Is This Invoice Email a Scam? A Bookkeeper's Free AI Check

The email comes from a vendor you’ve paid every month for three years. It sits inside the same thread as last month’s invoice. The logo is right, the invoice number follows their usual pattern, and the amount is what you expected. The only thing that changed is the bank account, and the sender says they switched banks last week.

That is the scam that costs finance people the most money, and it’s the one that AI has made easier to pull off. In the FBI’s 2025 Internet Crime Report, business email compromise (BEC) cost victims $3.05 billion, second only to investment fraud. IC3’s separate Real Estate category, which covers real estate investment fraud and rental or timeshare scams, added another $275.1 million, up from $173.6 million the year before. The closing-day wire scams that agents worry about show up in IC3’s BEC case examples, labeled “BEC/Real Estate”, rather than in that category.

This guide is about one narrow, useful habit: pasting a suspicious payment email into a free AI assistant (ChatGPT, Gemini or Claude) and getting a structured red-flag read in about two minutes, before anyone releases money. It works well for what it does. It also has a limit that matters more than anything else in this post: an AI reading an email can’t tell you whether the bank account is real. Only a phone call to a number you already trust can do that. So this guide covers both halves, the screen and the call, and the order they go in.

One honest note about my own testing. I wrote three made-up emails (a vendor bank change, an “approve this invoice” note from a fake executive, and updated wire instructions before a closing) and ran the prompt below on Claude. The sample outputs in this post are shortened from what it returned. I didn’t run a head-to-head across tools, and I couldn’t test a real compromised mailbox, which is the hardest case and the reason the phone call exists.

What’s actually going on with payment-email fraud

Three pieces of evidence explain why this became a daily risk for bookkeepers, AP clerks, office managers and agents.

The money is large and still growing. The FBI’s IC3 report lists 24,768 BEC complaints in 2025 with reported losses of $3,046,598,558, up from $2.77 billion in 2024. IC3 also keeps a separate Real Estate category, defined as loss of funds from a real estate investment or fraud involving rental or timeshare property: 12,368 complaints and $275,110,419 in losses, against 9,359 complaints and $173.6 million in 2024. Closing-day wire fraud shows up in the BEC examples, labeled “BEC/Real Estate”.

Source: FBI Internet Crime Complaint Center, 2025 Internet Crime Report, page 8. These are reported losses, so the real total is higher.

AI is not the main cause, but it removes the easiest tell. The same report says IC3 received more than 22,000 complaints that mentioned AI, with adjusted losses over $893 million, and that businesses reported over $30 million in BEC losses involving AI. That is roughly 1% of the BEC total, and the FBI notes that not all BEC is AI-enabled. Most of this fraud is still the old trick. What AI changes is polish: no typos, a tone that matches the real vendor, and fake documents that look right. “It was badly written” used to catch a lot of these. It catches fewer now.

Whole campaigns are being run at scale. Microsoft’s security team described a campaign it saw from August 3 to 5, 2026: more than a million emails, about 87.7% aimed at U.S. users, impersonating CEOs, CFOs and presidents of the target companies and pushing accounts-payable staff to pay a fake ServiceNow “Platform, Annual Subscription” invoice of nearly $50,000 by ACH. The email included a “forwarded” thread and a fake invoice, and the lookalike domain was registered days earlier. Microsoft found no evidence that ServiceNow or the named executives were compromised; it was pure impersonation. Microsoft also said some features of the emails (heavy HTML comments, very uniform structure) were “consistent with AI-assisted template development” while cautioning that this doesn’t prove how much AI wrote them. Real estate accounted for about 8% of the industries it saw targeted.

The survey data matches what practitioners say. The Association for Financial Professionals’ 2026 payments fraud survey, which polled 465 treasury practitioners in January 2026 about their 2025 experience, reports that 76% of organizations were hit by attempted or actual payments fraud, and its press release says 74% were affected by BEC.

And the people doing this work say the same thing on social media. In an r/Accounting thread from earlier this year about a near-miss on a six-figure wire, the top replies are almost all one rule: call a number you got independently. One commenter wrote that a new AP employee called the number on the fake email to “verify,” and the company lost $300,000 over it. (A different commenter suspected the original post was marketing, so I’m quoting the comments for the controls, not the story.) A February post on X from Barrett Linburg (@DallasAptGP) tells the same story in miniature: right logo, right project, right invoice number, new bank account, $50,000 saved only because the vendor’s hacked email came to light a few days later. His three rules were: a banking change means full stop, never call the number on the new email, and put a mandatory hold plus a voice callback on every updated account.

What “AI as a first-pass screen” can and can’t do

Before the walkthrough, here’s the frame, because everything else depends on it. Think of the AI as a second reader who is very good at noticing patterns in text and has no idea who your vendor is.

It can point out a lookalike domain, a Reply-To address that doesn’t match the sender, a deadline that exists only to rush you, a bank change, an odd forwarded thread, and numbers on an invoice that don’t add up. It can do that in seconds, in plain language, at 4:45 on a Friday when you’re tired.

It can’t call your vendor. It doesn’t know your vendor master. It can’t see whether the real vendor’s mailbox has been taken over. If an attacker is sending from the vendor’s genuine account, inside a genuine thread, with a genuine invoice number, the text may look perfectly clean and the AI may say so.

The research on how well language models spot phishing is mixed, and none of it is about your exact situation:

• In a 2024 study (Koide and colleagues), GPT-4 with a detailed, purpose-built prompt missed 0.3% of 1,010 phishing emails and wrongly flagged 0.3% of 1,000 legitimate ones. The same pipeline using GPT-3.5 and a simple prompt missed about 31% of the phishing emails. But that test used a purpose-built prompt, parsed headers, and explicitly left out messages without links, which is exactly the shape of a payment-diversion email.
• A 2025 preprint (Hasan and colleagues) tested GPT-4o and Claude Sonnet 4 and found roughly 89% recall on a small English subset (only nine phishing emails), and found that rewriting phishing emails in professional language let some slip past: 4.2% evasion for GPT-4o and 12.7% for Claude Sonnet 4 in their test.
• I could not find a validated, real-world miss rate for BEC-style emails on today’s free chatbots. The one peer-reviewed BEC paper I found builds a dataset; it doesn’t measure detector accuracy.
• F-Secure’s August 2026 “ASK” benchmark (35 scam scenarios, 840 scored responses from ChatGPT and Gemini, with Claude as judge) found strong warnings above 95% of the time on average, but about one in five harmless questions also triggered a scam warning, and the same ChatGPT question about a work-from-home reshipping job scored 0, 4 and 4 across three identical runs. That means one run gave a caution-free answer. Same input, different verdict.

Put together, the honest reading is: an AI screen is good for triage, and a reassuring answer is not permission to pay. The professional guidance from NAR, ALTA, the American Bar Association, ICAEW and the FBI never says “run it through a chatbot.” It says verify independently before money moves. The screen is worth doing because it helps you notice the right questions faster. The call is what protects the account.

The 2-minute screen, step by step

Here’s the full routine. It takes about two minutes for the screen and five to ten for the call, and the call is the part you can’t skip.

Step 1: Stop and treat any bank-detail change as a hold

Before you open an AI tool, make the decision that matters most: any change to who gets paid or where the money goes is on hold until you’ve verified it by phone. That includes a new bank account for an existing vendor, a new payee, a new remittance address, an executive asking you to pay an invoice outside the normal process, and a “wire instructions have been updated” message.

The expected result: nothing moves while you screen and verify. A real vendor can wait a day for a payment. A scammer can’t, which is why the email you’re reading probably contains a deadline.

Step 2: Strip what you shouldn’t paste

Free consumer AI tools have data rules you should know before pasting anything (covered in a table below). For a first-pass screen you don’t need real account numbers, and you don’t need most names. Here’s what to keep and what to remove:

Keep the domains, because a lookalike domain is one of the easiest things for an AI to catch and it can’t catch what you hide. If you’re a bookkeeper or tax preparer, read the privacy section below before pasting anything that came from a client.

Step 3: Paste the screening prompt

Here is the prompt I used. Copy it, replace the bracketed part with your stripped email, and paste it into a new chat. I’d keep it saved as a note so you can reuse it.

You are a payment-fraud screening assistant helping a bookkeeper or
accounts-payable clerk. Below is an email that asks for a payment or a
change to payment details. Account numbers and personal names have been
removed on purpose.

Review it and answer in this format:

1. RISK READ: low / medium / high, with one sentence on why. Remind me
   this is a text-only screen, not proof either way.
2. RED FLAGS: a numbered list. Check specifically for: lookalike or
   mismatched sender and Reply-To domains; a request to change bank
   details or payee; urgency or a deadline; a request to skip the normal
   approval process or not to call; unusual payment method; vague or
   generic wording; an invoice that doesn't match normal patterns;
   numbers that don't add up; forwarded threads that look pasted in.
3. WHAT I CAN'T TELL FROM THE TEXT: list what would need to be checked
   outside this email (for example, whether the sender's real mailbox is
   compromised, or whether the vendor really changed banks).
4. VERIFY BEFORE PAYING: the exact checks to do, in order. Always
   include a call to a phone number already on file, never one from
   this email, and a second approver for any changed payee.

Do not say the email is "safe" or "legitimate". If you see no red flags,
say "no red flags found in the text" and still list the verification
steps.

EMAIL:
[paste the stripped email here]

Two choices in that prompt are deliberate. It tells the AI to say what it can’t know, because otherwise chatbots tend to sound more certain than they should. And it forbids the words “safe” and “legitimate,” because the F-Secure results show a single reassuring answer can be a one-off.

Step 4: Read the answer for what it tells you to check

Here’s a worked example, carried through to the end. The sample email, with every detail invented:

From: Marcus Hale accounts@brightlinesupply.com Reply-To: accounts@brightline-supply.co Subject: RE: Invoice 20418, October janitorial supplies

Hi Dana, quick update on the October invoice (about $4,900). We moved banks last week, so please send this payment to our new account instead of the one you have on file. Details are below [ACCT REMOVED]. If you can release it by Friday we can avoid a late fee on our side. Thanks for your help.

And a shortened version of what Claude returned:

1. Risk read: high. This matches a common vendor bank-change pattern. This is a text-only screen and not proof either way.

2. Red flags:

1. The Reply-To domain (brightline-supply.co) differs from the sender domain (brightlinesupply.com). Replies would go to a different place than the From address suggests.
2. It asks you to send payment to a new account instead of the one on file.
3. A deadline (“by Friday”) tied to a late fee creates pressure.
4. It arrives as a reply inside an existing invoice thread, which is a common way these are made to look routine.
5. It gives no reference you can match to a purchase order or contract.

3. What I can’t tell: whether the thread is genuine, whether the vendor’s real mailbox is compromised, whether the vendor actually changed banks, and whether the Reply-To difference has an innocent explanation.

4. Verify before paying: (1) hold the payment; (2) look up the vendor’s phone number in your vendor records or on a source you already trust, not in this email; (3) call and ask them to read out the account details they want you to use; (4) compare to the account on file; (5) have a second person approve the change; (6) note who you spoke to, when, and which number you used.

Notice what the AI did well: it spotted the Reply-To mismatch, which is easy to miss in a mail client that only shows the display name, and it turned a vague worry into a checklist. Notice what it didn’t do: it didn’t tell you whether Marcus really moved banks. It can’t.

Now a harder example, from a real fake. Microsoft published a redacted copy of the invoice from the campaign above.

Source: Microsoft Security Blog, “Protecting organizations from AI-assisted executive impersonation and invoice fraud” (September 10, 2026). Account details and the recipient’s name are redacted by Microsoft.

If you add the four line items as printed ($24,678.90, $15,369.91, $11,236.08 and $6,384.41) you get $57,669.30. The invoice’s own subtotal says $57,465.90, there’s no discount line, and the total due says $49,465.90, with the currency shown as MXN. The invoice date is July 2025 and the “due” date is July 3, 2025, though the email arrived in August 2026. That’s my reading of Microsoft’s figure, and I’m not a forensic accountant, but these are exactly the kind of internal inconsistencies a language model is good at spotting when you ask it to check whether the numbers add up. They are also things a rushed AP clerk skips past, because the logo and layout look right.

Microsoft also listed red flags in the email text that an AI screen can notice: the “forwarded” messages had no normal forwarding headers, the CEO supposedly asked not to be copied but the latest message came from his address, display names didn’t match sender addresses, and the lookalike domain (service-nowinc[.]com) had been registered four days earlier.

Step 5: Make the call, and make it the right call

This is the step that protects the money. The rules, which every authoritative source agrees on:

1. Call a number you already had. Use your vendor master file, a past signed contract, the vendor’s official website that you found yourself (not through the email), or a contact you’ve spoken to before. Never use a number in the email, in its signature, or in a “new details” letter. The r/Accounting commenter who lost $300,000 dialed the number on the fake email.
2. Make an outbound call. Don’t accept a call-back from “the vendor” that arrives after you raise concerns.
3. Ask for the information, don’t offer it. Instead of “did you change your bank to First National?” ask “can you tell me the account you want us to pay into?” A scammer who has already seen your thread can say yes to a yes/no question. Then compare what they say to the new details in the email.
4. If the vendor says nothing changed, that’s the answer. Don’t pay. Tell your IT contact, forward the email as an attachment, and consider that the vendor’s mailbox may be compromised, so let them know by phone too.
5. If the change is real, record it properly: who you spoke to, when, the number, what they said. Then get a second approval.

A call script, for when you’ve never done this:

“Hi, this is [name] from [company]. I’m calling the number we have on file for your accounts team. I received an email asking us to update your payment details. We confirm every bank change by phone before we process it. Can you tell me which account you’d like us to use, and who requested the change?”

If you can’t reach anyone, a practical fallback many AP teams use is to pay by check or another existing method until the change is confirmed. As one commenter put it in that same thread: if they can’t pass the verification bar, they get a check.

Step 6: Two people, a log, then pay

For a changed payee or a bank detail change, the person who changes the vendor record shouldn’t be the person who releases the payment. ICAEW’s guidance on invoice fraud recommends separating vendor setup, invoice approval and payment, matching invoices to purchase orders and delivery notes, and investigating bank-account changes and amounts just under approval limits. For a small office with two people, the cheap version is: you do the call, and the owner approves the changed account.

Keep a one-line log: date, who verified, which number was used, who approved. If anything goes wrong later, that line is your evidence that you followed a process.

Comparison: what the AI screen catches, and what only a call can settle

The pattern in that table is the point of this post. The AI screen is strong where the message gives itself away, and weak exactly where the attack is best. The call covers the weak column.

The closing-day version for real estate agents

For agents, transaction coordinators and title or escrow staff, the same logic applies with one change: the money usually moves from your client, not from you, and the scammer’s best moment is the last few days before closing.

The FBI’s report describes two of these. In one, a senior citizen closing on a property received a compromised email from the “title company” with wire instructions for more than $1.3 million to a fraudulent account. The FBI’s recovery team froze the account in time. In another, buyers received an email impersonating their own attorneys and wired over $449,000, and the money was still sitting in the account when a freeze was requested. Across 2025, the FBI’s Financial Fraud Kill Chain process handled 3,900 incidents, froze $679 million of $1.16 billion in attempted theft, and reports a 58% success rate. Those results depend on speed.

Source: FinCEN, Rapid Response Program Fact Sheet (April 15, 2026). Page 2 adds that FinCEN is most likely to be able to interdict or recover funds when fraudulent wires are reported to law enforcement within 72 hours of the transaction.

What the real-estate industry’s own guidance says:

• NAR advises getting wiring instructions in person where possible; otherwise confirm in person or by calling a trusted number, never a number from a suspicious email or voicemail, and confirm receipt right after the wire.
• ALTA (the title association) has an outgoing-wire checklist covering the source of the instructions and verification of anything received by email, and confirming delivery afterward.
• The American Bar Association says never to initiate a wire based solely on an email, and to call a number already on file, not the one in a signature block.

The AI screen for an agent is a short variation on the prompt: ask it to compare the sender’s domain with the one in the signed contract (you’ll need to give it both), to look for changed instructions versus earlier ones, to flag urgency or requests to avoid calling, and to tell you what to verify. Then you do the part the tool can’t: tell your client, in writing, at the start of the transaction, that the title company’s wire instructions will never change by email and that they should call the title company at a number from the contract before sending a dollar. Don’t forward wire instructions you haven’t verified yourself.

A reasonable sentence to put in your welcome email: “You will receive wire instructions only from [title company]. If anyone emails you changes, call us before you send anything.”

Data privacy: what happens to the email you paste

Pasting an email into a free chatbot isn’t free of consequences. Each provider has settings you should check, and “training off” isn’t the same as “confidential.” Based on each provider’s help pages as of October 20, 2026:

Sources for that table are linked at the bottom; settings names change, so check the current screen.

Two professional notes, with the usual caveat that this isn’t legal advice:

• If you prepare tax returns, IRC §7216 restricts how a preparer uses or discloses tax return information, with criminal penalties for knowing or reckless unauthorized disclosure. It doesn’t automatically cover every piece of bookkeeping data, but it’s broad enough that you shouldn’t paste client financial details into a consumer AI tool without checking the rules and getting proper consent. The IRS’s 2026 responsible-AI guidance warns against public or unsecured systems.
• If you’re a covered financial institution under the FTC’s Safeguards Rule, which includes firms like tax preparers, adding an AI service that receives customer information belongs in your security risk assessment and vendor oversight. Turning off training addresses one use, not retention, access or contract terms.

The practical answer for this use case is easy, because the screen doesn’t need the sensitive parts. Remove account numbers, client names and personal details, keep the domains and the wording, and the privacy exposure is small. For redaction help, our guide to running local PII redaction covers a free tool that works on your own computer.

What this means for you

If you’re a solo bookkeeper with several clients. You’re the whole control system for each client’s payables, and you may not have a second approver. Your first action: add a line to every client engagement letter saying you verify bank changes by phone with the client or the vendor, and that the client approves any changed payee in writing. That moves a judgment call into a documented process, and it protects you if something goes wrong.

If you’re an AP clerk at a mid-size company. The risk to you is volume and pressure: dozens of invoices, a CFO name in the sender line, and a Friday cutoff. Your first action: ask your controller to confirm in writing that a changed bank detail needs a callback and a second approver, with no exceptions for executives. Then save the screening prompt where you can find it quickly.

If you’re an office manager at a small firm. You probably pay the bills with whatever bank portal the owner set up, with no formal policy. Your first action: write three rules on one page (call a known number for any bank change, hold changed accounts for a day, owner approves new payees) and get the owner to initial it. Then use the AI screen as a habit before paying anything unusual.

If you own a small business and pay your own invoices. You’re the target for the “our bank details have changed” email, and you may not have anyone to double-check you. Your first action: keep a list of your vendors’ phone numbers somewhere that isn’t your email, and call before you change any payment destination, even if it’s a vendor you’ve dealt with for years.

If you’re a real estate agent. You can’t stop a client from wiring money, but you can make sure they’ve heard the warning before the scammer’s email arrives. Your first action: add the wire-fraud warning to your first email in every transaction and to your closing checklist, and never forward wire instructions you haven’t confirmed by phone with the title company.

If you’re a transaction coordinator or title and escrow staff. You’re the person the scammer impersonates, and the person who sees the “updated instructions” email first. Your first action: tell clients and agents that your office never changes wire instructions by email, and put the callback number on a document they receive early.

If you approve payments (controller, owner, finance director). You set the culture. Your first action: make sure the person who calls to verify a bank change is not pressured by you or anyone else to skip it, and that the person who changed the vendor record isn’t the one releasing the payment.

Edge cases and troubleshooting

These problems come from the practitioner threads and the limits of the tools.

The AI says “no red flags found,” and the email still feels off. Trust the feeling and run the call anyway. Run-to-run variation is real: F-Secure saw the same ChatGPT question get a caution-free answer in one of three runs. A clean read means nothing was visible in the text. A compromised vendor mailbox can produce text with nothing visible in it.

It’s a brand-new vendor and you have no phone number on file. The callback has nothing to call. Find a number independently: the vendor’s website reached through a search you start yourself, a business registration lookup, or a reference who already works with them. For a first payment to an unknown vendor, ask for a W-9 or equivalent and consider paying a small first invoice by a traceable method, or by card, which is easier to dispute.

The vendor really did change banks, and the AI flagged it. That’s fine. A false alarm costs you a five-minute call. Do the verification, record it, get the second approval, and the real change goes through. Never “turn off” a control because the flag turned out to be wrong this time.

You called the vendor and the voice sounded right. Voice cloning exists, and the FBI’s report lists it as a BEC tactic. Make the outbound call to a number you already had and, for large amounts, ask a question only the real contact would know or ask for a video call. One commenter in that r/Accounting thread, asked how to verify, answered simply: “Video calls.”

The invoice is a PDF or screenshot, not email text. Most free chat tools accept images, but a PDF can contain account numbers and client names. Redact first, or retype only the parts you need: the line items, subtotal, tax and total, the dates and the currency. Then ask the AI to check whether the numbers add up and whether the dates and currency make sense.

The “CEO” wants you to pay an invoice and says not to call. That’s the pattern in Microsoft’s campaign: an executive’s name in the display name, a pasted “forwarded” thread, and wording like “no need to copy me.” Call the executive on a number you already have, or walk to their desk. If it’s real, they’ll be glad you checked.

You hit the free-tier message limit mid-screen. Rather than reaching for an unknown “free scam checker” website that wants your whole email and your address, wait or switch to another of the three tools. Free third-party checkers have their own data policies, and many weren’t built for payment emails.

You already paid. Move fast. The FBI and FinCEN both say time matters. Call your bank immediately, ask for a recall of the funds, and file a complaint at ic3.gov. FinCEN’s April 2026 fact sheet says it is most likely to be able to interdict or recover funds when fraudulent wires are reported to law enforcement within 72 hours of the transaction. Ask your bank what it offers, because policies differ. Report it even if the amount seems small.

What this can’t fix

It can’t verify that an account belongs to a vendor. Only the vendor can tell you that, on a call you place. No AI tool can look at a bank account number and know whose it is.

It can’t detect a fully compromised mailbox. If the attacker controls the vendor’s real account and writes in the vendor’s real voice inside a real thread, the text can be indistinguishable from the real thing. ICAEW describes an AU$900,000 invoice that came from a genuine supplier address whose system had been compromised and whose account details had been changed.

It doesn’t replace controls. Dual approval, a vendor master with change logs, callback rules, and positive pay-style bank controls are what a finance team actually relies on. Positive pay matches issued checks to presented ones, so it won’t stop a payment you authorized to the wrong account.

It isn’t a measured detection rate. Published studies cover different models, prompts and datasets. Nobody can tell you “this prompt catches X% of invoice scams.” Treat the screen as a prompt for better questions.

It doesn’t make pasting client data safe. “Training off” is one setting, not a confidentiality guarantee, and for tax preparers and some other firms the rules go further than a privacy toggle.

FAQ

Can ChatGPT, Gemini or Claude tell me if an invoice email is fake? They can spot warning signs in the text, such as lookalike domains, urgent deadlines and bank-detail changes, and they can check whether invoice numbers add up. They can’t confirm that a bank account is real or that a mailbox hasn’t been compromised. Use the answer as a checklist, then verify by phone.

What’s the safest way to check a changed bank account? Call a phone number you already had, from your vendor records or a contract, and ask the vendor to state which account they want you to use. Don’t use any number or link from the email. Then get a second person to approve the change and log it.

Is it safe to paste the email into a free AI tool? It depends what’s in it. Remove account numbers, personal names, client names and tax IDs, and keep the domains and wording. Check the provider’s training and retention settings first. Bookkeepers and tax preparers should also consider IRC §7216 and the FTC Safeguards Rule.

What are the biggest red flags in a vendor payment email? A request to change bank details, a deadline or late fee that creates urgency, a Reply-To address that differs from the sender, a request to skip normal approvals or not to call, a “forwarded” thread with no headers, and invoice math that doesn’t add up.

Does AI make these scams harder to spot? It removes the typo and awkward-phrasing tells. The FBI’s report counts about $30 million of BEC losses involving AI against $3.05 billion in total BEC losses, so most of the fraud is still the traditional kind. Process controls matter more than spotting bad grammar.

What should a real estate agent tell clients about wire fraud? That wire instructions come from the title company and will never change by email, and that they should call a number from their signed contract before sending money and again afterward to confirm receipt. NAR and ALTA both recommend verifying by phone with a trusted number.

How fast do I need to act if I already sent the money? As fast as you can. Contact your bank right away to request a recall and file a complaint at ic3.gov. FinCEN says recovery is most likely when wires are reported to law enforcement within 72 hours.

Should a small business with two employees bother with dual approval? Yes, in a light form: the person who takes the call and records the bank change isn’t the one who releases the payment, or the owner approves any new or changed payee. It costs minutes.

Is a “free email scam checker” website a good alternative? Some are fine for general phishing, but they weren’t built for payment diversion and many keep what you submit. Use one only with the same stripped-down text you’d give a chatbot, and don’t treat a pass as clearance.

Does this work for invoices that arrive as PDFs? You can ask the AI to check line items, totals, dates and currency, but redact account numbers and names first, and verify by phone either way.

The bottom line

If you handle other people’s money, the best use of free AI here is small and specific: a two-minute second reader that notices the lookalike domain, the rushed deadline and the numbers that don’t add up, then hands you a checklist. Strip the sensitive details first. Read the result as a list of questions, never as a verdict. And treat the phone call to a number you already had as the actual control, because that is the step that has caught these scams in every story above, and skipping it is the step that cost one team $300,000.

If you want to build these habits into your regular workflow, our Bookkeeping with AI course covers verification and controls for bookkeepers, and AI for Real Estate Agents covers the agent side. AI Privacy 101 is the place to learn what to keep out of any chatbot. For related reading, see our guides to AI voice cloning scams and ChatGPT scams. If a suspicious message arrives as a text rather than an email, our guide to checking a text with the AI on your phone covers that case. For a free starting prompt, try the Phishing Email Detector skill.

Update note: this guide reflects data and provider settings as of October 20, 2026. The FBI IC3 and FinCEN figures come from their published 2025 report and April 2026 fact sheet. AI provider privacy settings change often, so check the current screens before you rely on the table above. This is general information, not legal or tax advice.

Sources

• FBI Internet Crime Complaint Center, 2025 Internet Crime Report (PDF)
• Microsoft Security Blog, “Protecting organizations from AI-assisted executive impersonation and invoice fraud” (September 10, 2026)
• FinCEN, Rapid Response Program Fact Sheet (April 15, 2026)
• AFP, 2026 Payments Fraud and Control Survey
• AFP press release, “Over 75 percent of US firms experienced payments fraud in 2025”
• ICAEW, “How to spot a fake AI-generated invoice” (March 2026)
• ICAEW, “How to identify and deal with fake invoices” (February 2026)
• NAR, Consumer Guide: How to Protect Against Real Estate Wire Fraud
• ALTA, Wire Fraud resources
• American Bar Association, “Lawyer Liability for Wire Transfer Fraud” (2025)
• Koide et al., “ChatSpamDetector: Leveraging Large Language Models for Effective Phishing Email Detection” (arXiv 2402.18093)
• Hasan et al., “Phishing Email Detection Using Large Language Models” (arXiv 2512.10104)
• F-Secure, “AI can answer almost anything. But can it spot a scam?” (August 2026)
• OpenAI Help, How your data is used to improve model performance
• Google, Gemini Apps Activity and privacy
• Anthropic, Is my data used for model training?
• IRS, Section 7216 Information Center
• FTC, Safeguards Rule: What Your Business Needs to Know
• Barrett Linburg (@DallasAptGP) on X, vendor invoice near-miss and three rules (February 2026)
• r/Accounting, “Vendor email compromise nearly cost us a six figure wire transfer” (comments)