Vendor & Invoice Fraud: Protect Accounts Payable

Fraud patterns

• Fake invoice: Brand-new “vendor” for software, shipping, or utilities you almost use.
• Duplicate / altered invoice: Real PDF with bank details swapped.
• Vendor impersonation: Lookalike domain emails a banking change.
• Compromised vendor: Real supplier mailbox is hijacked mid-project.

Related: business email compromise.

Verification playbook

1. 1
   Match to a purchase order or known contract. No PO? Escalate.
2. 2
   Compare payee details to the last paid invoice on file.
3. 3
   Any change → callback using a phone number already in your vendor master — not the email signature.
4. 4
   Two-person release for new payees and amounts over your threshold.
5. 5
   Scan odd PDFs and emails with ScanBeyond before opening macros or clicking “pay portals.”

Professional services (law, accounting, agencies)

Firms that move client funds are prime targets. Spoofed partners demand same-day wires for closings, settlements, or media buys. Policies should require:

• Verbal confirmation with the responsible partner using a known number
• No client-fund wires from email alone
• Separate approval for trust-account disbursements
• Client education: “We will never change wire instructions by email only”

Red flags

• First-time vendor with urgency and prepayment
• Bank country or beneficiary name does not match the vendor’s legal entity
• “Accounting@” free email for a supposedly large supplier
• Invoice number sequences that jump or reuse old numbers
• Pressure to pay before a weekend or holiday when banks are slow to recall

AP controls

• Vendor master changes require dual approval
• Positive pay / payment notifications from your bank
• MFA on accounting software — 2FA guide
• Quarterly vendor contact re-validation for top spend

If you already paid

1. Call the bank fraud desk for recall / trace immediately.
2. Contact the real vendor on a known number to confirm what they are owed.
3. Preserve invoices, headers, and chat logs; report to IC3 and police.
4. Reset email and accounting credentials; review recent vendor edits.

FAQ