Every organization faces fraud risk. Historically, prevention efforts focused on risks originating within the organization, such as asset misappropriation, expense reimbursement schemes, procurement fraud, and financial reporting misconduct. While these risks remain relevant, organizations are increasingly confronting fraud threats driven by advances in technology and a rapidly changing digital environment.

As fraud risks evolve, prevention strategies need to evolve with them. Organizations that rely exclusively on traditional approaches may find themselves less prepared for threats that can originate outside the organization and be carried out with a level of speed and sophistication that was difficult to imagine even a few years ago.

Understanding the Limits of Traditional Fraud Frameworks

For decades, the fraud triangle has served as a foundational model for understanding fraudulent behavior. The framework identifies three conditions that contribute to fraud: opportunity, pressure, and rationalization.

This model continues to provide valuable insight, particularly when evaluating occupational fraud risk. Many long-standing fraud prevention measures were designed around these concepts. Segregation of duties, access restrictions, and management oversight remain important safeguards. Together, these measures help limit opportunities for misconduct and reinforce accountability throughout the organization.

However, many of today’s fraud risks do not fit neatly within the traditional fraud triangle. Cybercriminals, organized fraud networks, and other external threat actors often operate independently of the motivations commonly associated with employee misconduct. Their goals may range from stealing funds or sensitive information to disrupting operations or demanding ransom payments. Unlike traditional occupational fraud, these threats can originate anywhere and target organizations of any size.

As a result, organizations should view traditional fraud frameworks as an important foundation rather than a complete solution.

Artificial Intelligence Is Reshaping Fraud Risk

Artificial intelligence has significantly changed both the scale and sophistication of fraudulent activity.

Fraudsters can now use AI to create convincing documents, impersonate individuals through voice-cloning technology, and generate realistic video content. Tools that once required specialized expertise are becoming increasingly accessible, making sophisticated fraud schemes easier to execute.

These capabilities can support a wide range of schemes, from fraudulent payment requests to business email compromise attacks. In some cases, fraudsters use AI-generated content to establish credibility and persuade employees to bypass established procedures.

The challenge for organizations is that many traditional verification practices rely on familiarity and trust. Employees may recognize a voice, an email address, or a face on a video call and assume the communication is legitimate. As AI-generated content becomes more convincing, organizations may need to strengthen independent verification procedures and reevaluate approval processes that rely heavily on perceived authority.

Moving Beyond a Reactive Approach

Many organizations strengthen fraud prevention efforts only after experiencing a loss. While investigations and corrective actions are important, they take place after financial damage has already occurred.

An effective fraud prevention strategy is proactive rather than reactive. This requires organizations to routinely revisit their risk profile and determine whether existing controls remain effective as operations, technology, and business processes change.

Fraud prevention should be viewed as an ongoing business process rather than a one-time compliance exercise. As organizations grow and adopt new technologies, new vulnerabilities can emerge. Regular risk assessments help ensure prevention efforts remain aligned with current threats.

Building a More Comprehensive Prevention Strategy

Effective fraud prevention depends on more than strong policies. Organizations also need visibility into emerging risks and the ability to adapt as threats evolve.

Traditional safeguards remain essential. Management oversight, vendor due diligence, employee training, and periodic access reviews continue to play an important role in reducing fraud risk. These controls provide a strong foundation for addressing many common schemes.

At the same time, organizations should consider whether their prevention strategies adequately address technology-driven threats. Multi-factor authentication, data encryption, cybersecurity assessments, and continuous monitoring can strengthen defenses against external fraud attempts.

Many organizations are also leveraging data analytics to identify unusual transactions, unexpected payment activity, or other anomalies that warrant further review. These tools can help organizations identify potential issues earlier and respond before losses escalate.

Perhaps most importantly, fraud prevention programs should remain flexible. Risks continue to change, and controls that were effective several years ago may not provide the same level of protection today.

The Continuing Importance of People and Culture

While technology continues to transform fraud risk, people remain one of the most important elements of any prevention strategy.

Leadership sets the tone for how risk and integrity are viewed throughout the organization. When management consistently reinforces expectations and responds appropriately to concerns, employees are more likely to recognize red flags and report suspicious activity.

Organizations should also encourage open communication and provide clear reporting channels for concerns. A strong culture of integrity can help reduce opportunities for misconduct while supporting the early identification of potential issues.

Internal audit, compliance, and risk management functions can further strengthen these efforts by evaluating existing controls and helping organizations address new and emerging risks. Their role extends beyond compliance and can provide valuable insight into whether prevention strategies remain effective as the business evolves.

Looking Ahead

Fraud risk continues to evolve alongside technology and changing business practices. While traditional fraud prevention frameworks remain valuable, organizations should regularly evaluate whether their strategies address the risks they face today rather than the risks they faced in the past.

Organizations that regularly reassess fraud risks and adapt their prevention strategies will be better positioned to protect assets, respond to emerging threats, and maintain stakeholder confidence. In today’s environment, fraud prevention is not simply a matter of compliance. It is an important component of risk management, operational resilience, and long-term organizational success.

At HTB, we help organizations evaluate risk, strengthen governance practices, and navigate complex business challenges with confidence. Contact us to learn how our team can help your organization address risk and make informed decisions in a changing environment.

 Millions of Americans struggled to meet IRS deadlines during the COVID-19 pandemic. Between business closures, staffing shortages, and unprecedented disruption to daily life, filing taxes on time became extraordinarily difficult for countless taxpayers. Many ended up paying significant penalties and interest as a result. Now, a groundbreaking federal court decision is offering hope that some of those payments may be recoverable.

In Kwong v. United States, the U.S. Court of Federal Claims ruled that the IRS miscalculated tax deadlines during the COVID-19 emergency. The decision could open the door for taxpayers who paid penalties between January 20, 2020, and July 10, 2023, to claim refunds.

Understanding the Legal Framework

Internal Revenue Code Section 7508A allows the IRS to extend tax filing and payment deadlines when taxpayers are affected by federally declared disasters. Under the 2019 version of Section 7508A(d), the law mandated an automatic extension running from the earliest declared incident date through 60 days after the latest incident date. For COVID-19, the earliest incident date was January 20, 2020, and FEMA established May 11, 2023, as the latest incident date—meaning the automatic extension ran through July 10, 2023, a span of more than three years.

The statute says this mandatory postponement period “shall be disregarded” when calculating various tax deadlines, including the two-year window to file a refund suit. The IRS, however, argued through its regulations that disaster extensions could never result in more than one year being disregarded, effectively capping the relief available to taxpayers.

What the Court Decided and Why It Matters

Terry Kwong sought refunds of penalties for multiple tax years. The IRS argued his claims were time-barred under the normal two-year limitation, but Kwong contended that the entire COVID-19 disaster period should be excluded from that calculation. The Court of Federal Claims agreed. Reading the plain language of the statute, the court held that the full period from January 20, 2020, through July 10, 2023, must be disregarded when computing filing deadlines, making Kwong’s February 2023 lawsuit timely.

The court also rejected the IRS’s regulatory interpretation that would have capped the extension at one year. Citing the Supreme Court’s decision in Loper Bright Enterprises, which eliminated judicial deference to agency interpretations of ambiguous statutes, the court concluded it was bound by the plain text of the law. The regulation, in the court’s view, had “misread” what the statute required. It’s worth noting that Congress amended Section 7508A in 2021 and again in 2025 to cap disaster extensions, but both amendments apply only to disasters declared after their enactment. The COVID-19 declaration predated these changes, so the original, more generous version of the law still governs.

Who Might Be Entitled to Relief?

The implications extend well beyond Terry Kwong’s case. Any taxpayer who paid IRS penalties or interest for deadlines falling within the COVID-19 disaster period may have grounds to seek a refund—including failure-to-file penalties, failure-to-pay penalties, and associated interest. This also applies to taxpayers with earlier tax years whose administrative or judicial deadlines happened to fall during the pandemic period.

Additional relief came through the Disaster-Related Extension of Deadlines Act, signed into law on December 26, 2025. This legislation modified Section 7508A to ensure that disaster postponement periods are treated as extensions when calculating refund amounts, closing a gap that previously prevented some taxpayers from recovering the full amount of their overpayments.

Taking Action to Preserve Your Rights

For taxpayers who believe they may have overpaid penalties, time remains of the essence. The first step is obtaining IRS transcripts to identify exactly what penalties and interest were assessed and paid between January 20, 2020, and July 10, 2023. Because the government may appeal the Kwong decision, tax professionals are recommending that eligible taxpayers file a protective refund claim using Form 843 (Claim for Refund and Request for Abatement), citing the Kwong decision as the legal basis. A protective claim acts as a placeholder, stopping the statute of limitations clock while legal developments continue to unfold. Claims related to this decision generally need to be filed by July 10, 2026, but acting sooner avoids administrative hurdles. For penalties that remain unpaid, taxpayers can also request abatement based on the Kwong decision.

How HTB Can Help