Trustmi announced it has identified and named two emerging payment fraud threats, Ghost Executive and Deadline Deception, following an analysis of 597 intent-driven payment fraud attack attempts observed during the first half of 2026.

According to the company, observed payment fraud attempts increased year over year from 119 incidents in the first half of 2025 to 597 during the same period in 2026. The analysis found attackers are increasingly moving away from isolated phishing messages and malware in favor of coordinated campaigns built around fake financial documents, fabricated business conversations and behavioral pressure.

Trustmi reported that seven of the nine tracked attack patterns included a fake invoice. The most common pattern, identified in 193 incidents, combined a fabricated email thread with a fake invoice. In those attacks, the invoice delivers the payment request while the manufactured conversation is intended to make the transaction appear to have already been reviewed and approved.

"Payment fraud is no longer arriving as an obviously suspicious request. It is arriving with a paper trail, an approval history and a reason not to ask questions," said Shai Gabay, co-founder and CEO of Trustmi. "Attackers are manipulating the trusted processes organizations use to authorize payments. Ghost Executive and Deadline Deception demonstrate why validating an email, a document or payment instruction in isolation is no longer enough. Organizations need to understand how every element of the request connects across the full payment workflow."

Ghost Executive

Trustmi said Ghost Executive involves fraudsters fabricating executive approval by inserting a senior leader into a falsified email conversation or adding apparent executive authorization to a fraudulent financial document. The goal is to present a payment as a decision that has already been made, reducing the likelihood that finance or accounts payable employees will question the request.

The company identified approximately 255 Ghost Executive incidents during the first half of 2026, accounting for more than four in 10 of the payment fraud attempts analyzed. Common variations included AI executive impersonation combined with fabricated email threads or fake invoices.

Deadline Deception

Deadline Deception combines fraudulent paperwork with false payment deadlines such as overdue notices, final demands or end-of-day payment requirements to pressure employees into releasing funds before completing verification procedures.

Trustmi said the attack pattern was virtually absent from its data a year earlier but appeared in approximately 97 incidents during the first half of 2026, making it the fastest-growing attack pattern tracked by the company.

The company said a typical attack begins by targeting a finance or accounts payable employee before introducing a fraudulent vendor identity and supporting documents such as invoices, W-9 forms or bank letters. Attackers then add fabricated executive approval or email history, create urgency with phrases such as "past due," "need today" or "CEO approved," and direct the employee to initiate payment.

Because these attacks may not contain malware or other traditional technical indicators of compromise, Trustmi said individual elements can appear legitimate when reviewed separately. The company said the risk becomes more apparent when identity, communications, documents, vendor records, banking information and payment behavior are analyzed together.

Trustmi assessed nearly every attack in the analysis as medium to high sophistication, with about two-thirds receiving the highest sophistication grade. The company noted the rating reflects analysts' assessment of how convincingly attacks were constructed rather than how often generative AI was used.

To reduce exposure to Ghost Executive and Deadline Deception, Trustmi recommends organizations treat financial documents and apparent executive approvals as claims requiring independent verification instead of proof that a payment is legitimate. The company also recommends finance and security teams establish shared ownership of payment fraud prevention through common escalation procedures and shared risk metrics.