You Sound Exactly Like the Scam: How AI Impersonation Became a B2B Revenue Problem

Your company changes banks. Billing sends a short, polite note to four hundred customers with the new account details and a copy of the updated W-9.

Within a day, a large share of those customers have flagged the message as suspected fraud. Two have called your CEO's mobile to confirm it was really you. Accounts payable at your biggest account has frozen an invoice that was already approved, and nobody there will unfreeze it until a named human at your company calls them back on a number they looked up themselves.

Nothing went wrong. Everything worked exactly as your customers designed it. The message was legitimate, the process was routine, and it still tripped every control the finance world installed over the past two years.

For Revenue Leaders, RevOps, Finance, and Customer Success Teams.

Most B2B companies still file AI impersonation under security, somewhere between phishing training and the annual penetration test. It belongs in the revenue conversation instead, because the defenses buyers built against synthetic voices and forged invoices now sit directly on top of the things sellers do every day. Cold outreach. Contract signing. Vendor onboarding. Collections. Renewal calls with a new CSM the customer has never met. Fraud got cheap, so trust got expensive, and somebody in your pipeline is paying for the difference.

The losses stopped being anecdotes

The FBI's Internet Crime Complaint Center published its 2025 report in April 2026, and the totals broke records. More than a million complaints. Losses of $20.9 billion, up 26 percent in a single year. Business email compromise ranked second by total dollars lost, at $3.04 billion across roughly 24,800 complaints, up from $2.77 billion the year before. Of those BEC losses, 86 percent moved by wire transfer or ACH, which is another way of saying the money was gone before anybody noticed it had left.

The more interesting line in that report is a new one. For the first time, the FBI tracked "AI-related" as its own crime descriptor: more than 22,000 complaints and close to $900 million in losses in a single year, with over $30 million of that specifically tied to AI-assisted business email compromise. Phishing losses tripled in the same period, from $70 million to $215.8 million, even though complaint volume was flat. Fewer attempts, far more money. The attacks got better, not more numerous.

Deloitte's Center for Financial Services put a forward number on the same trend, estimating that generative AI could push US fraud losses to $40 billion by 2027, up from $12.3 billion in 2023. That works out to roughly 32 percent annual growth in a category that used to be a rounding error on most operating plans.

The exposure is close to universal. The Association for Financial Professionals found in its 2026 Payments Fraud and Control Survey that 76 percent of organizations faced attempted or actual payments fraud in 2025, with about 74 percent hit specifically by business email compromise. A Gartner survey of 302 respondents found 62 percent had dealt with a deepfake incident. In a Medius study of finance professionals across the US and UK, 53 percent said they had been targeted by deepfake scam attempts and 43 percent admitted they had fallen for one. The same study found 87 percent would make a payment if their CFO or CEO called and asked them to.

Then there is the case everyone in finance now cites from memory: an employee at the engineering firm Arup transferred roughly $25.6 million after a video call in which every other participant, including the CFO, was synthetic.

Any single one of those numbers is a security slide. Together they describe something closer to a change in operating conditions. When three quarters of companies get hit with an attempt in a year, the finance organizations you sell to stop treating verification as an exception workflow and start treating it as the default path for anything involving money or identity. That default is what your revenue team now has to move through.

The impersonation is aimed at your customers, in your name

Most of this fraud does not target you. It targets your customers, and it wears your logo to do it.

The economics of vendor impersonation are better than executive impersonation, and attackers noticed. A fake CEO asking for an urgent wire is a cold approach that has to overcome suspicion in one shot. A compromised or spoofed supplier thread does not. It arrives inside an existing relationship, on the expected invoice cycle, with the right amounts and the right names, from a domain that differs from yours by one character. AFP's 2025 data already showed vendor imposter fraud hitting 45 percent of organizations, closing on classic executive impersonation at 49 percent, and vendor impersonation is the side of that pair still growing.

Generative tools removed the last constraint on volume. A convincing brand impersonation site that took a skilled attacker most of a working day to build now takes minutes, which is why Check Point's Q2 2026 brand phishing report still has Microsoft at the top of the impersonation list, at roughly 23 percent of all attempts, nearly double the next brand. Being widely used is now a liability. If a hundred thousand businesses receive invoices from you, you are a template worth cloning.

The commercial damage does not stay with the fraudster. When a customer's AP team pays $180,000 into an account they believed was yours, three things happen that show up on your P&L. Your invoice is still outstanding, and you are now the vendor asking a furious customer to pay twice. Your name is attached to the incident in their internal write-up, which will be read by their CFO during your next renewal. And every future communication from your billing address gets an extra approval step forever.

That is a retention problem wearing a security costume.

Your outreach now looks exactly like the attack

The second cost lands at the top of the funnel, and it is subtler.

Think about what a legitimate first-touch sales sequence looks like from the receiving end in 2026. An unfamiliar sender. A personalized opening that proves the sender researched the recipient. A link to a document. A follow-up call from an unknown number, sometimes placed by an AI voice agent that sounds human enough that the buyer cannot tell. Occasionally some polite urgency about a quarter-end incentive.

Now describe a social engineering attempt. The list is identical.

Buyers have gotten no better at telling the two apart. Twilio's research found that 90 percent of consumers failed to correctly identify AI-generated voice clips, while 72 percent were confident they could. That gap is the whole problem. People who cannot detect synthetic media but believe they can will make fast, wrong calls in both directions, trusting a cloned voice and rejecting a real rep.

Gartner predicted that by 2026, attacks on face biometrics would leave 30 percent of enterprises unwilling to treat identity verification and authentication as reliable on its own. The consequence for sellers is that no single channel proves you are real anymore. Not your email domain, not your voice, not your face on a video call, not a LinkedIn profile that has been alive for six years. Each one can be manufactured, and your buyer knows it.

So they default to the cheapest safe behavior: ignore it. The unread cold email and the unreturned call are not always a targeting failure or a bad subject line. Some meaningful share of your non-response rate is now a fraud filter doing its job.

The practical response is to stop relying on charm and start supplying proof the buyer can check without talking to you. Send the first touch from a domain that matches the company name on your website, not a lookalike built for deliverability. Skip the shortened links and the tracking redirects in a first email, since those are the exact artifacts a security tool flags. Reference something verifiable, like a public post or a mutual connection the recipient can confirm. Send calendar invites from your corporate domain with a real meeting link rather than a one-off URL. A prospect who can confirm you are real in under a minute converts better than one you have to charm into taking the risk. None of this is clever. It is the difference between looking like a vendor and looking like a lure.

Verification became a step in your sales cycle

Every control a buyer adds to stop fraud has a cost, and part of that cost gets paid by the vendor trying to sell to them.

Supplier onboarding is where it shows up first. Manual vendor onboarding commonly runs two to four weeks. Teams that have automated the identity checks get it down to a week or so for standard suppliers, and a few days for low-risk ones. The variable is verification: business registration checks, tax ID validation, bank account ownership confirmation, sanctions screening, callbacks to a number the buyer sourced independently. For a small or newer vendor with a thin public footprint, every one of those steps is slower.

Nobody in sales counts those weeks. They are invisible in the CRM, because the opportunity is already marked closed won. They are extremely visible in cash. A deal that signs on March 28 and clears vendor setup on April 22 is a Q1 booking and a Q2 collection, and the gap between those two dates is pure verification friction.

The same tax applies mid-relationship. Any change to your banking details, your billing entity, your legal name after an acquisition, or your primary contact now triggers a hold and a callback at most of your customers. If your quote-to-cash process assumes a customer will act on a written instruction from a new sender, that process is broken and your DSO already knows it.

Customer success absorbs a version of this too. Assign a new CSM to an account and the first outreach comes from a name the customer has never seen, asking for a meeting and often for system access. That is a reasonable thing to be suspicious of. Teams that warm-introduce the new CSM from the old one's address, on a thread the customer already recognizes, get meetings booked. Teams that fire off a fresh introduction email from an unknown person get silence and then complain about engagement rates.

Make yourself the easy vendor to verify

The vendors handling this well treat verification as part of the customer experience rather than an IT policy, and their habits are worth stealing.

Publish a verification page and point to it constantly. One stable URL on your primary domain listing your legal entity name, your registered address, your exact banking details, the domains you send email from, the phone numbers your team calls from, and a named contact for confirming anything financial. Reference it in every invoice, every contract, and the footer of every billing email. When a customer's AP team wants to check, you want them landing on your page instead of Googling their way into a cloned one.

Set one banking policy and never deviate. The strongest version is a public commitment that your payment details will never change by email, plus a documented process for the rare occasion when they do change, involving a call the customer initiates to a number they already have. Say it in the contract. Say it at onboarding. Say it again at renewal. Repetition is what makes it a control instead of a claim.

Verify in the other direction too, and let the customer see you doing it. When an existing customer emails asking for a refund to a new account or a change to their billing contact, call them back on the number in your system before acting. Customers notice. It reframes the friction as competence rather than bureaucracy.

Fix the plumbing that lets someone impersonate you. Email authentication on every sending domain, active monitoring for lookalike registrations, and a defensive registration budget for the obvious character-swap variants of your name. Most impersonation campaigns move from domain registration to live distribution inside a day, so monitoring only helps if somebody is actually watching the alerts.

Disclose your AI agents before the buyer wonders. If an AI voice agent qualifies your inbound calls or an assistant drafts your outreach, say so in the first few seconds. Deception about whether a human is on the line is now the fastest way to get your entire domain and phone range blocked, and it costs you nothing to be straightforward about it.

Then handle the mirror image of the problem inside your own hiring. Gartner projects that by 2028, one in four candidate profiles worldwide could be fake, and a 2025 Gartner survey of 3,000 candidates found 6 percent admitted to some form of interview fraud, either posing as someone else or having someone pose as them. A remote sales org hiring quickly is a soft target for exactly that, and the cost of a fraudulent hire sitting inside your CRM is not a security line item.

The vendors who are easy to verify will win the close ones

B2B has always run on trust, and for thirty years buyers inferred it from signals that were expensive to fake. A real office. A conference booth. A voice you recognized on the phone. A reference customer who picked up when you called. Those signals are cheap to manufacture now, and buyers have priced that in.

What replaces them is not a better story about how trustworthy you are. It is infrastructure: a published verification path, a payment policy that never bends, authenticated domains, and named humans a nervous AP clerk can reach in under ten minutes. None of it is glamorous, and none of it will appear in a marketing campaign.

It will show up in the numbers, though, in the accounts that cleared vendor setup in four days instead of four weeks, in the invoices that did not sit in a fraud queue, and in the renewal conversation that never had to start with an apology for something you did not do.

Pick one thing this quarter. Build the verification page, put the URL on every invoice, and tell your customers it exists. That single page will do more for your collections cycle than another round of email sequence testing.