13 July 2026

Fake emails and invoices made with AI: CEO fraud in 2026

Until recently, a scam email gave itself away: spelling mistakes, odd phrasing, a "Dear Customer" that was too generic. That filter no longer works. With AI, anyone can write a flawless email in Catalan, Spanish or English, in the exact tone of a real supplier, in thirty seconds. The good news is that the fraud still has recognisable patterns — you just have to know where to look.

CEO fraud, 2026 edition

The setup is always a variant of the same scheme: somebody passes themselves off as a senior manager, a regular supplier or an accountant, and asks for an urgent payment or a change of bank details. It used to take a certain skill to write that convincingly. Now an AI tool generates the email, imitates the writing style of whoever is being impersonated and, if needed, answers follow-up questions naturally. Language has stopped being the alarm signal.

What to look at now, since the text proves nothing

The sender address, letter by letter. It is not enough to look at the display name ("John Smith, Smith & Co"): you have to open or hover over the real address. The best-made frauds use domains almost identical to the original — one letter changed, a hyphen added, a different extension. On a phone screen, those changes are invisible at a glance.

Any change of bank details. No serious supplier changes their account number by email without prior notice. If an invoice arrives with a different IBAN from the usual one — even when the rest of the document is identical to every other month — that is the single most reliable sign that something is wrong.

Hurry and secrecy. "I need this closed today" or "don't mention it to anyone else in the office" are classic social engineering, and AI has not changed them: it has only made them sound more natural. Any message combining urgency with a request for discretion deserves a pause, not an action.

The rule worth more than any detector

Faced with a suspicious invoice or payment instruction, one rule always works: verify by calling the number you have always had, not the one in the email or in the signature block. If the "regular supplier" asks for an urgent payment, you call the contact that has been saved for years and confirm it out loud.

That thirty-second call is, today, the most effective defence that exists against AI-assisted fraud — more than any antivirus or mail filter.

An illustrative example

Imagine an accountancy firm in Sabadell receiving an email, apparently from a regular client, asking to change the bank account used for quarterly direct debits. The text is perfect, the logo correct, and it even refers to a real meeting they had weeks earlier. An administrator, following the internal protocol, calls the client on the number they have always had — not the one in the email. The client sent no such message. The destination account is fraudulent.

Thirty seconds of phone call prevents a direct transfer into a scammer's account. The scenario is fictional, but it reflects the real pattern of CEO fraud that police forces keep warning about.

What a small organisation can actually do

No expensive or complex tool is needed. A simple protocol, known to everyone, is enough:

• No change of bank details and no urgent payment is processed on the strength of an email alone. Ever. Without exception for seniority — the whole point of CEO fraud is that it borrows authority.
• Verification by voice, on a previously known number. Written down, so it is a rule and not a habit.
• A second pair of eyes above a threshold amount. Deciding the threshold is a five-minute conversation.
• Permission to pause. Whoever makes payments must know, explicitly, that nobody will blame them for delaying a transfer by an hour to check it. Most of these frauds succeed because somebody was afraid to look slow.

That last one is the measure people forget, and it is the only one that is purely cultural. If the organisation punishes caution, no protocol survives contact with a Friday afternoon.

If a payment has already gone out, the clock matters more than anything else — the sequence is in the piece on the first 24 hours.

This article is general information, not legal or security advice for a specific case.