The Payment Looked Suspicious. The Story Behind It Was Different.

An unusual payment can raise an important AML question.

But the payment itself does not always explain what happened.

Sometimes the customer may be deliberately moving funds.

Sometimes the activity may be connected to fraud.

Sometimes a legitimate customer may have been deceived.

Understanding the difference can be just as important as identifying the unusual activity in the first place.

A recent case offers an interesting example

In September 2026, a U.S. district court entered a judgment forfeiting approximately $375,000 connected to a business email compromise scheme.

According to the U.S. Department of Justice, criminals impersonated vendors of a business and instructed an employee to redirect legitimate invoice payments to an account controlled by the scammers.

The business believed it was paying genuine invoices and ultimately sent more than $800,000 to the fraudulent account.

The money was later moved through additional accounts, making it more difficult to trace.

The case eventually led to the recovery and forfeiture of part of the proceeds.

The important AML point is not simply that an unusual payment occurred.

It is that the same transaction can look very different once the circumstances behind it are understood.

A payment can look suspicious for more than one reason

Imagine a business that normally pays its suppliers every month.

One day, a payment is sent to a new account.

The amount is significant.

The beneficiary has not appeared before.

The payment does not match the customer's usual behaviour.

From a monitoring perspective, those are reasonable reasons to take a closer look.

But there are several possible explanations.

The customer may have intentionally made the payment.

The payment instructions may have been changed through fraud.

An employee may have been deceived.

A legitimate business relationship may have changed.

The transaction alone does not tell us which explanation is correct.

This is where context becomes important

A useful AML investigation should consider what happened before the transaction.

Who requested the payment?

Was the beneficiary previously known?

Did the customer confirm the change?

Was there a recent change to payment instructions?

Does the customer have a history of similar transactions?

Did the customer report that it had been deceived?

Are there other payments showing the same behaviour?

These questions help build the circumstances around the transaction.

They do not guarantee a conclusion.

They help make the conclusion more informed.

Fraud and AML can meet at the same transaction

This is one reason the relationship between fraud teams and AML teams matters.

A fraud investigation may identify that a customer was deceived.

An AML investigation may identify that the funds moved through an unusual account.

Both observations can be important.

A payment can be connected to a crime without the customer who sent it intentionally participating in that crime.

At the same time, a customer claiming to have been deceived should not automatically end the investigation.

The available facts still need to be considered.

The customer's normal behaviour can help

Customer profiles are not only useful for identifying potentially suspicious behaviour.

They can also help explain unexpected behaviour.

Consider a company that has made supplier payments to the same businesses for several years.

A sudden instruction to send a large payment to a completely new account deserves attention.

That does not mean the customer has become high risk.

It may simply mean something happened.

The change becomes a starting point for understanding what happened rather than an immediate conclusion about the customer.

This matters across different businesses

A bank may see the payment leaving an account.

A payment provider may process the transfer.

An accountant may later see the unexplained change in the company's records.

A professional adviser may be told that a client's funds were redirected.

A DNFBP may encounter the proceeds at a later stage when the money is used for another transaction or asset.

Each business may encounter a different part of the story.

That makes communication and context valuable.

What should happen when unusual activity may involve fraud?

Start by understanding the event.

Establish what changed.

Review the relevant customer and transaction information.

Consider whether the payment was consistent with previous activity.

Where appropriate, coordinate with fraud, cybersecurity or other relevant internal teams.

Obtain additional information when the circumstances justify it.

Document the reasoning behind the outcome.

If the information creates reasonable grounds for suspicion and the applicable reporting requirements are met, follow the organisation's established procedures.

The important point is to investigate without making assumptions too early.

There is a balance to maintain

Strong AML controls need to identify suspicious activity.

They also need to recognise that unusual activity can have different explanations.

A victim of fraud should not automatically be treated as a willing participant.

At the same time, an explanation should be supported by the available facts rather than accepted simply because it was provided.

That balance is part of good financial crime analysis.

The lesson

A suspicious payment is a signal.

It is not always a conclusion.

The most useful question may therefore not be:

“Why did the customer send this money?”

It may be:

“What happened that caused this payment to occur?”

Sometimes the answer will point towards deliberate financial crime.

Sometimes it will point towards fraud.

Sometimes it will reveal a legitimate change in circumstances.

Understanding that difference helps compliance teams make better decisions while treating customers fairly.

The transaction may be the first thing you notice.

The circumstances behind it may be the most important part of the investigation.

Reference: U.S. Department of Justice, United States Recovers $375,000 in Fraud Proceeds from a Business Email Compromise Scam, 24 September 2026. Official DOJ reference