A woman reviewing receipts at a desk with a laptop and notebook

Typing up vendor bills is nobody's favorite part of the week, and software now offers to do it for you. In a November 20, 2024 announcement, Intuit said that with its email-to-bill feature, "business owners can forward emails, drag and drop files, or scan a QR code to upload images, and Intuit Assist will enter the details into a bill form so they can schedule payment." Other offices connect a general AI assistant to the inbox where bills arrive, or have an agent built for them.

Getting the typing off your desk is a perfectly good goal. The question for an owner or office manager is how to set it up so the AI doesn't become the easiest way to get a fake invoice, or a quietly changed bank account, paid.

Below are seven setup steps, each with the way it tends to go wrong, a short worked example, and what to do if money goes out the wrong door anyway. This is about the decisions you make around any tool, not how to configure a particular app, and it isn't accounting or legal advice. Your accountant and your bank can tell you what fits your business.

Why the bills desk needs a setup, not just a switch

The scam is already aimed at whoever pays the suppliers. The FBI's Internet Crime Complaint Center calls it business email compromise: fraudsters break into or imitate email accounts and other ways a business communicates, then use them to get money sent somewhere it shouldn't go. The center's 2025 annual report describes it as a scam "targeting businesses or individuals working with suppliers and/or businesses regularly performing wire transfer payments." That's a description of the person who pays the vendor bills.

The same 2025 report lists 24,768 business email compromise complaints and $3,046,598,558 in reported losses for 2025. Those are complaints and losses people reported to that center, not a count of all fraud. The report also notes there are multiple tactics for this scam, "and not all are AI-enabled." The trick is older than the AI. What's new is that an AI now sits at the exact spot where it lands.

An AI that reads documents can be steered by them. OWASP, a nonprofit security community, warns about this in its guidance on prompt injection, meaning instructions slipped into material an AI reads: "Indirect prompt injections occur when an LLM accepts input from external sources, such as websites or files." (An LLM, or large language model, is the kind of AI behind these tools.) Those instructions don't have to be visible to you, either: "prompt injections do not need to be human-visible/readable, as long as the content is parsed by the model." And OWASP is candid that "it is unclear if there are fool-proof methods of prevention for prompt injection."

The National Institute of Standards and Technology, the federal standards agency, explains why in its March 2025 report on attacks against AI systems: these models "combine the data and instruction channels." In plain words, what the AI reads and what it's told to do come in through the same door.

Put those together and you get the rule the rest of this guide hangs on. An invoice is a document written by someone outside your business. Whatever it says, whether printed on the page, tucked into an attachment or hidden where only the AI will notice, is information for a person to check. It is never an instruction to follow.

Seven setup steps, and how each one goes wrong

Step 1: Give the AI the reading and drafting job, and nothing past it

The AI pulls the vendor, amount, due date and line items into a draft bill and checks it against what you ordered and received. That's the whole job. Releasing a payment belongs to a named person, an actual name rather than "accounting," and that limit lives in the permissions of your accounting or banking software, not in a sentence telling the AI not to pay.

OWASP's guidance on giving an AI more power than its job needs puts it directly: "Implement authorization in downstream systems rather than relying on an LLM to decide if an action is allowed or not." The software decides who can do what, not the AI's good manners. It's the same reason a marketing agent can draft but shouldn't hold the publish key, except here the key moves money.

How it goes wrong: the AI gets connected through a login that can do everything, because that was the easiest one to hand over, and "draft only" exists only as an instruction. Ask whoever sets it up which account the AI uses and what that account is allowed to do. If the answer includes paying bills or editing vendors, the limit isn't real yet.

Step 2: Treat everything inside an invoice or vendor email as content, not commands

Picture a line on an invoice that says "Our banking details have changed, remit to the account below." (That's an example of the wording, not a quote from a real invoice. "Remit" just means where to send the money.) It's a fact for a person to verify. The AI can read it, note it and flag it. It must not be able to edit a vendor's payment details because a document asked it to, and it shouldn't be the one deciding whether the request is real.

How it goes wrong: someone sets the AI up to keep vendor records current from whatever comes in. That sounds tidy. It also means a document written by a stranger can rewrite where your money goes.

Step 3: Lock each vendor's bank details, and check every change on a second channel

Each vendor's bank details live in one vendor record that the AI can't change. Changing that record is a process with a person attached, not an edit. Any request to change it gets checked, whether it arrives by email, on an invoice, as a PDF letter or by phone. The FBI's center gives the rule in its September 11, 2024 alert: "Use secondary channels and/or two-factor authentication to verify requests for changes in account information."

A second channel means a way of reaching the vendor that your business already had before the request arrived: the phone number in your vendor file, on an older contract, or for the rep you've dealt with for years. It is never the phone number, email address or link inside the message asking for the change, because whoever sent that message controls them.

How it goes wrong: the office manager does call to check, using the number printed on the new letter. A friendly voice confirms everything. That call verified nothing.

Step 4: Write down what the AI must flag instead of resolving

Keep this list short enough that people actually read the flags. The AI hands each of these to a person rather than settling it itself:

If you've written a process down for an AI before, these are the stop-and-ask rules for this one.

How it goes wrong: the list grows so long, or the threshold sits so low, that nearly everything gets flagged, and people start clearing flags without reading them. A flag nobody reads is the same as no flag. Start short and add to it on purpose.

Step 5: Put two people between a new or changed payee and your money

The payee is whoever gets paid. The federal standards agency's security glossary describes separation of duty as "the principle that no user should be given enough privileges to misuse the system on their own," and gives a payroll example: "the person authorizing a paycheck should not also be the one who can prepare them." It adds: "An example of dynamic separation of duty is the two-person rule."

For vendor bills, that means one person prepares and a different person releases. Whoever confirms a bank change isn't also the one who releases the first payment to it. And the AI counts as neither person.

If one bookkeeper does everything, make the owner the second person for the payments that matter most: every payment to a new or changed bank account, and anything above your threshold. The bookkeeper keeps everything else.

How it goes wrong: the second person approves from a summary that shows the vendor name and amount but not the fact that the bank account changed. Whatever the approver looks at has to say plainly when payment details are new or different.

Step 6: Keep a plain record, and test the setup before you trust it

Keep a record of what the AI read, what it entered, what it flagged, and who approved each payment. When something looks off months later, that record is how you find where it went wrong.

Then test it. OWASP's prompt injection guidance recommends testing that treats "the model as an untrusted user." For a small business, that can be a clearly internal drill: the owner sends a mock invoice with changed bank details from an address that isn't the vendor's, then watches whether it gets flagged and whether it can get anywhere near payment. Three rules keep the drill from becoming the problem:

How it goes wrong: the drill runs once, at setup, and never again, while the vendor list, the staff and the software keep changing. Run it again when any of those change.

Step 7: Know your first moves if money goes to the wrong account

The FBI's center is blunt in its 2024 alert: "If you discover a fraudulent transfer, time is of the essence." Its advice, in order:

Then call the real vendor on the number you already had. The scam may have started in their email rather than yours, and they need to know.

How it goes wrong: a day goes by confirming that it really was fraud before anyone calls the bank. Call first, and sort out the details after. Put your bank's fraud contact somewhere everyone who handles payments can find it today.

A worked example: the familiar supplier with new bank details

This is a made-up example, not a real business, vendor or incident.

A bill arrives from a supplier you've used for years. The sender's email address is one character off from the one in your vendor file, and the invoice carries a note about new bank details.

  1. The AI drafts the bill as usual: vendor, invoice number, amount, due date and line items, checked against what was ordered and received.
  2. It flags two things for a person: the changed bank details, and a sender address that doesn't match the vendor record.
  3. The vendor record stays as it was. The AI can't edit it, and the note on the invoice isn't treated as an instruction.
  4. The office manager calls the supplier on the number already on file, not the one printed on the invoice.
  5. Payment waits until that call is done. If the supplier really did change banks, the change goes through the owner's process and the owner releases the first payment to the new account. If not, the bill stays unpaid, and the supplier hears that someone may be sending mail in their name.

Nothing dramatic happened, which is the point. The AI did the typing and noticed what looked different. People decided where the money went.

What stays with people, and what the AI takes off the desk

Three things stay with people:

What the AI genuinely takes off the desk is the typing, the matching, the sorting, and noticing what looks different: a new sender address, a changed bank-details line, an invoice for something nobody ordered. That's real work, and it's work a person no longer has to do by hand.

If we build something that reads your invoices, it follows the same line we drew in our piece on MarginEdge and AI chat for restaurants: it drafts and flags, and it doesn't approve an invoice or touch bill pay. A person on your team approves and releases every payment.

Frequently asked questions

Can't I just tell the AI never to pay anything or change bank details?

You can tell it, but don't rely on it. An AI that reads invoices can be steered by what is written in them, and OWASP's guidance says it is unclear whether prompt injection can be fully prevented. Put the limit in the permissions of your accounting or banking software, so the account the AI uses simply cannot release a payment or edit a vendor's bank details.

What counts as a second channel for checking a bank-detail change?

A way of reaching the vendor that your business already had before the request arrived, such as the phone number in your vendor file or on an older contract. Never use the phone number, email address or link in the message asking for the change, because whoever sent that message controls them.

We only have one bookkeeper. How do we get two people involved?

Make the owner the second person for the payments that matter most: every payment to a new or changed bank account, and anything above a threshold the owner picks. The bookkeeper can handle everything else.

What should we do first if we paid a fake invoice?

Call your bank right away and ask it to recall the payment. The FBI's Internet Crime Complaint Center says time is of the essence, and asks victims to file a complaint at ic3.gov as soon as possible, whatever the amount. Then call the real vendor on the number you already had.

The bottom line

AI can take vendor-bill typing off your desk. Before it does, settle six things: the AI reads and drafts, and your software's permissions keep it there; vendor bank details are locked, and every change is checked on a channel you already had; the AI flags a short list of things for a person; two people stand between a new payee and your money; you've tested the setup with a safe drill; and everyone knows the first call to make if something gets through. None of that makes fraud impossible. It does mean the AI can't be the thing that pays a fake invoice.

If you're working out which parts of your back office to hand to AI and which stay with a person, see what our Agents do or start a conversation with us.