Real-time payments bring new value, and new threats too. With November marking the annual International Fraud Awareness Week, B2B payments professionals are optimizing speed and value, while outthinking a new breed of AI-equipped fraudsters.
As enterprises push for instant settlement and streamlined financial workflows, the very advantages driving payments innovation are opening new fraud vectors. Ironically, every real-time transaction, from single supplier payments to mass payouts, represents not only an operational leap forward but also a widened attack surface.
That’s according to Bottomline’s Eric Choltus, who sees fraudsters exploiting technology often faster than legitimate operators, who report to boards and regulators. This is creating a gap in the effective use of AI. It’s an industry priority to prevent that.
“Advanced social engineering schemes, invoice scams, and insider manipulations are now augmented by AI and deepfakes, making today’s business email compromise (BEC), account takeover (ATO), and authorized push payment fraud (APP) attempts almost unrecognizable from the threats of just five years ago,” he said.
That’s why finance teams have to keep up with fraud trends and treat them with the same urgency as they do regulatory deadlines and revenue targets.
Myth-Busting Instant Payments Equals Instant Risk
B2B payments are leaning into instant, but not quite as fast as some expected. There are many reasons for that, including operational, cultural, and economic hurdles. In terms of fraud typologies, Choltus said, “the risks are higher with real-time payments. It's more difficult, if not impossible, to claw money back once it’s sent out,” adding that real-time payments can happen 24/7/365, making security that much more crucial.
As instant rails like RTP® from The Clearing House and the Federal Reserve’s FedNow® Service grow in usage and transfer size, fraudsters are capitalizing on the lift, making it harder to catch and reverse instant fraud. Both real-time rails acknowledge the threat if fraud prevention measures are not put in place further up in the payments process. Similar concerns are being echoed in the U.K. and across Europe, where systems like Faster Payments and SEPA Instant Credit Transfer are also grappling with the balance between speed and security.
In June 2025, the U.S. Federal Reserve, OCC, and FDIC issued a joint Request for Information seeking input on how to combat fraud across payment systems, including FedNow® and RTP®. Yet FedNow® increased its transaction limit to $10 million in 2025, citing higher commercial usage. RTP® also has a $10 million limit, as use cases for instant B2B payments scale. In parallel, the U.K. has raised its Faster Payments limit to £1 million, while the EU continues to push for broader adoption of SEPA Instant, with regulators emphasizing mandatory fraud reimbursement and stronger authentication protocols.
Choltus said this transition to ever-faster payments pushes banks and corporates to think about fraud detection in new ways. “You can’t look at the payment alone anymore,” he said. “You have to scrutinize every step that led up to it. Who logged in and at what time, whether or not that user was acting as expected [behavioral biometrics], and key actions that may have happened prior, like a change to a beneficiary account number, and other key details.” In other words, tracking user behavior and payment flows in real-time is no longer optional; it’s foundational to any payment fraud defense strategy.
Similarly, functions like “Request for Payment” in the U.S., the U.K., and Europe are a double-edged sword. They add convenience but create more fresh attack surfaces, from phishing to deepfakes and business email compromise. That necessitates technology to flag the unusual and to interdict suspicious payments in real-time before they’re completed.
Vendor Validation, Good vs Evil AI, and the Insider Threat
For B2B payments, vendor and invoice fraud are a perennial headache, now multiplied by the rise of AI-powered forgeries. Choltus explained that “fraudsters can impersonate legitimate vendors/payees, change banking details, create fake invoices, and request a payment, for example, using request for payment capability.”
To combat this, he advocates event-driven risk controls.
“If all of a sudden, the account number of a vendor or a payee is changed, that's an important event,” Choltus said. “But it has to be correlated with other events since it’s a common occurrence in B2B payments. If that account number was changed, and there was a suspicious login, and abnormal user activity, and the transaction value is not what we typically see for this kind of payment, those are just some of the signals you can bring together to weigh the holistic risk of a payment.”
There’s also significant risk reduction in using closed vendor networks and automated payables provided by payment service providers (PSPs), including Bottomline. “Typically, a closed vendor network is very carefully managed and everyone’s validated,” he said.
It’s not about restricting the flow, but rather building trust and embedding robust checks.
AI also cuts both ways. “AI is amazing. It's improving at lightning speed,” he said, while noting again that criminals move just as quickly, and with fewer constraints.
“Fraudsters have no regulatory environment, so they can leverage the technology faster than [banks] can,” he said. For payment pros, the challenge is to layer AI into processes without losing control or transparency.
“Banks have to be very careful in the way they’re leveraging this. There must be 100% clarity on the model and why it flagged something as suspicious. The best approach, Choltus said, is for AI to support human decision-making, not replace it.
Insiders remain an insidious risk, whether out of malice or mistake. Choltus categorized the danger: “That employee can be tricked, or the employee can be part of the scheme.”
He recommended behavioral analytics and holistic monitoring across payment flows and staff actions, blending fraud prevention and insider threat programs.
Consortium Intelligence and Building Resilience
Perhaps the most promising trend in fraud defense is how competitors are becoming co-defenders. “Banks and fintechs are very competitive, but when it comes to fraud, we're all working together. It just makes the network safer,” Choltus said. Information sharing isn’t just a philosophy; it’s a powerful solution. By pooling intelligence, payment institutions can track threats across the ecosystem, not just in their own backyard.
Choltus described leveraging data from trillions of transactions to generate actionable risk indicators at the network level and feeding these back to consortium members: “We can look at trillions of transactions, calculate risk indicators, and bring that to bear in a consortium intelligence service.”
This kind of shared vigilance and constant feedback loop allows banks and corporates to keep up as fraud tactics shift. As digital payments grow, collaboration gets baked into the next era of resilience. “Proactive resilience is not optional; it’s the new baseline,” he said.
B2B payments operate on the front lines of fraud, where speed and risk go hand in hand. To win, Choltus said organizations need real-time, event-driven defenses, smart automation, behavioral monitoring, explainable AI, and (perhaps most of all) a willingness to share intelligence across the ecosystem. “The best defense isn’t just strong technology,” he said, “but stronger teamwork and relentless vigilance.