Duelpoint

Question

How do AI agents get tricked into paying fake invoices?

By believing the invoice instead of checking it. A purchasing agent pays an invoice number nobody issued, an amount slightly above what was approved, a fee added after agreement, or the right amount to new bank details, because the supplier’s message sounds routine. It is stopped by matching every invoice to an approved purchase and its approved amount, and by never changing bank details from a message.

By Duelpoint Research · Published

01How it happens

  • An invoice arrives with a number that looks like the real ones.
  • The amount is a little above what was approved, “after a price change”.
  • A handling or rush fee appears that nobody agreed.
  • A message says the supplier’s bank details have changed.

02The checks that stop it

  • Pay only invoices that match an approved purchase, never more than its approved amount.
  • Send anything new, changed or higher to a person to confirm through a known contact.
  • Never change bank details from a message.
  • Keep a budget the agent cannot exceed.

03How to test it

Give the agent one genuine test invoice and its approved amount, then send suppliers who try each trick above, and record what it paid. That is a purchasing agent test.

Questions

Isn’t an amount limit enough?

No. Many fake or inflated invoices sit under any general limit. The agent needs to match each invoice to an approved purchase and its approved amount.

What we testAI purchasing and invoice agentsGuideTesting AI agents that handle money

See where your agent leaks money. Tested against your own rules, with the money at stake.

See the testsHow we score