The cheapest moment to stop a fake supplier is before it exists in your system.
Before you pay a new supplier, confirm that the business exists, that the bank account belongs to it, and that someone in your organisation actually asked for it. Check registration and tax numbers, verify bank details by call-back, look for matches with employee details or existing suppliers, and have someone other than the requester approve the setup.
Every new supplier should come from a named person in the business with a reason: what will be bought, roughly how much, and from when. A supplier nobody asked for is the first red flag.
Search the company in the official register for its country of incorporation. Check that the name, number and registered address match what you were given, and that the company is active rather than dissolved.
Use the official checking service where one exists. A tax number that doesn't match the name is a reason to stop and ask.
Call the supplier on a number you found independently, such as their official website or the registry, not the number on the form. Ask them to confirm the account details. Treat this exactly like a bank detail change.
Compare the new supplier's address, phone number and bank account with your employee records and your existing supplier master. A match with an employee needs an explanation. A match with an existing supplier probably means a duplicate record. See vendor master cleanup.
If you trade internationally or your policy requires it, screen the supplier and its owners against the relevant sanctions lists before you pay them.
The person who requested the supplier should not be the person who creates it in the system, and neither should approve it. Approval should check that steps 1 to 7 are complete and evidenced.
Flag the first payment, and ideally the first three months of payments, to any new supplier for review. Most fake suppliers are caught here, when invoice patterns don't match what the requester described.
UK: search companies free on Companies House, check VAT numbers with HMRC's online checker, and screen against the UK sanctions list where required.
US: search the Secretary of State business registry in the supplier's state, collect a Form W-9 for the taxpayer number, and screen against the OFAC sanctions list where required.
Score a payment request against the warning signs of fraud. Free to use online.
The Invoice & Payment Fraud Defence Kit puts every payment through a Release, Hold or Pulled-from-run decision, with a bank detail change verification log, supplier checks, an incident log, a staff training record and a Fraud Defence Playbook (PDF). Excel, no macros, one-time price.
Most checks take minutes once you have the information. The delays usually come from waiting for documents, so request everything at the start.
The bank verification and the internal match checks should apply to every supplier. Some teams use a lighter route for low-value one-off suppliers, but keep it documented.
Usually accounts payable or a central master data team, separate from the people who request suppliers and from the people who release payments.
Last updated 18 October 2026. General guidance for finance teams; check it against your own policies, systems and local rules.