Fraud has changed in a way that affects every employer that moves money, not only banks. Cloned voices, polished phishing emails and fabricated identities used to take skill and time. Now they take a subscription and an afternoon.
Most mid-sized companies will not buy their way out of this with software alone. The weak point is usually the team around the tools.
Where the attacks land
Three patterns show up again and again, and each one hits a different part of the business.
- Convincing email fraud. Generative AI removes the bad grammar and odd formatting that staff used to spot. A message asking accounts payable to change banking details can now match the tone of a real executive or supplier. The FBI's Internet Crime Complaint Center publishes annual figures on business email compromise, and it remains one of the costliest categories it tracks.
- Voice and video impersonation. A call that sounds like the CFO, asking for an urgent wire, defeats a process built on "I recognized the voice." Remote onboarding of staff, vendors and customers faces the same risk.
- Synthetic identities. Fake but consistent personas open accounts, build a payment history and then disappear. They are hard to catch with one-time checks.
In Canada, the Canadian Anti-Fraud Centre reports on the same trends. The pattern is the same on both sides of the border.
The tools are only half of it
Detection software that spots odd behaviour, odd timing or odd language is improving quickly. But every model still needs someone to build it, feed it clean data, test it, tune it and explain what it did. When a legitimate customer is blocked, or a fraudulent payment goes through, a person has to answer for it.
That is where many teams are thin. They bought the platform and assumed the skills came with it.
Four roles that decide whether the tools work
Fraud analysts who can work with models, not just queues. The old job was reviewing alerts one by one. The newer job is judging which alerts matter, spotting where a model is missing a pattern, and feeding that back. Look for people who have investigated real cases and are comfortable with data, not only case notes.
Data engineers and machine learning specialists. Detection depends on clean, timely data from payments, onboarding, customer service and email systems. Someone has to connect those sources and keep the pipelines running. This is a contested hiring market, so expect a longer search and a competitive offer.
Governance, risk and controls people. Regulators and auditors want to know why a decision was made. If nobody on your team can explain how a model reaches its outputs, you carry the risk. A risk or compliance hire with enough technical fluency to ask good questions is worth a lot here.
Finance and operations staff who own the process controls. Controllers and AP leads are the last line of defence. Call-back rules, dual approval on banking changes and clear escalation paths do more against impersonation than most software. These controls need a named owner.
Hiring decisions that come up
Small and mid-sized employers rarely build a full fraud function. A few practical choices:
- Start with the process owner. Before you hire a data scientist, make sure someone in finance or operations owns payment verification and vendor changes.
- Use contract talent for the build. Standing up a detection model, cleaning data or documenting controls for an audit is project work. A contract specialist for 6 to 12 months can be a better fit than a permanent hire you may not need afterwards.
- Hire for judgment. Tools change every year. People who think clearly about how fraud works adapt with them.
- Pay for scarce skills. Analysts with both investigation and data experience are in short supply. Offers set to last year's pay bands lose them.
- Train the whole team. Staff in payables, payroll, HR and customer service need to know that voices and video can be faked. A short, regular briefing costs little.
Questions to ask your own team
- Who approves a change to vendor banking details, and how is it verified?
- If a model blocks a payment, who can explain why?
- Do we have anyone who can test our detection tools for bias or gaps?
- Which of our fraud skills sit with one person who could leave?
- Are we relying on a platform vendor to supply judgment that we should have in-house?
The fifth question is often the most uncomfortable, and the most useful.
What to do next
Map the fraud-related work in your business: who owns it, who backs them up, and which skills you rent from a vendor. Then decide which gaps need a permanent hire and which need a contractor for a defined project. Do it before an incident forces the decision.
If you are hiring fraud analysts, data engineers, risk specialists or finance controllers, a Traverse recruiter can help you define the role and find people for it.