Moody's Talks: Risk Reframed · Sep 22, 2026 · 24m 12m saved
With Tom Abbey, UK and Ireland Country Manager at Trustpair
£1.2 billion was lost to fraud in the UK last year, Tom Abbey said, and in the kind he works on, where a real payment to a real supplier is diverted to a fraudster's account, he puts about 80% of the risk at the moment the supplier is set up.
Most finance teams still protect those payments by phoning the supplier or asking for a signed bank statement, and treat some loss as the price of paying on time. Abbey said AI can beat both checks in seconds, and that accepting any loss is a habit from before the tools existed to stop it.
"It's an outdated viewpoint because there is now technology out there to prevent it to a point of total mitigation."
Tom Abbey, UK and Ireland country manager at Trustpair, on Moody's Talks: Risk Reframed. Trustpair checks that a supplier's bank account belongs to that supplier before a company pays it, and Abbey said the firm counts zero fraud across its clients since they signed on.
The full interview is covered here so you can skip it. 24 minutes of audio, 12 minutes of reading.
Here are the 14 insights that matter.
Key Takeaways
Procure-to-pay fraud is a process failure, not a cyber problem, in Abbey's view
About 80% of the risk sits in supplier onboarding and in requests to change a supplier's bank details
Business email compromise is the most common route in, ahead of deepfakes and forged documents
A deepfaked CFO on a video call persuaded a finance employee who had followed company process to send out $25 million
Phoning the supplier back is a 20- to 30-year-old control that has not changed
A bank statement Abbey faked in seconds would have passed an anti-money-laundering team's checks at a large trading business
Zero loss is achievable, he said, where supermarkets still budget for theft
Treasurers cannot see whether upstream teams followed the process before they are asked to pay
He expects companies to be fined for relying on manual controls as UK regulation tightens
Fraudsters buy AI tools on the dark web that have none of the limits of ChatGPT or Claude
1. A Process Problem, Not Cyber
Alex Pillow, who hosts Risk Reframed for Moody's and whose own background is in screening, said procure-to-pay fraud had not been covered on the show before. Abbey defined it: the procure-to-pay process runs from bringing a supplier on board through to the treasury payment, and a fraudster compromises that process to divert a genuine payment owed to a genuine supplier into a fraudulent bank account.
The weakness is old manual processes, not networks
So there's probably a false view that this is kind of a cyber issue, but what it comes down to is process.
Tom Abbey
Companies run historic, manual processes that, he said, are now easy to manipulate with AI and other technology.
2. £1.2B Lost In The UK
Pillow asked how big the problem is. Abbey gave the UK figure for fraud of all kinds.
UK losses last year ran above a billion pounds
So last year 1.2 billion UK pounds obviously was lost to fraud
Tom Abbey
That was the UK alone, he confirmed, and banks prevented a further 1.6 billion. He put the share taken as "every 70p of one pound is being kind of taken from businesses." Pillow suggested the problem could be the same or worse in larger economies than the UK, with its relatively advanced rules and controls. Abbey agreed and said it is a worldwide issue, because many of Trustpair's clients are global with teams spread around the world.
Pillow raised the smaller suppliers, down to sole traders, who never receive money they have earned. Abbey said it takes "just kind of a simple lack of control" to divert the funds, which can wreck a small supplier's cash flow and potentially the business.
3. Onboarding Holds 80% Of Risk
Abbey split the process into three segments. The first is onboarding: checking bank details when a supplier is created, and handling later requests to change them.
Onboarding carries most of the risk
So if we look at onboarding and I would say this is probably where 80% of risk is.
Tom Abbey
Deepfakes, document forgery and fake assets are all in use, but he said one route is ahead of the rest.
Email takeover is the most common method
So kind of using deep fakes, document forgery, creating fake assets but probably the most common is actually BEC or business email compromisation.
Tom Abbey
He walked through the scheme as the fraudster. Take over a supplier's email address and continue an existing conversation with the customer. Once the customer is hooked, open an account in the supplier's name at an online bank with weak know-your-customer checks, then send it over on an AI-generated invoice or incorporation document. When the customer enters that account on a UK banking platform, the name check comes back as a match, because the account really does carry that name.
The name check gives a false all-clear
But fraudsters know that they can manipulate that process, get the green tick and a company will pay out to a fraudster.
Tom Abbey
Pillow asked whether there is also a version where someone poses as a supplier who does not exist. Abbey said it is the same scheme: instead of taking over a real address, a fraudster can create one with a single character out of place and impersonate the supplier from it.
4. The Deepfaked CFO
Abbey described what he called a large historic case at a large British engineering business. Someone in its shared services team received an email, apparently from the CFO, asking for a transfer of 25 million pounds for a merger. The employee refused and asked for a Teams call instead.
The call was the fraud
Jumped on a team's call and a CFO had been deep faked, voice cloned, and they were actually referencing a real merger and acquisition that was taking place and persuaded this poor person to transfer out $25 million.
Tom Abbey
Pillow noted that the employee had done what they thought was the right control. Abbey agreed.
Following the rules did not help
They followed company process.
Tom Abbey
5. Master Data Decays
The second segment is vendor master data, the stored record of each supplier. Unless a company runs a rigorous campaign to update it, Abbey said, its quality degrades: bank accounts close, companies go into liquidation, and suppliers are added to sanctions lists. Paying a sanctioned supplier brings the bank, the FBI or the UK government onto the company's case. Pillow asked whether that is more mistakes than fraud.
The problem is visibility, not error
I would say it's just lack of visibility on the data and lack of integrity on the data.
Tom Abbey
6. Cyber As A Route To Theft
The third route is cyber. The cyberattacks on Jaguar Land Rover and Harrods last year shut down much of those businesses while they worked out what had been compromised, and a fraudster inside a vendor master file could add their own bank details to many payees and start diverting funds. Pillow cited a cyber-crime journalist, a guest on the show several times, who has traced the path from cyberattack to financial crime to money laundering. Some nation states attack only to disrupt, Pillow said, but the two agreed the profit motive is more common: cyber is used to commit a fraud, and the money taken is then laundered.
Fraud gangs run like businesses
They are highly sophisticated. They use AI 99% of the times on the fly just as part of the conversation.
Tom Abbey
He described them as "multi-million pound businesses in their own right."
7. Checks Built Decades Ago
Asked where companies are most vulnerable, Abbey said the weakness Trustpair sees most is manual checks, and they come in two kinds. The first is the call-back: a person phones the supplier to confirm who they are and that the bank details are correct.
The call-back has not changed in decades
So a process that's probably been around 20 30 years but hasn't evolved.
Tom Abbey
That process has many points where a fraudster can get in, he said. The second kind is document review: asking for a bank statement signed by the chief executive, or a letter on company letterhead. Twenty years ago that was hard to fake, 10 years ago easier but still guarded by good controls, and now, Pillow added, it takes seconds.
Pillow said companies were using 20-year-old processes to defend against the problem, and Abbey finished his sentence: a "1.2 billion in the UK problem."
The host's comparison
Taking a spoon to a knife fight or a gun fight.
Alex Pillow
8. A Fake Millionaire Statement
Abbey tested an acquaintance who works in anti-money laundering and know-your-customer checks for a large trading business. He edited his own online bank statement to make himself a millionaire, changing every transaction, and asked whether it would be accepted as proof of earnings to open a VIP trading account. The answer was that the current process would accept it.
The forgery took no time
And I made that in seconds.
Tom Abbey
"Don't become fraudsters," Pillow told listeners. "You will get caught eventually."
9. Zero Fraud Is Achievable
Pillow set out the usual view in fraud prevention: a business that tolerates no fraud at all shuts off growth.
The host's framing of acceptable loss
So, you will lose more money in loss growth than you will retain in reducing your losses.
Alex Pillow
He asked whether procure-to-pay fraud has a benchmark rate. Abbey said it historically did, and compared it to high-street supermarkets that accept a certain amount of stolen stock to allow growth. In procure-to-pay he called that view outdated, and when Pillow asked whether losses could get to zero or near it, he said "100%." Trustpair, he said, holds itself to "zero fraud across our entire client base since they've been on boarded."
Pillow suggested that getting the last check right is enough, since no loss occurs if the money never leaves. Abbey said yes in short, but Trustpair checks at several points, because a supplier onboarded today may not be paid for a month, 3 months or 6 months.
Checks have to run through a supplier's life
So there needs to be multiple checks during that life cycle to make sure that they one the banking account details are up to date.
Tom Abbey
Those checks also catch a supplier added to a sanctions list since it was set up.
10. Anxious Treasurers
Pillow asked what early warning signs a treasury or anti-fraud team should watch for before losses appear. Abbey said the sign is the process itself and how little of it the payer can see.
Treasurers pay without knowing if checks were done
I speak to a lot of treasurers and I think the common kind of takeaway or the common theme is that there's a lot of anxiety around has upstream teams follow process.
Tom Abbey
Treasury has no audit trail showing the process was followed, he said. Suppliers deal with different business units, countries and teams, so the gap is visibility across all of them that checks were carried out to a watertight standard.
11. Regulation Will Bring Fines
Pillow linked the topic to earlier episodes on data interoperability, master data management and a series on perpetual know-your-customer checks, and described bank account verification as an extension of checks on sanctions, politically exposed persons, adverse media and shell companies. Abbey agreed, called it an overlooked area, and said regulation now supports the case. He cited the UK's economic crime act, which he said leans toward internal fraud but requires controls that are watertight, evidenced and technology-first.
Manual processes fail most companies
So, those manual processes that we have today that are probably seen across 80% of organizations are just not fit for purpose.
Tom Abbey
He expects penalties within a few years
And I would say over the next few years as the regulation reduces gray area becomes more watertight we'll start to see that companies start to get fined because of lack of kind of digital controls and lack of quality process.
Tom Abbey
Pillow compared regulation to the tail walker at a park run, the person at the back who brings everyone else up, while leading companies move to digital processes from the front.
12. Checks In Existing Tools
Abbey said Moody's, Trustpair and their peers work with the source-to-pay software companies already use. Trustpair built native connectors so clients need little IT work, and so that verification runs inside the tools users already have. A separate manual step invites people to skip it, he said, "because that's what humans do." In an onboarding platform, suppliers enter their details and the company sees the quality of the vendor and the safety of its bank information before it accepts them.
13. AI With No Guardrails
Pillow asked whether the controls themselves could be compromised by AI. Abbey said people assume fraudsters use commercial AI such as ChatGPT and Claude. Instead they pay for access to unregulated tools on the dark web that will create videos of public figures or anything else they are asked for.
The dark-web tools have no limits
There is no guide rails in place.
Tom Abbey
Pillow said the next threat is probably unknown and the answer is to stay vigilant. Abbey agreed.
The next threat is unknown
It's just we never know with AI it's evolving so quickly we don't know what the next thing is going to be.
Tom Abbey
14. Stop Relying On Call-Backs
Pillow asked for three things a risk, supply chain or third-party risk professional should do first, or ask their treasury team. Abbey gave one: find out how the current process works, and if there is any sign that call-backs are still the main defense, change it.
The fix cannot wait
It is an instant change management piece that needs to happen and it needs to happen now.
Tom Abbey
"Just one takeaway don't need the other two," Pillow said.
Bonus Insights
Trustpair publishes an annual fraud survey
Asked for a resource, Abbey pointed to the survey Trustpair runs every year to measure how the market has changed; the 2026 edition is out now. Pillow said listeners could reach Abbey on LinkedIn.
The two share a commute
Pillow opened by saying he and Abbey take the same train line in, and Abbey said it is not a nice train in bad weather. Moody's and Trustpair had recently been getting to know each other with a view to working together, and Pillow said solving risk takes an ecosystem of partners.
Abbey's bottom line is that procure-to-pay fraud gets in through manual checks such as call-backs and document review, which AI now defeats in seconds, and that continuous digital verification can take losses to zero before regulators start fining companies that have not adopted it.
Products, Companies & Tools Mentioned
Trustpair (Abbey's company, which verifies that a supplier's bank account belongs to that supplier; it reports zero fraud across its clients since onboarding)
Moody's (Publisher of Risk Reframed, getting to know Trustpair with a view to partnering on supplier risk)
Jaguar Land Rover and Harrods (Cyberattacks on both last year were the example of cyber as a route to payment fraud)
ChatGPT and Claude (The commercial AI tools people assume fraudsters use, set against unregulated dark-web tools)
Books & Resources Mentioned
Fraud in the Cyber Era: 2026 Fraud Trends & Insights – Trustpair (The annual fraud survey Abbey recommended)
Economic Crime and Corporate Transparency Act 2023 (The UK law Abbey said requires evidenced, technology-first controls)
Watch the full interview
If this was worth your time, send it to someone closer to the industry than you are.
Get the latest market chatter as it happens: