That urgent payment change email might be a scam. Vendor and CEO fraud emails cost real money, and a two minute AI check catches most of the obvious ones before you act.
| 2024 BEC losses | About 2.8 billion dollars reported to FBI IC3 |
|---|---|
| Cumulative BEC losses | About 55.5 billion dollars exposed, Oct 2013 to Dec 2023, per FBI IC3 |
| 2024 job scam losses | 501 million dollars reported to FTC, up from 90 million in 2020 |
| Top phishing red flag | Urgency and pressure to bypass normal checks, per CISA guidance |
1. Build your one standing prompt
Write a prompt that tells AI to flag fraud patterns, not just give a yes or no. Save it in your notes app so it is ready the moment something feels off. Example: ‘Read this email and flag anything that looks like fraud. Check for urgency language, requests to change payment or bank details, a sender address that does not match the display name, a generic greeting paired with a very specific ask, pressure to skip the usual approval step, or an unexpected link or attachment. List what you find.’
2. Paste in the whole email when something feels off
Copy the full text, including the sender’s display name and email address if you can see it. The more context AI has, the more patterns it can check against.
3. Read the flags, not a verdict
AI lists what looks unusual, it does not make the final call. Treat the output as a second pair of eyes, not a judge.
4. Verify off the email itself
If anything is flagged, call the person or vendor on a phone number you already had before this email arrived. Never use a number or link from the message itself.
5. Keep a short list of confirmed scams
When you confirm something was fraud, save the exact phrase that gave it away and add it to your prompt. Your checklist gets sharper every time you use it.
A worked example
A colleague in finance gets an email that looks like it is from the company’s CFO, asking her to update a vendor’s bank details before an outgoing payment goes out today.
Before
Hi, I need this handled quietly and fast. Please update ABC Supplies’ bank account to the new details attached before you release today’s payment. I’m in back to back meetings so just confirm once it’s done. Thanks.
After
Flags found: 1) Urgency and pressure to act fast without the usual checks. 2) Request to change bank or payment details for an existing vendor. 3) Instruction to handle it ‘quietly’, which discourages verification. 4) Sender avoids a call or meeting, asking only for a written confirmation. 5) No invoice number or amount referenced despite claiming urgency. Recommend verifying directly with the CFO using a known phone number before making any change.
Three ways to bend it
For job seekers checking offer emails
Run any offer or interview email through the same prompt before you respond, especially ones asking for a joining fee, personal banking details, or payment before you have even started, a common pattern in fake recruiter scams.
For WhatsApp or SMS messages
Paste the text of any suspicious WhatsApp or SMS message asking for money, OTPs, or account details. The same red flags apply to fake job offers and loan approvals landing on your phone.
For procurement or ops teams
Use it as a standing second check before approving any vendor payment change, alongside your normal approval chain, not instead of it.
When it goes wrong
AI says it looks fine but I’m still not sure
Trust the discomfort. AI catches known patterns, not your gut feeling. If something still feels wrong, verify anyway.
I only have a screenshot, not the original email
Paste in whatever text you can read, and separately check the sender’s actual email address and domain by hand. Screenshots can hide the real sender.
When not to use this
This is a personal habit, not a security system. If money is already moving or you suspect an active breach, stop and call your bank or your company’s security team immediately, do not wait on an AI check. It also does not replace your organization’s actual email security tools, it is just a second pair of eyes for the messages that land in your own inbox.
What you can now do
You can now run a sixty second check on any email that feels off, before you click, reply, or approve a payment, instead of guessing and hoping.
Part of Making Life Easier With AI, a weekly walk-through of one small thing AI can take off your plate.
Take this further
Act as a blunt hiring manager who has read ten thousand resumes, not a career coach. I will paste my full resume and the job description I want. Rewrite the whole resume for that role, section by section, in this order: summary, experience, skills, education. Rules: every experience line leads with impact, not duty. Use bracketed placeholders like [8 percent] for any number I did not give you, and list at the end every placeholder I need to replace with a real figure. Keep it to one page of text. Plain formatting only, no tables or columns, so screening software can parse it. After the rewrite, tell me the three weakest claims that need evidence before I send this anywhere. My resume: [paste resume]. The role: [paste job description].
Takeaways
- Write your standing fraud-check prompt now and save it in your notes app before you need it.
- When a payment or bank-detail request email arrives, paste the full text including sender address into AI before acting.
- Call the vendor or colleague on a phone number you already had on file, never one from the email itself.
- Log the exact phrase that exposed a past scam and add it to your prompt so the checklist improves over time.
- Treat any AI flag on a job offer asking for upfront payment or banking details as a reason to stop and verify separately.
Questions people actually ask
Can AI actually tell me if an email is a scam?
Not with certainty. AI is good at spotting known fraud patterns like urgency language, mismatched sender addresses, or pressure to skip approval steps, but it cannot confirm intent. Treat its output as a flagged list to investigate, not a verdict. Always verify anything flagged directly with the sender using contact details you already had, not ones from the email.
What are the biggest red flags in a CEO fraud or vendor payment email?
Common flags include urgent language, requests to change bank or payment details, instructions to keep the request quiet, a sender pushing for written confirmation instead of a call, and vague details like no invoice number despite claimed urgency. These match patterns tracked by CISA and the FBI in business email compromise cases.
How much money do businesses actually lose to email scams like this?
The FBI’s IC3 recorded close to 2.8 billion dollars in reported business email compromise losses in 2024 alone, and nearly 55.5 billion dollars in cumulative exposed losses between October 2013 and December 2023. It remains one of the costliest categories of reported internet crime.
If I only have a screenshot of a suspicious email, can I still check it?
Yes. Paste whatever text you can read into your AI prompt, but also check the sender’s actual email address and domain by hand, since screenshots can hide or crop the real sender line. This manual check matters because display names are easy to fake.
Should I use this instead of my company’s security tools?
No. This is a personal second check for messages already in your inbox, not a replacement for your organization’s email security systems. If money is already moving or you suspect an active breach, stop and contact your bank or security team immediately instead of running an AI check first.
Sources
- Business Email Compromise: The $55 Billion ScamFBI Internet Crime Complaint Center (IC3)
- Avoiding Social Engineering and Phishing AttacksCISA
- Job ScamsFederal Trade Commission
- New FTC Data Show a Big Jump in Reported Losses to Fraud to $12.5 Billion in 2024Federal Trade Commission
What happens next
Expect fraud emails to keep getting harder to spot as generative AI helps scammers write cleaner, more personalized messages with fewer typos and better-matched tone. Watch for a rise in voice and video deepfakes layered on top of these email scams to defeat phone verification itself, which is why confirming through a previously known, separate channel will matter even more. Regulators like the FTC and FBI are likely to keep publishing updated red flag guidance as task and gamified job scams evolve.
