Microsoft finds signs of AI assistance in million-message invoice fraud campaign

Microsoft Security Research has disclosed a financial fraud campaign that sent more than one million emails over three days, combining executive impersonation, vendor branding and fabricated invoices in an attempt to divert payments.

The campaign, observed between 3 and 5 August and disclosed on 10 September 2026, targeted accounts payable personnel with requests for ACH payments of nearly US$50,000. Microsoft said 87.7 per cent of the messages went to users in the United States, making this a predominantly US campaign rather than evidence of equally distributed activity worldwide.

Microsoft found indicators consistent with AI-assisted development of the email templates. That carefully qualified assessment matters. The public evidence does not establish that generative AI created all of the content, controlled the operation autonomously or even produced most of each message.

How the invoice fraud worked

The campaign built a plausible business narrative around an apparently routine payment. Messages impersonated both company executives and ServiceNow, and included a fabricated invoice and a purported forwarded email conversation intended to make the request appear established and internally approved.

The unidentified actor used third-party email delivery accounts, infrastructure under its control and lookalike domains. These visually similar addresses supported the impersonation without requiring access to the genuine organisations’ systems.

Microsoft found no evidence that ServiceNow or the other legitimate organisations named in the messages had been compromised. The campaign should therefore not be described as a breach of those organisations, nor as an operation based on hacked mailboxes or a software vulnerability. It was a social engineering campaign using attacker-controlled infrastructure and identities designed to resemble trusted parties.

That distinction also explains why the messages could pass a superficial credibility check. A fabricated thread, recognisable vendor name and executive identity can reinforce one another, while the fraudulent domain may differ from the legitimate one by only a small spelling change.

What the AI indicators establish

Microsoft identified extensive HTML comments, structured labels and uniform construction as signs consistent with AI-assisted template development. Such features support the assessment that AI may have helped produce or organise the material, particularly at the scale recorded during the campaign.

They are not conclusive evidence of an entirely AI-generated operation. Microsoft did not identify the model or service used, disclose actor-side evidence or determine how much of the content AI generated. Conventional scripting, reusable templates and mail merge techniques can also produce uniform messages.

The most defensible conclusion is narrower: AI assistance may reduce the effort needed to produce structured templates and personalise fraud at scale. The campaign does not demonstrate that an AI system independently selected targets, managed the infrastructure and executed the financial fraud from beginning to end.

That evidentiary limit is important because the wider financial harm from business email compromise does not reveal how much AI contributes. The FBI’s 2025 Internet Crime Complaint Center report recorded US$3,046,598,558 in complaint losses attributed to business email compromise. The equivalent totals were US$2,770,151,146 in 2024 and US$2,946,830,270 in 2023.

Those complaint figures establish the scale of reported losses, but the dataset does not provide a separate category for AI-assisted business email compromise. It cannot show that AI caused the annual change or quantify losses involving generative tools.

Why authentication is only one layer

Microsoft recommends combining anti-phishing and spoof protection with email authentication and post-delivery remediation. Its documentation says SPF, DKIM and DMARC work together.

Correct configuration can block important forms of direct domain spoofing. It cannot, however, confirm that a payment request has a legitimate business purpose. Attackers can register domains they control, configure authentication for those domains and choose names that imitate a real supplier or service.

This leaves a gap between authenticating a sender’s domain and approving a financial transaction. Closing that gap requires finance procedures as well as security technology. IC3 guidance advises organisations to verify payment requests through a previously known telephone number, rather than using contact details included in the email requesting the transfer.

Accounts payable staff also need to inspect the full sender and reply-to domains, including spelling differences and mismatches between the displayed name and underlying address. Purported forwarded conversations deserve the same scrutiny as new messages because, as Microsoft’s findings show, the earlier correspondence itself may be fabricated.

Post-delivery tools can remove messages newly identified as malicious, but no single technical or procedural measure guarantees prevention. Where a payment may already have been redirected, IC3 guidance advises potential victims to preserve original records and contact their financial institution to safeguard affected accounts.

A separate incident, not proof of AI

A payment fraud disclosed by the Town of Ashfield, Massachusetts, illustrates the lookalike-domain problem but should not be merged with Microsoft’s campaign. The town’s official notice said it sent US$47,000 after follow-up messages used Solects.com instead of the legitimate Solect.com to redirect payment for a genuine invoice.

A Forbes article reported the amount as US$47,198 and presented the incident as another AI-enabled example. Ashfield’s account gives the amount as US$47,000, does not attribute the fraud to AI and does not connect it to the campaign investigated by Microsoft.

Ashfield said it discovered the fraud several months after the payment. The town said the receiving account had been drained and closed within about a week. The episode supports the case for independently confirming payment changes, but not a broader conclusion about AI.

Microsoft did not disclose the number of successful transfers or aggregate losses from its campaign, nor whether Australian organisations received any of the messages. Its findings nevertheless document how familiar invoice fraud can be produced at substantial scale. For finance and security teams, the key distinction is not whether an email sounds polished or machine-written, but whether the payment instruction survives verification through contact details and processes independent of the message.

A valid domain-authentication result does not establish that a payment instruction is genuine, because technical identity and business approval are separate judgements. Use The Hack Academy’s online cybersecurity training programme as a self-paced route into networking and cybersecurity fundamentals, with practical exercises alongside theory.