New "Ghost Executive" and "Deadline Deception" attacks use fabricated approvals, fraudulent paperwork and artificial urgency to make payments appear legitimate
NEW YORK CITY, NY / ACCESS Newswire / July 28, 2026 / Trustmi, the leader in Behavioral AI for payment security, today announced the discovery and naming of two emerging payment fraud threats - Ghost Executive and Deadline Deception - following an analysis of 597 intent-driven payment fraud attack attempts observed during the first half of 2026.
Trustmi's analysis found a year-over-year increase in observed payment fraud attempts, rising from 119 incidents in the first half of 2025 to 597 during the same period in 2026. The attacks reveal a growing shift away from isolated phishing messages or malware and toward coordinated fraud campaigns built around believable financial documents, fabricated business conversations and behavioral pressure.
Across the incidents analyzed, seven of nine tracked attack patterns included a fake invoice. The most common individual pattern - observed in 193 incidents - combined a fabricated email thread with a fake invoice. In these attacks, the invoice provides the payment request while the manufactured conversation creates the appearance that the transaction has already been reviewed and approved.
"Payment fraud is no longer arriving as an obviously suspicious request. It is arriving with a paper trail, an approval history and a reason not to ask questions," said Shai Gabay, co-founder and CEO of Trustmi. "Attackers are manipulating the trusted processes organizations use to authorize payments. Ghost Executive and Deadline Deception demonstrate why validating an email, a document or payment instruction in isolation is no longer enough. Organizations need to understand how every element of the request connects across the full payment workflow."
Ghost Executive: An Executive Who Was Never There
Ghost Executive is an attack in which fraudsters fabricate an executive's approval - either by inserting the executive into a falsified email conversation or placing apparent executive authorization on a fraudulent financial document - so the payment looks like a decision that has already been made.
Trustmi identified ~255 Ghost Executive incidents in the first half of 2026, representing more than four in 10 of the payment fraud attempts analyzed. Common variations included AI executive impersonation paired with a fabricated email thread or fake invoice.
The attack exploits the authority associated with senior leadership. Rather than asking a finance or accounts payable employee to make a new decision, the attacker presents the payment as an instruction that has already been evaluated and approved. The executive is present in appearance but absent in fact, making employees less likely to challenge or independently verify the request.
Deadline Deception: When the Clock Becomes the Weapon
Deadline Deception pairs fraudulent paperwork with a false deadline - often an overdue notice, final demand or end-of-day payment requirement - to reduce the time available for verification and pressure an employee into releasing funds.
It was virtually absent from our data a year ago, but by the first half of 2026, however, it had appeared in approximately 97 incidents, making it the fastest-growing attack pattern tracked by the company.
Where Ghost Executive borrows authority, Deadline Deception weaponizes urgency. By framing payment as the safest option and delay as the greater business risk, attackers attempt to override established review procedures and discourage employees from independently validating the vendor, banking information or claimed approval.
The resulting attack chain commonly follows six stages:
A finance or accounts payable employee is targeted
The attacker creates or borrows a fraudulent vendor identity
Supporting paperwork, such as an invoice, W-9 or bank letter, is generated
An executive approval or fabricated email history is introduced
Urgency is applied through language such as "past due," "need today" or "CEO approved"
The employee is directed to initiate payment
Because these attacks may contain no malware or conventional technical indicator of compromise, any individual component can appear legitimate when reviewed on its own. The risk becomes clearer only when identity, communications, documents, vendor records, banking details and payment behavior are analyzed together.
Trustmi assessed nearly every attack in the analysis as medium to high sophistication, with approximately two-thirds receiving the highest sophistication grade. The classification reflects Trustmi analysts' assessment of how convincingly each attack was constructed; it is not a direct measurement of how frequently generative AI was used.
Reducing Exposure to Ghost Executive and Deadline Deception
Trustmi recommends that organizations treat clean-looking financial documents and apparent executive approvals as claims requiring independent verification - not proof that a payment is legitimate
Longer term, Trustmi recommends establishing shared ownership between finance and security teams, including common escalation procedures and metrics for payment fraud risk.
About the Analysis
The findings are based on Trustmi's analysis of 597 notable payment fraud attempts identified across enterprises during the first half of 2026 and compared with the same period in 2025. Trustmi focused on deliberate, intent-driven fraud, the cases built to succeed, and set aside the far larger volume of low-effort spam.
Some attacks were identified while Trustmi worked with customers and were stopped before a final transfer amount was confirmed. Others were uncovered during in-depth reviews with prospective organizations, allowing analysts to observe the full attack sequence. Each case was categorized according to the fraud pattern, tactics used, date observed and requested payment amount when available. All examples were anonymized.
Because an individual incident can combine several tactics and attack patterns, certain figures overlap. Percentages cited as a share of total incidents are identified accordingly.
To read the full findings and learn more, view Trustmi's Benchmark Special Report "The Fraud in the Paperwork"
About Trustmi
Trustmi is the leading behavioral AI platform for payment security, helping enterprises stop fraud and costly payment errors before money moves. As fraud increasingly arrives "pre-approved" - designed to pass existing controls - Trustmi provides a critical verification layer across the entire payment lifecycle. By correlating signals across email, vendor behavior, financial documents, and payment workflows, Trustmi detects sophisticated, socially engineered attacks that traditional security and finance controls miss. Trusted by global enterprises with complex payment environments, Trustmi protects over $240 billion in payments annually and has helped prevent more than $1 billion in fraud and $5 billion in payment errors. Founded in 2021, Trustmi is headquartered in New York City and backed by leading investors including Cyberstarts and Insight Partners. For more information, visit https://www.trustmi.ai/.
Contact
PAN for Trustmi
trustmi@pancomm.com
SOURCE: Trustmi
View the original press release on ACCESS Newswire
