Why Automation Is Breaking Traditional Fraud Controls

The firm’s recent analysis argues that corporate judgment has migrated from human oversight to automated execution, leaving internal controls without a place to attach. Partner Kia Hakimi notes that while recommendations keep a human in the loop, automated systems bypass the verification step where errors—such as altered account numbers—are typically identified.

This concern mirrors guidance from six international cyber agencies, including CISA and the NSA, which recently urged organizations to prioritize reversibility over efficiency. The advisory warns that if a system can wire money or alter legal documents, a human must remain the final arbiter. The danger lies in the delegation of oversight: when systems decide which exceptions a human reviews, the supervisor is merely confirming the machine's own output.

Financial stakes remain high, with the FBI reporting $3.047 billion in losses from business email compromise last year. The majority of these thefts occur via wire or ACH transfers, where recovery is nearly impossible. Shadow Sciences advocates for a balanced approach: automate low-stakes tasks, but keep human intervention mandatory for any action where the damage cannot be undone.