation. Fraudsters tend to pick numbers that feel random to humans but do not follow the natural distribution.

The data tells the opposite story. Employees with more than five years of tenure cause the highest median fraud losses. The longer someone has been around, the more access they have, the more trust they have built up, and the better they understand exactly where the gaps are.

Unlike card payments, which have chargeback mechanisms built in, SEPA credit transfers are generally not reversible once processed. Recovery depends entirely on the receiving bank's cooperation and, often, law enforcement involvement. This is exactly why pre-payment controls matter far more than post-payment recovery.

Most duplicate invoices are actually accidental, caused by vendors resubmitting through a different channel or internal process gaps across departments. Whether intentional or not, the financial impact is identical. Companies without systematic duplicate checks routinely overpay without ever realizing it.

Checks: still the reigning champion of US payment fraud. The 2025 AFP Survey clocks 63 percent of organizations hit last year, ahead of every other rail, with 3 in 4 still mailing checks untracked. A 17th-century payment instrument, a 2026 problem.

Not even close. USD 2.2 billion was stolen from crypto platforms in 2024 alone, with North Korean hackers taking 61 percent of that. Recovery rates remain very low, typically in the single digits. Once funds hit mixers, bridges, or privacy coins, the trail goes cold fast.

Paying does not buy peace. It marks your company as someone who pays. Security research consistently shows that organizations that paid a ransom are disproportionately hit again, often within 12 months and sometimes by the same group rebranded. Paying also does not guarantee data recovery.

The mental image of a career criminal is almost always wrong. According to the ACFE, the large majority of occupational fraudsters have a spotless record before they commit the act. They are usually the reliable, long-tenured colleague that nobody would suspect. That is part of the reason controls matter more than background checks. You are protecting against future behavior, not past records.

Meta was fined 1.2 billion euros by the Irish Data Protection Commission in May 2023 for transferring EU user data to the US without adequate safeguards, the largest GDPR penalty on record. Regulators are not bluffing anymore, and the trend is up, not down.

The EU Instant Payments Regulation completed its phased rollout in October 2025. Euro-area banks and PSPs must receive instant payments (since January 2025), send them (since October 2025), and cannot charge more for instant than for standard transfers. Speed is no longer a premium product.

This is one of the biggest anti-fraud changes in European payments in a decade. Verification of Payee is now mandatory and free for users. Before a euro leaves, the payer's bank pings the payee's bank and gets back Match, Close Match, No Match, or Unable to Verify. Invoice redirection and CEO fraud just got structurally harder.

They used to be, until the Court of Justice of the EU struck that down in November 2022. General public access was ruled a disproportionate interference with privacy. Access is now limited to competent authorities, obliged entities, and those who can demonstrate a legitimate interest, which makes supplier due diligence meaningfully harder.

One person is a risk. Two in on it is a conspiracy. Splitting invoice creation, approval, and payment release across different people is the oldest trick in the fraud prevention book, and still the most reliable. Every major fraud framework, from COSO to ISO 37001, leans on this idea.

The stolen amount is almost never the real cost. Every euro lost pulls in investigation hours, legal fees, recovery work, and a pile of operational chaos. Research consistently puts the all in cost at three to five times the face value. Fraud loss is an iceberg. The headline number is the tip.

Asset misappropriation is the bread and butter of occupational fraud. Think small theft, padded expenses, the missing laptop, the vendor that never delivered. Individually it looks petty. The problem is the pattern. A few euros a week, for years, turns into a number that would have set off every alarm if it had happened at once.

Around 500,000 known deepfake files existed in 2023. By 2025 the count had jumped to 8 million. That is not a linear curve, it is a hockey stick. The tools got cheaper, the quality got better, and cloning a voice or face dropped from specialist work to a weekend project. Your finance controls now have to assume a video call or voice memo can lie.

Email filters are good at stopping dodgy links. They are much worse at reading images of QR codes. Attackers hide the malicious URL behind a QR, the user scans it on a phone (outside corporate controls), and lands on a credential page.

Fraudsters follow the shopping calendar, not the national calendar. A TransUnion analysis found Thanksgiving Day topped the charts for attempted online fraud across the US, Canada, and the UK. Consumers rushing through checkouts, inboxes packed with deals. Perfect weather for a scam.

Here is the uncomfortable bit. SMS codes are better than nothing, but they are the junk food of authentication. A SIM swap, where a scammer sweet talks your mobile carrier into porting your number to their phone, bypasses the whole thing. The real options are authenticator apps or a hardware key.

Think of it as an iceberg. The fraud cases that get reported and end up in official statistics? That is the tip. Underneath, unreported incidents and indirect costs push total European fraud losses to an estimated $100 billion a year. Most of it never shows up anywhere.

Even inside one of the most tightly regulated currency zones on the planet, tens of thousands of fake euro notes get pulled out of Germany's cash flow every six months. The 20 and 50 euro notes are the forger's favourites.

Tietoevry tracked 3.7 billion transactions on behalf of European banks in 2024 and saw attempted fraud climb around 43 percent year on year. The direction is clear: controls that stayed still last year are effectively weaker this year.

A full year. Research consistently puts the median detection time for occupational fraud at 12 months. Every month without detection compounds the total loss. And by the time internal audit catches it, the damage is already locked in.

The global median loss per fraud case is $145,000. For smaller companies it tends to hit harder because of fewer controls, less redundancy, and no buffer to absorb the damage. One case can be enough to cause serious financial distress.

The "90 percent of attacks start with phishing" line is marketing, not data. In the latest Verizon DBIR (2025), phishing shows up in about 16 percent of confirmed breaches. Stolen credentials lead at 22 percent. For finance teams the real headache is the laser targeted cousin, Business Email Compromise.

Germany's B2B e-invoicing mandate started on 1 January 2025, but only the obligation to RECEIVE structured e-invoices applies immediately. Issuing becomes mandatory on 1 January 2027 for
companies with turnover above 800,000 euros and on 1 January 2028 for the rest.

AI-generated BEC content is a fast-rising share, reported at
around 40 percent by VIPRE in Q2 2024 and around 14 percent by Barracuda in April 2025, varying by vendor and methodology.

The global average data breach cost currently stands at $4.44 million per incident globally, though for US companies it has hit an all-time high of $10.22 million. That number covers detection and escalation, notification, post-breach response (including regulatory fines and legal costs), and lost business. A breach involving financial data or payment systems typically lands at the higher end.

he VAT Gap is the yawning space between the VAT governments should collect and what actually lands in the treasury. The latest European Commission report puts it at €128 billion across the EU, a €27 billion jump in a single year. Some is admin error. A large slice is deliberate carousel fraud, where VAT gets reclaimed on transactions that never happened.

Europe's biggest accounting scandal of the decade. Wirecard's auditors could not confirm 1.9 billion euros of escrowed cash that the company claimed sat in trust accounts in the Philippines. The money did not exist. The DAX constituent filed for insolvency days later, and the ripple effects reshaped BaFin, KPMG, and the EU audit regulation debate.

The customer was forecast to deposit £15 million a year. It deposited more than £365 million, of which £264 million was physical cash. The bank's systems flagged the pattern repeatedly and no one acted. The case is now the UK reference point for "your alerts are only worth what you do with them."

The employee believed they were on a normal call. Everyone on the screen, including the CFO, was a deepfake. Fifteen separate transfers were made before the fraud was caught. Arup confirmed the case publicly and it remains the single highest-profile deepfake business fraud to date.

In 2025, over $3.4 billion in cryptocurrency was stolen. A massive portion of this total came from a single attack on Bybit in February, which accounted for $1.5 billion alone. The data show a growing trend where massive outlier hacks are driving the majority of annual losses.

The tide is turning, slowly. IBM's 2025 study found 63 percent of ransomware-hit organisations chose not to pay. 37 percent still did. The shift matters because paying funds the next attack and statistically raises the odds of being hit again. Refusal is now the majority response.

Crypto exchange OKX pleaded guilty in February 2025 to running an unlicensed money transmitting business in the US and agreed to roughly $504 million in combined penalties. Regulators cited millions of users onboarded without proper KYC, traders in sanctioned jurisdictions who were never geo blocked, and billions in suspicious transaction volume that never triggered a single suspicious activity report.

That is card fraud only. Card not present transactions drive the bulk of it. Nilson projects losses to continue climbing as e-commerce volume grows, even as issuers push 3D Secure and tokenization. The losses are distributed across merchants, acquirers, issuers, and ultimately cardholders.

Even when companies refuse to pay, the bill still arrives. IBM puts the average total cost of a disclosed ransomware incident at $5.08 million in 2025. That figure is downtime, investigation, legal, customer notification, and the quiet reputational bruise that shows up in the next sales cycle. The ransom itself is often the smallest line.

A number few people outside enforcement even heard of four years ago. University of Texas finance professor John Griffin and Kevin Mei traced blockchain addresses across 4,000 victims and four years to build the estimate. Most scammers operate from Southeast Asia, and a large share of the perpetrators are themselves trafficking victims. It is both a financial and a humanitarian scandal.

Crypto overtook banking as the most heavily fined sector for anti money laundering failures in 2025, with first half fines alone crossing $927 million. Behind crypto in the ranking: banking at $200M+, payments and FinTech at $160M+, trading and brokerage near $50M, gambling at $22M+. Shortcuts at scale get punished at scale.

Plot twist. The demographic most associated with fraud victimhood, older adults, actually reports losing money less often. Data shows that people aged 18 to 59 are about 34 percent more likely than those 60 and over to report a fraud loss. Digital natives are not immune. Anyone moving money online is a target.

No real profits, no real investments, just a carousel of new investor money paying old investor returns for decades. When $7 billion in redemptions hit at once in 2008, Madoff confessed to his sons, who turned him in the next day. The ledger holding all the fraudulent records sat on an IBM AS/400 server from the 1980s that Madoff refused to replace. Now we know why.

Seventeen dollars just to move one piece of paper through receipt, approval, matching, and posting. Automated best-in-class AP teams do the same for around 3 dollars. Multiply the gap by tens of thousands of invoices and the savings fund an entire finance team.

Tyco inflated income by $500 million and funnelled $150 million to its CEO and CFO through unapproved loans disguised as bonuses. The money paid for a $2 million Jimmy Buffett private island party, a $2,200 wastebasket, and the shower curtain that became the icon of early 2000s corporate excess. At that scale, extravagance is rarely just about taste. It tends to be the visible side of a much bigger control failure.

About 3.4 billion phishing emails daily. That is nearly one for every two people alive. Most get filtered. A small fraction arrives. A smaller fraction gets clicked. And that tiny leakage is enough to power BEC, ransomware, and credential-theft campaigns worldwide.

Urgency plus authority plus no real verification channel is the exact playbook of CEO fraud. This type of impersonation is one of the most financially damaging fraud types in business payments. Even smaller amounts are often used deliberately to test whether controls can be bypassed.

Check past hotel bookings and proceed if the request fits past behavior.

Ask the CEO to confirm via reply message and process once they respond.

Process the reimbursement given the urgency and document it afterward.

Ask the CEO to go through the normal expense process, and double-check through a independant channel you already trust.

The most dangerous fraud emails do not look suspicious. They look exactly like this. IBAN change requests are one of the highest-risk triggers in B2B payments. "It looks legit" is not a control. The only safe verification is one you initiated yourself, not one that came through the same channel as the request.

Update the bank details. The supplier relationship exists and the request looks consistent.

Reply to the email and request written confirmation on company letterhead first.

Verify the bank detail change via an independent communication channel before making any changes.

Wait for the next invoice to see whether the new IBAN appears again before updating.

Ghost employee fraud, whether intentional or negligent, is a serious internal control failure. Six months of unchecked salary payments with no offboarding verification is not a process gap to note and move on from. The median payroll fraud loss sits at roughly $100,000 per case before detection.

Post a corrective journal entry, recover the net overpayment through payroll, and flag it as an offboarding process gap for HR.

Escalate to HR and Finance leadership, freeze any further payments, and treat it as a potential control failure until proven otherwise.

Calculate the total overpayment, issue a formal repayment notice to the former employee, and document it for the next audit.

Contact the former employee directly to agree on a repayment plan and keep the process moving without waiting for a full internal review.

This is threshold manipulation, one of the most common expense fraud techniques. Fraudsters learn the approval limits and intentionally stay just below them. The pattern across multiple submissions is the red flag, not any single receipt.

Approve them. Each claim is within policy, receipts are attached, and the amounts are not duplicates.

Request additional documentation for each claim, such as business purpose and attendee details, before approving.

Hold off on approving and flag the pattern first. The clustering just below the threshold is what matters, not whether individual receipts look fine.

Run the standard duplicate check and process them if nothing flags automatically. The control environment is working as designed.

Four red flags are stacking up here: one person creating and approving vendor payments, no contract, vague service descriptions, and a residential address. The separation of duties principle exists precisely to prevent this. Its absence is one of the clearest internal fraud signals in the book.

Request the missing contract and supporting documentation from the team member and put payments on hold until it arrives.

Escalate to internal audit and legal, freeze further payments, and initiate a full review.

Flag it for the next audit cycle and note it as a vendor documentation gap in the meantime.

Introduce a mandatory dual-approval rule for this vendor going forward and request a formal contract before the next invoice is processed.

Phone numbers can be spoofed, and in 2024 scammers used AI voice cloning to successfully mimic CFO voices in real fraud cases. Urgency plus a new account plus no documentation is one of the most reliable fraud tripwires in B2B finance. Verifying through a second, independent channel is always the right call.

Process it. The request comes directly from the CFO and the situation is genuinely urgent.

Ask the CFO to send the account details by email so you have written confirmation before processing.

Put the transfer on hold and get your manager's sign-off before processing anything to a new account.

Decline to process outside of the standard workflow and verify via an independent second channel before taking any action.

Urgency plus a changed bank account is a textbook invoice redirection setup. It does not matter how attractive the discount looks or how legitimate the email appears. The only safe verification is a phone call you made yourself to a number you already have, not one found in the email.

Process it. A 12% discount from a two-year supplier with a plausible explanation is worth acting on quickly.

Reply to the email and ask for written confirmation of the account change.

Pay to the original account this time and flag the new IBAN for verification before the next invoice.

Call the supplier on the number already in your vendor master to confirm before changing any payment details.

Lookalike vendor fraud works precisely because the amounts are believable and the invoices look professional. One transposed letter in a vendor name is all it takes. Master data verification before payment is the only reliable control. Googling a fake company name often returns nothing, which is not the same as confirming it is legitimate.

Check the invoice number against your open purchase orders and approve if there is a match.

Search the company name and VAT number online to confirm they belong to a legitimate business.

Forward it to IT to check whether a license renewal is actually due before approving payment.

Cross-check the vendor name, VAT number, and IBAN against your master data before taking any further action.

This is a classic salami slicing scheme, named because you steal in very thin slices that are individually meaningless. Across 3,000 transactions at even EUR 1.50 average, that is EUR 4,500. More importantly, the systematic nature of the pattern is itself the red flag, regardless of the total amount.

Accept the explanation. Individual amounts are immaterial and rounding differences are normal in bookkeeping.

Run a spot check across 20 to 30 entries to assess whether the rounding pattern looks consistent and deliberate.

Request a full reconciliation of the suspense account and escalate if any outflows cannot be explained.

Ask the bookkeeper to reverse the open entries and stop the practice without opening a formal review.

A single vendor taking 71 percent of spend with no competitive process and a possible undisclosed personal connection is not a process oversight. It is a conflict-of-interest red flag with potential corruption implications.

Escalate the vendor concentration to your CFO as a spend efficiency issue and recommend a competitive tender for the next contract cycle.

Ask the procurement manager directly whether a personal relationship with the vendor exists.

Escalate to internal audit or compliance, preserve all documentation, and request a formal conflict-of-interest review.

Document the missing tender process as an audit finding and include it in the next scheduled procurement review.

This is the Arup playbook, almost exactly. A Hong Kong finance employee sent around 25 million dollars in 2024 after a deepfake Teams call with a fake CFO and colleagues. Audio sync and pixellation are often subtle. The rule: break the channel before you authorize anything, and reverify with people you know.

Initiate the transfer using the account details in chat. Senior leadership plus legal counsel is sufficient authorization.

Ask on the call for a confirming email from the CFO before initiating, and process once the email arrives.

Leave the call, contact the CFO and CEO on a known-good channel, and refuse to initiate until each person confirms in person or via verified number.

Ask the outside counsel to share the signed acquisition documents on the call and proceed once you have seen the cover page.

Gift card requests from leadership over email are one of the most common BEC scams on the planet. Attackers love them because gift cards are essentially cash and nearly impossible to claw back once the code is sent. No legitimate CEO urgently needs gift cards by Friday. Ever.

Buy the cards from the company card and email the codes. The CEO is clear about the business purpose.

Reply asking for the client's name and a purchase order number before proceeding.

Do not act on the email. Contact the CEO on a known channel to confirm. This is a classic gift card scam pattern.

Buy one card as a test and send the code first to see whether the CEO acknowledges it before buying the rest.

This is invoice splitting, the supplier (or whoever inside colluded to onboard them) is deliberately sizing every invoice under the single-signer threshold. Each one might be legitimate, but the pattern is not. Controls that exist at a threshold stop working if anyone can choose whether to trigger them.

Approve the four invoices individually because each falls under the single-signer threshold and they all have invoice numbers.

Combine the invoices into a single approval request and route them together for second-signer review.

Escalate the pattern. Treat it as potential invoice splitting intended to evade dual approval, and request the underlying contract and deliverables before paying any of them.

Approve the first two invoices and hold the remaining two pending clarification from the supplier about why the work was billed separately.

A personal benefit from a vendor in the middle of negotiations is the textbook setup for a kickback. The right move is not managing the optics, it is removing the conflict and examining it properly.

Advise the manager to enjoy the gift but disclose it informally to HR to be safe, and continue the negotiation.

Ask the manager to return the gift and document the return to preserve neutrality in the negotiation.

Escalate to compliance or internal audit, pause the manager's involvement in the contract negotiation, and open a formal conflict-of-interest review.

Document the gift in next year's code-of-conduct training and continue with negotiations since no decision has been made yet.

Flat hours, generic tasks, no artifacts, single approver who never questions. Four red flags of contractor fraud or ghost-hours billing. The fix is twofold: evidence of work for past hours, and restored separation of duties so a single manager cannot both generate and approve someone else's pay.

Accept the timesheets. The contractor is within their agreed-upon weekly hours and the manager has approved.

Ask the manager to double-check the timesheets and continue paying in the meantime to avoid straining the relationship.

Hold further payments pending a review, request evidence of work, and assess whether separation of duties between timesheet entry and approval has broken down.

Change the contract to a fixed-fee model so future hours are not the issue, and move on.

Ghost SaaS is one of the quietest drains on any finance team. When a subscription outlives the employee who set it up, the cost just keeps compounding. Every recurring charge needs an owner, a review cycle, and a clear cancellation path.

Keep it running and ask the team lead to find a new internal owner.

Cancel the subscription going forward and add the tool to the SaaS review.

Park it until the annual budget cleanup and downgrade to the cheapest tier in case there is still some business use.

Move the charge to a shared admin cost center so the team's budget looks clean.

Spoofed internal-looking domains are a staple of BEC. The attacker relies on the branding, the technical-sounding narrative, and the target's urge to comply with what sounds like IT. Bank migrations are a common cover story. The only safe response is to break the channel and verify directly.

Update the recurring payment destinations for the affected suppliers and confirm back to the IT-infrastructure address so they can track the migration.

Reply to the sender to ask whether this is genuinely from IT and wait for their confirmation before making any change.

Do not act. Verify directly with IT and Treasury on known channels. Report the email as a phishing attempt and preserve the original for the security team.

Apply the change for one small supplier first as a test and escalate only if the test payment fails.

Disaster-themed charity fraud spikes within hours of any major headline, using emotional pressure and recycled imagery to push a fast decision. The test is simple: can you confirm the charity's registration and bank details on a channel you already trust? If not, you do not pay, no matter how urgent the appeal feels.

Donate the full EUR 2,000 to join the early wave of relief and file the tax paperwork afterwards.

Ask the sender for their charity registration and a scan of the certificate, then decide based on what they send.

Verify the charity yourself in the national register and approve the donation if the registration checks out.

Flag the red flags, forward to the CSR or leadership team with your notes, and let the decision go through the proper giving process.

An established supplier suddenly requesting crypto for an otherwise normal invoice is a very strong fraud signal. Either their systems are compromised or someone is impersonating them. Bitcoin payments are irreversible and nearly impossible to recover. The correct move is to fall back to the verified channel and reverify the request independently.

Arrange a one time crypto purchase and require SEPA again from next cycle.

Reply asking for written confirmation of the change on letterhead, then decide.

Pay via the SEPA account on file this cycle and call the supplier on a known number to verify the crypto request.

Escalate to the CFO and hold until the supplier submits a formal payment method change from their finance team.

Fake parking ticket QR codes are an active quishing technique. The QR on the paper ticket leads to a lookalike payment portal that captures card details. The colleague may already have compromised card data, and IT security needs to move quickly. The receipt authenticity question is secondary.

Reimburse and remind the colleague to be careful with QR codes next time.

Ask the colleague to repay the fine through the official municipal portal and release the reimbursement only once confirmed.

Pause the reimbursement, loop in IT security, freeze the card, and rotate credentials. Treat it as quishing.

Reimburse based on the paper ticket since the fine is real, and flag the QR finding to IT as a side note.

Paperwork later almost always means paperwork never. A PO is not a finance ritual, it is the one piece of evidence that someone, before the money moved, said "yes, go do this." After payment, the vendor and the requester get to write the story however they want.

Process and open a retroactive PO under the urgent engagement grace period.

Process as a one off journal entry and have the department head initiate the PO this week.

Split into two EUR 9,000 payments, pay the first now and the second once the contract is in place.

Hold the invoice, require a signed contract and PO before processing, escalate if the department head pushes back.

A compromised employee inbox is one of the easiest ways to redirect salary payments. The email looks legitimate because it comes from the real address. The fraud signal is not the content, it is the channel. Any change to a payout IBAN must be verified out-of-band before it takes effect.

Update the IBAN since the email came from the verified work address and includes a screenshot.

Update, send a EUR 1 pre note, and confirm with the employee before the full salary run.

Pause and verify out of band (phone call, in person, authenticated self service). Only update once identity is confirmed.

Accept for this cycle and ask the employee to formalize it in HR self service within 14 days.

Tax authority impersonation is a popular European fraud theme, with fraudsters spoofing Finanzamt, HMRC, or national tax authorities. Real tax agencies never ask for payment to foreign IBANs, and enforcement procedures follow formal documented steps that arrive well in advance of any payment deadline. Verify on a channel you control, not one printed on the letter.

Pay the amount promptly to avoid enforcement action and contest it later through your tax advisor.

Call the phone number printed on the letter to confirm, then pay if the person confirms the amount.

Do not pay. Contact your tax advisor and the Finanzamt directly using contact details you already have on file, and verify whether the notice is genuine.

Reply to the letter asking for a copy of the original tax assessment and pay once it arrives.

Refunds should be sent back to the originating account. Redirecting a refund to a different IBAN is both a money-laundering signal and a fraud vector (stolen cards used to purchase, legitimate IBAN used to collect the refund). Follow the money back the way it came in unless a strict, verified exception process applies.

Refund to the new IBAN based on the customer's explanation, documenting the freeze reason.

Refund to the original payment account in line with standard refund policy, and revisit the destination through a separate verified process if needed.

Split the refund across the original and the new IBAN to balance experience and risk.

Hold until the customer provides a bank letter confirming the freeze, then release to the new IBAN.

Tip offs catch more corporate fraud than audits, analytics, and management review put together. Almost half of all fraud comes to light because someone on the inside decided to say something. Handle tips well and you have the best fraud detection tool your company owns. Handle them badly and nobody speaks up again.

Confront the named colleague directly to hear their side and resolve the matter quickly.

Dismiss the tip as uncorroborated since it was anonymous and focus on the next audit cycle.

Treat it as a protected whistleblower disclosure, route to compliance, preserve confidentiality, and open an independent review of the named transactions.

Share the tip with the named colleague's manager so they can investigate informally within the team.

No malware. No hacking. Just a convincing email and one person under pressure. BEC is one of the most damaging fraud categories for finance and AP teams because it goes straight for the payment workflow. The most expensive cyberattack tool is still just email.

Business Email Compromise (BEC): invoice and payment fraud via email impersonation

By the time a budget overrun shows up in your monthly review, the money is already gone. Preventive controls stop the problem before it happens. Detective controls just give you a nicer way to explain it afterward. The difference is not subtle.

Reviewing expenses monthly and adjusting budgets after the fact

Providing budget visibility primarily at CFO level

Enabling real-time spend visibility with predefined approval workflows

Running quarterly financial reviews with department heads

The money is no longer "dirty." On paper it looks like a normal investment return. That is the entire purpose of integration, the third and final stage of money laundering. The three stages are Placement (getting the money into the system), Layering (obscuring the trail), and Integration (making it look legitimate). Once here, tracing it is extremely difficult.

Tax optimization through asset structuring

Integration of illicit funds into the legal economy

Reclassification of funds as operational income

The most reliable early warning signs often have nothing to do with the numbers. Refusing leave, avoiding access sharing, and reacting defensively to questions about vendors are well-documented precursors to internal fraud. These behavioral patterns appear long before any financial discrepancy shows up.

An accounting inconsistency not yet reflected in the books

Emerging cash flow risk in the team's processes

Control risk and potential opportunity for internal fraud

Possible tax misclassification or compliance exposure

The 3-way match is one of the oldest and most effective controls in AP. Before any invoice gets paid, three documents need to align: what you ordered, what you actually received, and what the supplier is charging. When all three match, you pay. When they do not, you investigate. Simple in theory, frequently skipped in practice.

The invoice amount, the payment date, and the supplier's tax number

The purchase order, the goods receipt, and the supplier invoice

The budget code, the cost center, and the department approval

The IBAN, the invoice number, and the contract reference

Smurfing is a form of structuring. Instead of depositing EUR 50,000 at once (which triggers automatic reporting in most jurisdictions), a money launderer splits it into many smaller deposits across different accounts or branches. The goal is to stay below the radar of automated detection systems. Classic placement-stage technique.

Using shell companies across multiple jurisdictions to hide the origin of funds

Breaking large sums of illicit money into smaller transactions to avoid reporting thresholds

What's at stake

How it works

Test Your Instincts

Get Your Verdict

Climb the Leaderboard

FAQs

Terms & Conditions