Commercial Fraud in Focus: What We Saw in 2026

Business email compromise (BEC), bank account takeover, AI-assisted voice cloning and traditional check fraud are the top bank fraud trends hitting companies in 2026. About 76% of U.S. organizations experienced attempted or actual fraud last year, proving that fraudsters target mid-sized and local companies just as aggressively as large corporations. Today’s threats rarely look like flashy cyberattacks. Instead, they show up as routine requests to update vendor payment instructions, altered checks stolen from the mail or urgent phone calls from someone pretending to be your bank.

Business email compromise happens when a fraudster gains access to a company email account and tricks employees into sending wire or ACH payments to a fraudulent bank account. According to the Federal Bureau of Investigation (FBI), business email compromise and account takeovers cause $3 billion in losses — a figure that grows by roughly $400 million every year.

• Initial breach: An employee clicks a phishing link, giving the fraudster access to their inbox. 
• Silent monitoring: The fraudster watches email traffic for weeks or months to learn vendor relationships, invoice schedules and financial contacts. 
• Hidden rules: The criminal creates hidden email subfolders and routes incoming messages from specific vendors or banks straight into those folders so the employee never sees them.
• Payment redirection: The fraudster steps into an active invoice thread or uses a slightly altered email address, like replacing an "m" with an "r" and an "n", and asks your accounting or payroll team to send an ACH, wire or direct deposit to a "new" bank account.

Two immediate red flags should make your team stop and question a financial request:

• An unfamiliar caller creating urgency: If someone you do not recognize calls claiming there is an urgent issue with your bank account, hang up immediately. If there is a legitimate issue with your Johnson Financial Group account, your dedicated commercial advisor or Treasury Management associate will be the one to contact you.
• Any request to change bank or payment information: Whenever a vendor, customer or employee emails a request to update ACH routing numbers, wire instructions or direct deposit details, treat it as a potential threat until verified.

Slowing down and verbally verifying payment requests through a trusted contact is the single most effective way to prevent commercial bank fraud. Even when extra verification steps feel like they slow down daily efficiency, putting simple internal controls in place protects your company from losses that are almost impossible to recover once funds leave your account:

• Call a known contact at a known phone number: Never call the phone number listed in an email requesting a payment change. Look up the contact's number in your internal system and verbally confirm the change.
• Never share multi-factor authentication codes: Your bank will never call, text or email you to ask for your secure access code or login credentials.
• Train your employees continuously: Because three-quarters of organizations face business email compromise attempts, ongoing fraud awareness training for everyone from human resources (HR) to accounts payable is essential.
• Review your insurance coverage: Work with your leadership team to ensure your company has dedicated cyber and fraud insurance policies in place.