Microsoft warns of AI-assisted executive impersonation invoice fraud
In August 2026, Microsoft discovered a large fraud campaign involving more than one million emails in which attackers pretended to be company executives.
The fake emails asked accounts payable staff to send payments of nearly $50,000 to fraudulent accounts.
To appear more convincing, the attackers included a fabricated email thread in which the fake CEO forwarded invoices that appeared to come from the real company ServiceNow, meaning ServiceNow's identity was also misused.
According to Microsoft, about 88 percent of the targets were in the United States.
Researchers found signs that the email templates were built with the help of AI, such as unusually uniform structures and hidden code comments. However, they say they cannot confirm exactly how much of the content was actually generated by AI.
A security expert from Swimlane said AI is making existing fraud tactics more effective and easier to scale up.
It remains unclear exactly how the attackers used AI and whether similar campaigns are targeting other countries or companies.
WHY IT MATTERS
AI assistance can make these fraud emails look far more convincing, making it easier to trick companies and their employees.
WHAT YOU CAN DO NOW
- Verify payment requests by phone If an email asks for an unusual payment, call the person it claims to be from directly. Use a phone number you already know, not one listed in the suspicious email.
- Check the full sender address Look at the complete email address, not just the displayed name. Scammers often use addresses that differ from the real one by only a few letters or a different domain.
- Be wary of urgency and secrecy Scammers often push for fast, secret transfers. Take your time and get a second opinion from a colleague before acting.
- Require two people to approve payments Set up a rule at your company that larger payments always need approval from at least two people. This way, one fake email cannot cause damage on its own.