U.S. employees are confident they can recognize fraudulent payment requests, but many are still relying on warning signs that generative AI can easily eliminate.
A Trustmi survey of 1,000 U.S. workers involved in payment-related processes found that 78 percent believe they could identify a fraudulent request. Yet 70 percent said their top warning signs are typos, grammatical errors or unusual fonts.
That creates a significant blind spot as attackers use AI to produce polished messages that imitate executives, vendors and coworkers. Gen Z may be particularly exposed, with 82 percent relying on grammatical mistakes to identify fraud, more than any other generation.
Trust inside familiar communications is another vulnerability. Eighty-one percent of respondents said they would likely consider a payment request legitimate if it appeared in an existing email thread. Attackers who compromise a real account can hijack conversations, reference genuine projects and quietly replace payment details.
“People have been trained to spot the obvious signs of phishing, but today’s payment fraud is designed to blend into trusted business communications,” said Shai Gabay, co-founder and CEO of Trustmi.
The findings also suggest employees understand that inbox defenses cannot solve the problem alone. Seventy-nine percent said email filters are insufficient against modern workplace fraud, while 52 percent want automated fraud detection.
For businesses, the lesson is clear: security awareness training still matters, but payment requests also require automated verification, vendor-change monitoring and real-time controls before funds are transferred.
