The democratization of generative Artificial Intelligence has a dangerous flip side: it has lowered the cost and barrier of entry for cybercriminals to attack businesses. Today, on June 8, 2026, multinational insurance giant Aviva published in its annual report a historic record of fraud detection exceeding £230 million, warning that scammers are now systematically using AI to alter invoices, manipulate supplier delivery notes, and forge payment receipts.
For a small or medium-sized enterprise, receiving an email that looks exactly like one from a regular supplier attaching a PDF invoice identical to previous ones, but with the bank account number subtly modified by AI, can lead to an irreversible financial disaster.
Today, at IA4PYMES, we technically analyze how these new AI-based document scams operate and give you a 3-step security protocol to shield your administration department.
How Do Scammers Forge Documents with AI?
Unlike the crude photo edits of the past, generative AI allows digital documents to be altered in a way that is almost undetectable to the human eye:
- Smart PDF Editing (OCR and Inpainting): AI detects the exact font, size, and color of an original PDF and allows texts (such as the IBAN code or the total amount) to be replaced so that the final document retains the same layout without alignment errors.
- Email Spoofing (Contextual Phishing with AI): Attackers hack a supplier's inbox (or spoof their domain) and use language models to analyze the tone of past conversations. They then write an email perfectly tailored to the company's jargon saying: "Dear all, we attach the monthly invoice with our new payment IBAN."
- Intact Metadata: Many scammers make sure to regenerate the PDF while retaining the original document's creation metadata to avoid raising suspicions in automated IT audits.
Security Protocol Against AI Fraud in Accounting
To protect your SME's treasury, administration and accounting departments must abandon blind trust in digital documents and apply a strict verification protocol:
Step 1: The Alternative Channel Double-Verification Rule
This is the most important rule. It is strictly forbidden to make payments to a new bank account without verifying it first:
- Procedure: If you receive an email or invoice indicating a change in a regular supplier's bank account, you must call them using a phone number you already have saved in your contacts (never the number that appears at the bottom of the new suspicious email) to verbally confirm the change.
Step 2: Use of Cryptographic Digital Signatures (Signed PDFs)
Require your main suppliers to use integrated cryptographic digital signatures in PDFs (such as Adobe Sign).
- Why it works: If a scammer intercepts the email and alters a single character of the IBAN in a cryptographically signed PDF, the signature is immediately invalidated in a visible way, and the PDF reader software will display a red alert warning that the document was modified after signing.
Step 3: Limit Access and Automate with Verification AI
Just as scammers use AI to attack, businesses can use it to defend themselves. You can program local or private secure AI agents in your cloud that automatically audit incoming PDFs:
- The AI agent reads the invoice PDF, extracts the IBAN and tax ID, and automatically cross-checks it against the historical database of authorized suppliers in the ERP. If the data does not match, it blocks the payment in the ERP and sends a security alert to the administration manager.
Quick Verification Checklist for Your Administration Department
Checklist Against AI Invoice Fraud:
[ ]Has the supplier's IBAN or banking entity changed compared to last month?[ ]If there is an account change: Has the alternative telephone verification call been made?[ ]Does the sender's email match the supplier's official domain exactly (without subtle changes like a '1' instead of an 'l')?[ ]Is the PDF digitally signed with a valid certificate?
Conclusion: The End of Blind Digital Trust
The Aviva report leaves us with a clear lesson: in 2026, we cannot blindly trust what a screen or PDF document shows. Artificial Intelligence has made forgery cheap and widespread. The only effective defense for SMEs is to redesign internal administration workflows, implementing double signatures, security controls in their ERPs, and, above all, a culture of suspicion and cross-checking in their team before any unexpected changes in financial data.
💡 Do you want to audit and shield your business payment processes with AI?
Configuring defensive AI agents that automatically cross-check invoices against your ERP and securing your communications requires data integration and cybersecurity knowledge. At IA4PYMES we help you build intelligent security barriers. Book a free technical consulting session with our engineers now and we will analyze how to protect your cash flows against AI attacks and forgeries.