AI-powered fraud has found a favourite target: the people who run events, because they move money fast, to many vendors, and almost always under time pressure. Three schemes keep repeating: the fake client who commissions an event with flawless paperwork, the email that changes bank details in the middle of production, and the invitation that is really a request for permissions on your account. The defence is a method, not a tool: no payment instruction is accepted through a single channel, no advance goes out before the client’s money has truly settled, and every event has one official place where its details are published. If you are hiring a partner in another country, that verification has to run both ways.
What was said in New York, and why it travels
Fraud took up a full session at Skift Meetings Forum, held on 22 September in New York. According to Skift Meetings’ coverage, Nelson Lawson, managing partner at Information Secured, explained that the events industry is especially exposed because it runs on urgency, and gave two numbers: only 1% of cybercrime cases are successfully prosecuted, and the average amount taken from a small or medium-sized business is around 250,000 dollars. His working rule was blunt: assume everything is a fraud until verified.
Two weeks earlier, the same outlet unpacked an FBI warning about attackers posing as event professionals and sending malicious links disguised as invitations. The trick does not steal a password: it gets the victim to authorise an app on their account, which according to the FBI can bypass passwords and multi-factor authentication and stay active after the password is changed.
The wider picture matters too. An analysis of FBI data published by Insurance Business puts business email compromise losses (the email that impersonates a vendor or an executive) at just over 3 billion dollars in 2025, with 24,768 reported incidents in the United States alone.
None of this stays in the US. Any cross-border event combines the same ingredients: deposits to vendors, payments between countries and currencies, a client and a partner who have never met in person, and teams working from their phones.
The three schemes already in circulation
The fake client with real-looking documents. The clearest example was reported by Skift Meetings in February: a Las Vegas producer spent three months on a supposed office launch for the American Coatings Association. He received a signed statement of work, invoices and a 20,000 dollar deposit that appeared to clear; trusting it, he advanced 20,280 dollars to vendors. A second payment of 28,000 dollars was reversed a week later. The “client” domain had been registered in bad faith, the contact did not exist, and the association confirmed that at least half a dozen planning firms had received the same outreach. The producer lost more than 75 hours of work.
The bank detail change mid-production. An email with the usual logo, signature and tone says the vendor has “changed banks” and shares new account details. With AI, that email no longer has spelling mistakes. As Mike Bushman of RainFocus put it in the FBI piece, the old advice of watching for typos and awkward phrasing is far less reliable now.
The invitation that asks for permissions. A link to “confirm attendance” or “see the agenda” opens a screen asking you to authorise an app on your email or files. The advice Skift collected is simple: if a consent screen appears after clicking an event link, close the window. Legitimate event registration rarely needs broad access to your email, files or contacts.
How to verify before the money moves
What was repeated in New York fits into a routine any production can adopt:
- Confirm every payment instruction through a second channel. A call to a number you already had, never the one in the same email. Lawson extended this to video calls: there are already losses from executive deepfakes on live calls, and the defence is the same.
- Do not advance client money before it has truly settled. In the Las Vegas case, the expensive mistake was paying vendors with a deposit that was later reversed. Before funds go out, confirm with your bank that the incoming payment is final.
- Read the domain, not the name. An email from “the brand” on a domain with one letter changed is the entry point for most of these schemes.
- Slow down with first-time clients. Nirjary Desai, a producer on the same panel, said she now asks first-time clients to wire funds into her lawyer’s escrow account, with a 30-day hold before release. After falling for a scam, she recovered 20,000 dollars within 60 days because she had documented every communication and worked with her bank’s fraud department.
- Keep one official source for the event. A single page listing the domains, vendors and channels that will be used, so attendees and suppliers have something to check against.
Desai added a warning for anyone producing brand launches: scammers choose targets by looking at social media, and the more lavish an event looks, the more attractive the company behind it becomes.
Attendees are a target too
The risk does not end in accounts payable. The FBI-related guidance includes steps for event day: decide in advance who can alert attendees and through which channels if a fake message circulates, and add short security guidance to registration confirmations. If your event handles registrant data, this connects with what we covered on attendee data and privacy: who holds it, where it is stored and which vendor can reach it.
It also changes what to ask registration, app and accreditation vendors. Skift suggests two concrete questions: what permissions they request on accounts, and how fast they would notify you of a breach. A vague answer is already a warning sign.
Hiring a partner in Argentina or LATAM: verification runs both ways
When an agency in London, Toronto or Mexico City hires a production partner in Buenos Aires, both sides are doing exactly what fraudsters imitate: dealing with someone they have not met, signing remotely and sending money across currencies. That is why verification has to be mutual and written down from day one.
On the hiring side, the usual filters apply, with no shortcuts: named cases you can check, a formal contract, a legal invoice from the partner’s country and staged payments tied to milestones. We break that down in how to vet a local event partner in LATAM. On the partner side, the healthy practice is the mirror image: knowing who pays, from which account and with which tax details before committing a single vendor. In Argentina, for instance, we invoice international clients in USD with an exportable invoice, which gives both sides a paper trail from the start.
Distance is not the problem: an entire operation can be run from another country, as we did with access control for FILGUA in Guatemala, monitored from Buenos Aires. The problem is operating remotely without a method to verify. If you are planning an event in Argentina or elsewhere in the region and need a local partner with contracts, export invoicing and clear processes, see how we work as an operating partner in Argentina and through our strategic partnerships.