76% of Treasury Teams Hit by Fraud as Deepfake Attacks Rise, Treasury Dragons & nsKnox 2026 Index Finds

The 2026 Treasury Dragons Payment Fraud Index, produced with nsKnox, identifies payment-data verification as a material corporate-control weakness: only 18% of organizations continuously revalidate supplier bank details. Meanwhile, 41% still receive sensitive payment information by email, increasing exposure to payment fraud and business-email-compromise risks. The findings underscore continued demand for stronger treasury verification and payment-security controls.

Analysis

This is a weak standalone equity catalyst: a vendor-sponsored survey measures control gaps rather than incremental IT budgets, breach losses, or buying intent. The investable read is that supplier-payment verification remains an underpenetrated workflow within enterprise treasury, favoring platforms that can bundle controls into existing ERP, procurement, and bank-payment rails rather than point-security vendors. SAP, ORCL, and FIS have distribution advantages if CFOs prioritize vendor-master-data controls, while PANW and CRWD benefit only indirectly unless fraud events translate into broader identity and email-security spending.

The nearer-term risk is asymmetric for banks and payment processors: a high-profile business-email-compromise event can raise reimbursement, litigation, and onboarding-control costs before it creates meaningful software revenue. Over 1-3 months, watch for disclosed fraud losses, treasury-security budget commentary, and ERP/procurement attach-rate data; absent those, the survey should not alter estimates. Over 6-18 months, regulatory or bank-led confirmation standards could shift verification from a discretionary treasury tool into a required workflow, creating recurring revenue and switching-cost upside for incumbent enterprise platforms.

Contrarian view: consensus may over-attribute payment fraud remediation to cybersecurity multiples. The economic buyer is usually treasury/procurement, and the winning product must reduce payment friction and false-positive exceptions, not merely identify threats. A tightening of corporate IT budgets could therefore favor SAP/ORCL modules with low incremental implementation cost over premium standalone security subscriptions.

Key Decisions for Investors

• No directional trade on the survey alone; treat it as a watch signal until an independently disclosed fraud event, regulatory proposal, or enterprise-budget datapoint establishes measurable demand.
• Monitor SAP and ORCL quarterly commentary for treasury, procurement, supplier-master-data, and AI-assisted workflow attach rates over the next 1-3 earnings cycles. A guidance raise tied to finance-workflow cross-sell would support a relative long versus broad software ETF IGV.
• Maintain a conditional long SAP / short PANW relative-value screen rather than execute immediately: the thesis activates only if finance-workflow bookings accelerate while security spending remains budget-constrained. Falsify if PANW shows material payment-fraud product bookings or SAP implementation cycles lengthen.
• For bank exposure, monitor JPM, BAC, and C fraud-loss disclosures and commercial-client reimbursement policy changes. A cluster of losses or mandated payee-confirmation controls would be a near-term margin headwind for transaction banking, but not sufficient for a short without evidence of reserve or expense-guide pressure.