Most payment fraud gets through a gap between two people who each thought the other had checked.
Payment fraud is stopped by a short set of controls applied every time: verify new suppliers and every bank-detail change by callback, protect the supplier master file, separate preparing from approving payments, review the payment run against exceptions, and never let urgency, secrecy or seniority override the process.
| # | Control | Stops |
|---|---|---|
| 1 | Verify new suppliers against official sources before the first payment | Fake suppliers |
| 2 | Confirm every bank-detail change by calling a number already on file | Bank-change fraud |
| 3 | Restrict who can edit the supplier master file, and log every change | Insider diversion |
| 4 | Have a second person approve every supplier master change | Single-person fraud |
| 5 | Check the sender's email domain against the supplier record | Lookalike-domain emails |
| 6 | Match invoices to purchase orders and goods received where possible | Fake and inflated invoices |
| 7 | Run duplicate tests before every payment run | Duplicate payments |
| 8 | Separate preparing, approving and releasing payments | Unauthorised payments |
| 9 | Review the payment run for new accounts, round amounts and unusual payees | Payments that slipped through |
| 10 | Use bank name checks and dual authorisation in online banking | Misdirected payments |
| 11 | Ban exceptions for urgency, secrecy or seniority in writing | Executive impersonation |
| 12 | Reconcile supplier statements and the bank every month | Fraud that already happened |
With two or three people you cannot separate every duty. Compensate with a monthly independent review: someone outside the payment process, such as the finance director or an owner, reviews the supplier master change log and a list of all payments to new accounts. See segregation of duties in accounts payable.
Business email compromise alone accounted for close to $2.8 billion of losses reported to the FBI's Internet Crime Complaint Center in 2024, and nearly $8.5 billion between 2022 and 2024. Most of those losses passed through a normal-looking payment run.
UK: use Confirmation of Payee on every new or changed payee, and make sure your online banking requires two users to release a payment. US: ask your bank about Positive Pay for cheques and ACH debit blocks, and use dual approval in the bank portal. The process controls above are the same in both countries.
Score a payment request against the warning signs of fraud. Free to use online.
The Invoice & Payment Fraud Defence Kit puts every payment through a Release, Hold or Pulled-from-run decision, with a bank detail change verification log, supplier checks, an incident log, a staff training record and a Fraud Defence Playbook (PDF). Excel, no macros, one-time price.
Bank-detail change fraud and executive impersonation, both forms of business email compromise, cause the largest losses. Both are stopped by verifying changes and requests through a channel the fraudster does not control.
Yes. Software enforces the steps you configure, but bank-change verification, independent approval and supplier master access still depend on how you set it up and who has which permissions.
Review the supplier master change log and payments to new accounts monthly, and walk through the full process at least once a year, ideally with someone outside the AP team.
Last updated 18 October 2026. General guidance for finance teams; check it against your own policies, systems and local rules.