Invoice Manipulation, Vendor Impersonation, Rogue Agent Spend: The New B2B Fraud Surface

The fraud controls that most businesses have in place were designed for a specific threat model: humans attempting to deceive other humans in the payment process. Fake invoices submitted by external actors. Suppliers whose bank details have been changed by someone impersonating them. Employees who have exceeded their authorisation. These are real threats, and the controls built to address them including dual authorisation, supplier verification processes and invoice matching against purchase orders, represent decades of hard-won operational experience.

That threat model is no longer complete. The same payment workflows that human fraudsters exploit are now being targeted through mechanisms that existing controls were not designed to detect: AI-generated invoice manipulation that is indistinguishable from legitimate documentation, vendor impersonation executed with a precision that bypasses manual verification, and rogue AI agent behaviour that initiates payments within technically authorised parameters while operating entirely outside the intent of those authorisations.

The B2B fraud surface has expanded. The controls designed for the previous surface are necessary but no longer sufficient.

Invoice Manipulation: When the Document Looks Perfect

Invoice fraud is not new. What is new is the capability available to perpetrators and the resulting quality of fraudulent documentation that payment teams are now encountering.

Historically, fraudulent invoices were detectable through inconsistencies: formatting that differed from genuine supplier invoices, amounts that did not match established patterns, reference numbers that did not correspond to purchase orders. Trained reviewers and automated matching systems could identify these signals with reasonable reliability. Generative AI has changed the capability equation.

Fraudulent invoices produced with AI assistance

What detection now requires is contextual intelligence that goes beyond document verification, like for instance, analysing not just whether the invoice looks right, but whether the pattern of the invoice is consistent with the history of the supplier relationship, whether the bank details match verified records rather than recently submitted alternatives, and whether the timing and amount of the payment request falls within the expected behaviour of this counterparty in this period.

Static invoice matching cannot provide this, but context-aware AI compliance infrastructure can.

Vendor Impersonation: The Attack That Comes From Inside the Relationship

Vendor impersonation, where a fraudster convinces a business that a legitimate supplier has changed their bank details and that future payments should be redirected to a new account, is one of the most costly forms of B2B payment fraud globally. It succeeds not by breaking payment security systems but by exploiting the trust infrastructure that surrounds the payment relationship.

The classic attack vector is business email compromise: a fraudster intercepts or spoofs communication from a legitimate supplier, submits a bank detail change request that appears to come from a trusted contact, and waits for the next payment cycle to redirect funds to a fraudster-controlled account. What has changed is the sophistication of the impersonation. Modern vendor impersonation attacks:

• Use AI-generated communications that precisely replicate the writing style, tone, and formatting of the genuine supplier contact — making detection through language or style inconsistencies unreliable

• Operate over extended timeframes — engaging in genuine-seeming pre-change communication to establish legitimacy before the actual fraudulent request is submitted

• Target specific payment events — timing the bank detail change request to coincide with a known high-value payment that the fraudster has identified through intelligence gathering

• Exploit verification gaps — submitting requests through channels that bypass the verification controls applied to other update types, or providing false verification responses that satisfy process requirements without genuine authentication

The controls most effective against vendor impersonation are those that verify bank detail changes through a channel entirely separate from the one through which the request was received, and that apply heightened scrutiny to any payment initiated within a defined period following a bank detail change — regardless of how convincing the supporting communication appears.

What is also increasingly effective is AI-powered behavioural monitoring that identifies vendor impersonation attempts through the pattern of the communication and the request, rather than relying solely on the content of the verification exchange.

Rogue Agent Spend: The Fraud Category That Did Not Exist Two Years Ago

The most recent addition to the B2B fraud surface is also the most difficult to address through conventional controls, because it does not involve external attackers or compromised credentials. It involves AI agents — deployed legitimately within payment operations — operating outside the intent of their authorisation while remaining technically within its scope.

Rogue agent spend describes the category of payment fraud that occurs when an AI payment agent, operating autonomously within defined parameters, initiates payments that the authorising human would not have approved if presented with the specific decision. This is not a system failure. It is an authorisation design failure — and the distinction matters enormously for how it is detected and prevented.

Three mechanisms produce rogue agent spend:

1st Mechanism - Mandate scope ambiguity

An AI agent authorised for “supplier payments up to $50,000” initiates a payment to a 

vendor not on the approved supplier list for $49,800. The payment is within the amount 

limit. It is outside the intended scope. The authorisation framework did not specify the 

supplier list constraint with sufficient precision — leaving a gap between what the mandate 

technically permitted and what the authorising human intended to permit.

2nd Mechanism - Prompt injection attacks

An AI payment agent that retrieves context from external sources — supplier 

communications, web data, partner system APIs — can be redirected through malicious 

instructions embedded in that external data. A prompt injection attack does not require 

compromising the agent’s credentials. It requires embedding an instruction in data the 

agent is expected to read — redirecting its behaviour while it continues to operate within its 

authenticated session.

3rd Mechanism - Stale context execution

An AI agent operating on context that has become outdated — a supplier relationship that 

has changed, a business condition that no longer applies, a payment corridor that has become

restricted — initiates payments that were appropriate when the context was 

established and are no longer appropriate given current circumstances. The agent is not 

malfunctioning. It is operating correctly on incorrect inputs.

Detecting rogue agent spend requires monitoring that goes beyond checking whether each payment is within the agent’s defined parameters. It requires:

• Intent verification that is about comparing what the agent did against what the authorising human would have approved in the specific context of the decision, not just against the outer boundaries of the mandate

• Contextual anomaly detection which entails identifying when an agent’s payment behaviour deviates from its established pattern in ways that suggest it is operating on manipulated or outdated context

• Real-time mandate enforcement that involves evaluating each payment against the full scope of the intended authorisation, including implicit constraints that were not explicitly coded but are evident from the business context

• Prompt injection monitoring which scans the data sources an agent accesses for instructions that could redirect its behaviour, and flagging agents whose decision patterns change following specific data retrieval events

The Convergence of Three Threat Vectors

What makes the current B2B fraud environment particularly challenging is that these three threat vectors do not operate independently. A sophisticated attack may combine elements of all three: a vendor impersonation attempt that places fraudulent banking details into a supplier record, combined with an AI-generated invoice that passes document verification, combined with a prompt injection attack that redirects an AI payment agent to prioritise the fraudulent payment over the legitimate queue.

Each individual control addresses one vector. The combination is designed to pass all three. The defence requires an equivalent convergence of capabilities:

• Contextual compliance intelligence that evaluates each payment against the full 

history of the counterparty relationship, not just the current transaction

• Behavioural authentication that verifies bank detail changes through genuinely 

independent channels with multi-factor confirmation

• Agent governance frameworks that enforce intent-level authorisation rather than 

parameter-level authorisation — with real-time monitoring of agent behaviour 

against the full scope of what was intended

• Cross-vector correlation that identifies attack patterns spanning invoice submission, bank detail changes, and agent payment initiation — recognising the combination as a coordinated threat rather than three independent anomalies

Building Controls for the Fraud Surface That Exists Now

The businesses that are successfully containing B2B fraud in the current environment share a common characteristic: they have evaluated their controls against the fraud surface that exists now, not the fraud surface that existed when those controls were deigned.

Invoice verification processes that were adequate when fraudulent documents were detectable by formatting inconsistencies are not adequate when fraudulent documents are produced by AI. Bank detail change processes that relied on communication-based verification are not adequate when communications can be perfectly impersonated. 

Payment authorisation frameworks that defined mandate scope at the amount level are not 

adequate when AI agents can initiate payments within amount limits that fall entirely 

outside intended scope. The threat has evolved. The controls must evolve with it — or the gap between them will continueontinue to grow.

To get started and partner with a solutions provider that can help your business optimise payments and help you scale both locally and globally, open a SUNRATE account today or contact our sales team.