Are your fraud controls costing you more than the fraud they stop?

Fifty-five percent of CFOs at mid-market companies say their own fraud and security controls delayed payments to good customers or partners at least occasionally in the past year, according to a PYMNTS Intelligence survey of 60 CFOs at US firms with $100M-$1B in revenue. That's not a rounding error. Firms where this happens repeatedly lose 1.92% of annual revenue to the delays, errors, and cleanup work that follow — more than six times the 0.31% lost at firms without the pattern. The controls meant to protect the business are, for a majority of mid-market finance teams, also taxing it.

This is not an argument for looser controls. It's the opposite: it's what happens when real controls run through a process — manual review — that cannot scale to meet them.

Why does catching fraud slow down payments that aren't fraudulent?

Because most fraud controls in mid-market AP still resolve through a person, and a person can only look at so many invoices a day. The check itself — does this bank detail match what we have on file, is this a near-duplicate of an invoice we already paid, is this vendor new and this amount unusually large — takes the same fraction of a second whether it's automated or not. What doesn't scale is the queue behind it: every invoice that trips a rule waits for someone to open it, compare it, and decide, and that someone has a finite number of hours.

The same PYMNTS research found only 43% of CFOs rate their own company as strong at processing payments quickly while keeping fraud controls effective — meaning a majority are living with the tradeoff, not solving it. And 78% said gaps in visibility around fees, timelines, or policy status were themselves adding to customer friction, on top of the delays the controls cause directly. The bottleneck compounds: slow review creates unclear status, unclear status generates vendor calls, vendor calls consume the time that should be clearing the backlog.

A concrete version of this: a distributor's regular supplier updates its remittance bank details after a legitimate acquisition. The rule that flags bank-detail changes is doing exactly its job — that's precisely the pattern real payment-redirection fraud follows. But it lands in the same queue as everything else waiting on a person, behind whatever came in first. Three days later the supplier is calling to ask what happened, and the answer is: nothing happened, the check worked, there just wasn't anyone free to close it sooner. The control wasn't wrong. The queue behind it was the actual bottleneck.

What does this actually cost, beyond the annoyance?

The 1.92%-of-revenue figure is the headline, but it's built from ordinary line items: late-payment penalties and lost early-payment discounts, staff hours spent re-verifying vendors the system already flagged once before, the relationship cost of a supplier who now invoices you last because your payments run slow, and the fraud that a backlogged review queue eventually rubber-stamps because nobody had time to look closely. None of these show up as a single dramatic loss. They show up as a finance team that is always slightly behind, on both the fraud side and the speed side, because the same queue is doing both jobs.

Eighty-five percent of the CFOs in the same survey named automation that reduces manual review as the remedy most likely to improve speed and security at the same time — the highest-cited fix in the study, ahead of straight-through processing (70%) and AI-based real-time fraud scoring (53%). That's the finance team's own read on where the fix lives: not fewer checks, less manual work per check.

So is the fix looser rules, or something else?

Something else. The instinct to loosen controls under pressure to move faster is exactly how the fraud gets through — and tightening controls without changing how they're executed is exactly how the queue gets longer. The fix that shows up in the CFO data isn't a dial between "safe" and "fast"; it's removing the ceiling that manual review puts on both.

That's the same shape of problem this pipeline is built to solve on the fraud-detection side: a layer that reads every invoice as it arrives, checks it against what was agreed and what was received — bank details, amounts, quantities, vendor history — and only surfaces the fraction that's genuinely ambiguous to a person. In production, that has meant running the checks on 10,000+ invoices at 100% coverage, not a sample, with real fraud found in the exceptions the system actually flagged. The same architecture that catches fraud without sampling is the one that clears legitimate payments without a manual queue behind every one of them — the two aren't competing goals once the review layer stops being the constraint.

How do you tell if this is happening to you before it shows up in a revenue number?

Look for three signs, all cheap to check without a new tool: how often the same vendor gets re-flagged for details you already verified last quarter, how many invoices sit in a "needs review" state for more than a few days, and whether vendors have started asking about payment status before you've asked them anything. Any one of these, happening regularly, is the pattern the PYMNTS data describes — and the fix starts with measuring your own exposure before deciding what to automate.

If you want an honest read on where your own AP process is losing time to manual review — not a pitch, a process map — the free AI Audit is the place to start. Prefer to talk it through directly? Book a call.