The ongoing challenge of payments fraud.

Healthcare conducts a high volume of financial transactions with many points of vulnerability. That makes the industry a prime target for payments fraud. Constant vigilance regarding this multidimensional problem is essential.

To help financial leaders maintain readiness, CommerceHealthcare^® presents this brief overview of payments fraud. The analysis surveys the current landscape, key fraud types and effective defense tools. The impact of rapidly emerging AI is also discussed.
 

Payments fraud: today’s state of play.

Payments fraud can be defined as “a range of deceptive tactics designed to obtain funds or sensitive financial information illegally from either businesses or individuals during payment transactions.”^{footnote [1]} In healthcare, patient, vendor and insurance payments can all be involved. The scope of the challenge can be seen in a few highlights.
 

How prevalent is payments fraud?

One in five consumers has experienced financial fraud through credit cards or other channels.^{footnote [2]} Half lost at least $500 and one in four lost $1,800 or more.

Payments fraud continues to be a significant concern for businesses, with 76% reporting attempted or actual payments fraud in 2025.^{footnote [3]} In a recent survey, nearly six in ten firms in payment-heavy industries faced more fraud attempts than they did a year ago.^{footnote [4]} Incoming customer payments are a notably high risk.

E-Commerce fraud is expected to more than double between 2025 and 2030, reaching $131 billion.^{footnote [5]}
 

What are the chief payment methods targeted?

Attempted and actual fraud occurs across all of the leading payment rails (Figure 1).^{footnote [6]}

Figure 1
View the text-friendly version of Figure 1 opens in a new window ^{footnote [PDF]}

The prevalence of check fraud may be surprising, given that check use has been declining for many years. Nevertheless, checks remain prevalent, particularly in healthcare. A study showed that 68% of payers reimburse providers by paper checks.^{footnote [7]} That represents an increase from 60% in 2023. Over half of providers send refund checks to patients. Debit card payments are another prime target. According to one survey, 75% of financial institutions reported experiencing debit card fraud attempts.^{footnote [8]}
 

What is fraud’s financial impact?

Among surveyed businesses that experienced fraud, 20% indicated that none of their lost funds were recovered, while 30% recovered over 75%, and the remainder only recovered a portion of their losses.^{footnote [9]} Though smaller organizations tended to suffer from lower recovery rates, the economic risk is substantial for all.

Over the past year, companies surveyed worldwide reported fraud-related losses averaging 7.7% of annual revenue, with total losses reaching $534 billion.^{footnote [10]}
 

Fraud types.

Payments fraud takes many forms, complicating defense strategies. Several of the most frequent merit brief review:
 

Business email compromise (BEC).

Microsoft defines BEC as taking place “when cybercriminals impersonate trusted leaders to trick employees into sending money or data. … They might hack real accounts to send convincing requests or target executives directly.”^{footnote [11]} The goal is to exploit trust.

BEC occurs along two slightly different paths: one aimed at executives and the other at general employees (Figure 2).

Figure 2
View text-friendly version of Figure 2 opens in a new window ^{footnote [PDF]}

Across industries, a whopping 74% of businesses experienced BEC, “making email the dominant channel for payments fraud regardless of organization size.”^{footnote [12]} The concern in healthcare is high. In 2025 research, 53% of providers said they are vulnerable or highly vulnerable to a BEC/spoofing/impersonation incident.^{footnote [13]}
 

Vendor impersonation.

Vendor impersonation is another common form of payments fraud and can involve BEC. This scheme is typically conducted through phone and mail. Accounts payable (AP) departments become centrally involved.

Vendor impersonation occurs when a business receives an unsolicited request, purportedly from a valid vendor, to update the payment information for that vendor, when in fact, it is a fraudster impersonating the vendor. The goal, of course, is to have payments directed to the fraudulent account. Impersonators frequently use publicly available vendor information to appear legitimate.

A recent analysis showed that “vendor email compromise now accounts for the majority of business email compromise (BEC) attacks, making up 61% of all BEC.”^{footnote [14]}
 

Identity theft.

The U.S. Government defines identity theft and fraud as wrongfully obtaining another individual’s personal data to perpetrate crimes such as false applications for loans and credit cards, fraudulent withdrawals from bank accounts, or obtaining other goods or privileges.^{footnote [15]}

Attempted identity misuse most frequently targets financial accounts (85%), particularly credit card accounts (56%) and checking accounts (14%).^{footnote [16]} 
 

Account takeover.

Identity theft often leads to account takeover (ATO) “in which an unauthorized party gains control of a legitimate user account by obtaining or bypassing its credentials.”^{footnote [17]}

Figure 3
View text-friendly version of Figure 3 opens in a new window ^{footnote [PDF]}

From 2024 to 2025, suspected ATO increased by 37%.^{footnote [18]} U.S. victims lost almost $16 billion in 2024, and 5.1 million consumers were victimized.^{footnote [19]} 
 

Check fraud.

As noted earlier, check fraud is a popular scheme, whether altering stolen checks through various means or outright forgery. Fraudsters may exploit the float period between check issuance and settlement.
 

Automated Clearing House (ACH) fraud.

One description states that “Most types of ACH fraud occur when fraudulent actors use ACH debits to transfer funds to accounts they control or can access. They do this by gaining unauthorized access to the victim’s banking data or by manipulating existing payment systems to send unauthorized funds to their own accounts.”^{footnote [20]}

Healthcare represents a significant target for ACH fraud. The industry has seen steady ACH volume growth for several years. In the second quarter of 2026 alone, there were over 141 million transactions.^{footnote [21]}
 

AI-enabled fraud.

This fast-emerging technology is turbocharging payment fraud attempts. Though the topic is too broad to cover here in its entirety, it should be highlighted that AI enables malicious email at a large and sophisticated scale. AI can also generate deepfakes, highly realistic video and audio that is difficult to detect, making impersonation an even more pernicious threat.

One study foresees fraud losses caused by generative AI growing at a compound annual rate of 32% to reach $40 billion in the United States by 2027.^{footnote [22]} 
 

Mitigation.

The complex fraud landscape presents formidable roadblocks to detection and mitigation. The best defense practices encompass a set of varied approaches involving the classic triad of people, process and technology. 
 

Core strategies.

Organizations are strongly advised to consistently apply the following policies: 

• Maintain good account housekeeping. Strong account access control is foundational (Figure 4).

  

  Figure 4
  View text-friendly version of Figure 4 opens in a new window ^{footnote [PDF]}

• Segregate employee duties and establish dual authorization for online money movement. Ensure that no single individual is responsible for vendor setup, processing invoices and approvals.
• Implement strict vendor verification procedures and ensure security of vendor portals. Independently verify all vendor information at the point of onboarding as well as any subsequent requests for payment changes.
• Train employees regularly. This oft-repeated advice retains validity given that payments fraud often relies on social engineering and manipulation of human trust.
• Use debit blocks. Where appropriate, restrict unauthorized debits from banking accounts.
   

Examples of specific services.

Strong financial institutions, such as CommerceHealthcare^®, provide access to proven tools:

• Positive Pay. This service helps mitigate check fraud by comparing checks presented for payment against check information provided by the organization (Figure 5 shows the process).
   

  

  Figure 5
  View text-friendly version of Figure 5 opens in a new window ^{footnote [PDF]}

• ACH Risk Manager. An electronic service that screens ACH activity to help identify unauthorized transactions before they post (Figure 6).
   

  

  Figure 6
  View text-friendly version of Figure 6 opens in a new window ^{footnote [PDF]} 
   

The role of AI.

AI is not only a threat-enhancing technology. It also promises significant elevation of fraud control initiatives. For example, large-scale data analysis can surface fraud patterns to allow rapid recognition and response. AI is also creating “next-generation authentication” that analyzes individual behavior and biometric data for real-time identification of suspicious activities.^{footnote [23]} Another emerging tool is “real-time entity resolution” in which “AI algorithms match incoming payments against blocklists and watchlists” using multiple data points.^{footnote [24]}

Cross-industry surveys show that 17% of organizations are using AI in fraud control.^{footnote [25]} They cite significant gains in fraud reporting, deepfake detection, and real-time identification of suspicious transactions.

The same respondents point to a number of barriers to wider adoption, including the cost of AI investment, internal IT readiness, and concern about regulatory constraints.
 

Payments automation.

Another valuable strategy is automation of finance/RCM processes. Solutions such as electronic lockbox and comprehensive remittance and payment management platforms automate workflows in AP and receivables. That helps reduce fraud exposure associated with the still-prevalent manual, multi-step and paper-based processes used throughout healthcare. Such automation also creates more structured digital data that can support emerging AI applications.
 

More information.

Commerce Bank maintains a “Fraud Hub” on its website. It houses helpful articles, information and resources on this important and fast-moving topic. Please visit Fraud Mitigation | Commerce Bank.
 

Conclusion.

Payments fraud is a growing problem. As a bank with long-time healthcare experience, CommerceHealthcare® shares the industry’s commitment to strong security and compliance. Everyone needs to track the shifting targets and trends in fraud as well as the full arsenal of current and emerging defenses. Readiness is an imperative for all.

CommerceHealthcare^® solutions are provided by Commerce Bank.

Disclosures: