Commercial Fraud in Focus: What's to Come in 2027

The three biggest emerging fraud trends for 2027 are artificial intelligence (AI)-enabled social engineering, real-time payment exploitation and synthetic identity fraud. Rather than operating as fully autonomous attackers, fraudsters use AI to scale phishing emails, clone voices and generate deepfake videos at a fraction of the traditional cost. At the same time, the shift toward instant payment rails and convincing fake business profiles means companies must verify vendors and approve transactions before money ever leaves an account.

Scammers use AI as a force multiplier to make commercial fraud faster, cheaper and harder to spot. While human attackers still direct the schemes, AI tools handle the heavy lifting:

• • Identifying high-value corporate targets.
  • Writing flawless, convincing phishing emails and text messages. 
  • Translating scams across multiple languages instantly. 
  • Creating realistic voice and video impersonations of company executives. 

Because attackers now operate at machine speed, many companies are shifting their cybersecurity from a "human-in-the-loop" model to a "human-on-the-loop" defense. In this approach, defensive AI automatically isolates compromised devices, disables accounts and blocks suspicious IP addresses in real time, while your security team reviews weekly samples to govern the system.

You can reduce real-time payment fraud risks by front-loading your payment controls before anyone clicks send. Because instant payments settle immediately and cannot be recalled like a traditional check, your protective measures must happen prior to initiation. Effective front-loaded controls include:

• Dual Controls: Require two separate authorizations before any real-time payment is released.
• Segregation of Duties: Ensure the associate who sets up a vendor or initiates a payment is never the same person who approves it.
• Control Totals: Set strict dollar limits that trigger manual executive review.
• Intentional Speed Bumps: Build brief verification pauses into your approval workflow to confirm payment requests without slowing down daily operations.

Synthetic identity fraud is an emerging fraud trend where criminals combine real and fake information to create a convincing, fictitious business or individual profile. Fraudsters often use AI to build realistic websites and forge paperwork, making this threat hardest to catch during vendor onboarding and new account opening. To spot synthetic identity fraud before onboarding a new vendor, your team should perform independent verification:

• Search the Wisconsin Department of Financial Institutions and Secretary of State websites to confirm the company is registered and active.
• Check the company's age and compare its legal name against its "doing business as" (DBA) name.
• Verify that the vendor lists a physical street address rather than a post office box.
• Call the banker listed on the vendor's bank verification letter using an independently verified phone number to confirm the account is legitimate.

Even as emerging fraud trends grow more sophisticated, basic security habits remain your strongest line of defense. Every company should pair modern treasury controls with two foundational practices:

• Enforce Multi-factor Authentication (MFA): Require MFA across all financial and corporate systems. Also, remind associates never to share MFA codes. Legitimate organizations and advisors will never ask for these codes.
• Run Short, Frequent Employee Training: Replace annual compliance courses with brief, regular training sessions. Keeping current red flags top of mind helps your team pause and question unusual requests.

If a payment request or vendor change ever feels off, contact your Johnson Financial Group Treasury Management advisors before taking action.

To stay ahead of emerging fraud trends and new vulnerabilities, Chief Information Security Officer, Mark Ward recommends adding these resources into your routine to help your security and finance teams spot active schemes early.

Daily cybersecurity podcasts for quick threat awareness:

• Cyber Security Headlines (from the CISO Series): A six-minute daily news podcast covering the most important cybersecurity stories and emerging threats each morning.
• SANS Internet Storm Center ("Stormcast"): A five-to-10-minute daily update summarizing current network security threats, vulnerabilities and active attack patterns.

Free security control frameworks to strengthen your defenses:

• Australian Signals Directorate (ASD) Essential Eight: A practical baseline of eight mitigation strategies designed to protect organizations against common cyber threats.
• Center for Internet Security (CIS) Critical Security Controls: A prioritized, prescriptive set of best practices you can use for free to defend your systems against the most pervasive cyberattacks. 

For tailored guidance on protecting your accounts and payment workflows, connect with your Johnson Financial Group Treasury Management advisors.