Vendor payment fraud exploits gaps between invoice approval and payment release. This checklist helps finance leaders verify bank changes, strengthen access controls, and monitor payments, with practical steps to take when they suspect a problem.
What helps prevent vendor payment fraud?
Independently verify vendor bank changes using a trusted contact number, separate vendor maintenance from payment approval, and compare the final bank submission with approved instructions. Multifactor authentication and monitoring strengthen those controls, but neither replaces independent verification. Contact your bank immediately if you suspect a fraudulent transfer.
A vendor invoice can be valid while its payment instructions are fraudulent. Approving the purchase, matching the receipt, and confirming the amount do not establish who controls the destination bank account. For CFOs, controllers, and treasury leaders, that distinction should shape the accounts payable control process.
In AFP's 2026 Payments Fraud and Control Survey, 76% of respondent organizations experienced attempted or actual payments fraud in 2025. The survey was conducted in January 2026 among 465 treasury practitioners representing U.S. organizations. That figure measures reported exposure, not the percentage that suffered a financial loss. [1]
Our accounts payable automation strategy article focuses on processing efficiency and platform fit. Here, the priority is establishing trusted payment instructions and keeping them intact through release.
Treat bank changes as a separate approval
Business email compromise can involve spoofed addresses or access to legitimate email conversations. A message in a familiar thread is therefore not enough to authorize a bank change. The FBI recommends independently verifying changes in account numbers or payment procedures and enabling multifactor authentication. [2]
Create a controlled channel for vendor onboarding and bank changes. Record who submitted the request, who verified it, what information changed, and who approved it. Until verification is complete, hold the affected payment and leave the existing bank details unchanged.
Call an authorized vendor contact using a number established through trusted onboarding or another independently verified record. Do not use the phone number, signature block, or link supplied in the change request. Replying to the same email chain does not provide independent confirmation. If the vendor contact details also need changing, verify that change separately before relying on them.
An invoice PDF, bank letter, or familiar logo can support recordkeeping, but none should serve as proof that payment instructions are authentic. Invoice extraction software may capture fraudulent bank details accurately. Keep invoice processing separate from authorization to change the vendor master.
Accounts payable fraud prevention checklist
Use this checklist to test the actual workflow, including exceptions:
- Verify bank changes independently. Call a trusted, previously verified vendor number and document the confirmation.
- Separate duties. Keep vendor bank maintenance separate from change approval and payment release.
- Require individual accounts and MFA. Cover email, AP systems, and banking portals; remove obsolete access promptly.
- Restrict vendor master access. Grant editing rights only where needed and review permissions regularly.
- Preserve approval evidence. Record the verifier, approver, destination details, and reason for each change.
- Flag changed destinations. Route first payments after bank changes and unusual requests for additional review.
- Protect payment files. Restrict file access and require renewed approval after any payment detail changes.
- Monitor bank activity. Assign an owner to review releases, alerts, and exceptions promptly.
MFA helps protect account access; it does not prove that a payment request is legitimate. Staff should never share authentication codes or approve unexpected prompts. Likewise, two approvals offer limited protection if both approvers rely on the same unverified email.
In a small finance team, complete role separation may be difficult. Use a documented independent review by the controller or another authorized leader before release, supported by change logs and bank alerts. Avoid leaving one person able to alter bank details, approve the change, and send the payment without another person's review.
Check the destination at payment release
An approval can become stale if payment data changes afterward. Before release, compare the final bank submission with the approved batch, including destinations, amounts, payment counts, and totals. A matching batch total alone will not reveal a substituted bank account.
Review payments to recently changed accounts and requests that bypass normal timing or approval routes. Define who can approve exceptions and what evidence they need. An urgent message from an executive should not remove vendor verification requirements.
After release, treasury should review bank confirmations and transaction activity against approved payments. Agree with the bank which alerts are available, where they go, and who responds. Alerts sent to an unattended mailbox provide little practical protection.
Test your bank change controls
Use a training exercise to test how your team handles a bank change request attached to an otherwise valid invoice. Ask staff to identify which records establish the payable and which evidence is needed to authenticate the new destination.
Check that the workflow holds the affected payment, requires a callback to a previously verified vendor number, and records the verification and approval before any change. Also confirm who preserves the request and alerts treasury and security if the vendor denies requesting it. A matching invoice supports the payable, but it does not authenticate new bank details.
If you suspect payment fraud
Immediately contact your bank through a trusted channel. Ask it to stop pending payments and request a recall or freeze of transferred funds where possible, including contacting the receiving institution. The FBI advises contacting your financial institution immediately. Recovery is not guaranteed; do not wait for an internal investigation to finish before calling. [2]
Preserve original emails with headers, attachments, approval records, vendor change logs, payment files, and bank references. Coordinate with IT or security to contain suspected account compromise while retaining evidence. Notify finance leadership and verify the situation with the vendor independently.
Report suspected business email compromise to the FBI's Internet Crime Complaint Center, using the official site linked by the FBI. [2] Coordinate with legal counsel and insurers on applicable notification requirements.
Evaluate platforms against your controls
When reviewing payment automation solutions, ask providers to demonstrate bank change verification, role restrictions, approval history, exception handling, and payment file protections using your workflow.
Schedule a consultation with Conduit Bridge Advisory to discuss your ERP environment, operating requirements, AP control priorities, and provider evaluation. Your finance team, bank, and security specialists retain responsibility for payment authorization and incident response.