Most supplier fraud and many duplicate payments start in the same place: a messy supplier master.
Export the full vendor master, deactivate suppliers with no activity in 12 to 18 months, merge duplicates that share a tax number, bank account, address or normalised name, complete missing tax and contact data, and verify bank details for active suppliers. Then restrict who can create or change records, and review every change monthly.
Pull every supplier record with: supplier ID, name, status, address, tax number, bank details, contact details, payment terms, date created, last changed date and who changed it, and last invoice or payment date.
Any supplier with no invoice or payment in the last 12 to 18 months should be blocked for payment. Dormant records are a favourite target because nobody notices when one starts receiving payments again. Block rather than delete, so history stays intact.
Look for records that share any of these:
Keep one active record, move open items to it, and block the rest. Duplicate records are the main cause of the cross-supplier duplicate payments described in the duplicate payment audit.
Compare supplier addresses, phone numbers and bank accounts with your employee records. A match isn't always wrong, since some employees are legitimately paid as suppliers, but every match needs a documented reason.
Records without a tax number, a named contact or an email domain are hard to verify later. Request missing details from active suppliers and record the email domain they use, so the team can check emails against it.
Start with your highest-value suppliers and those whose bank details changed in the last year. Verify by phone on an independently sourced number, using the same steps as a bank detail change.
List who can create or change supplier records in your system. It should be a small group that cannot also enter invoices or release payments. Remove access for anyone who doesn't need it.
Run a monthly report of every new supplier and every changed field, especially bank details, and have someone independent review it against the supporting evidence. Repeat the full cleanup once a year.
Terminology: UK teams usually say "supplier master" or "purchase ledger"; US teams say "vendor master".
US: keep a current Form W-9 for each vendor and flag those that need a 1099 at year end. UK: record VAT numbers for VAT-registered suppliers and check them with HMRC's online checker.
Paste your invoice list and see likely duplicates in minutes. Free Excel file: enter your work email to download it.
The Accounts Payable Control System runs four duplicate-invoice tests, supplier master fraud checks and a three-way match on every invoice, with a payment run release gate that blocks release while exceptions are open. Excel, no macros, one-time price.
No. Block them for payment instead, so their transaction history stays available for audits and queries.
A full cleanup once a year, plus a monthly review of new suppliers and changes. The monthly review is what stops it getting messy again.
A small group, separate from invoice entry and payment release, and only after independent verification of the change.
Every new supplier and every changed field in the period, with the old value, the new value, who changed it and when. Bank detail changes should be listed first and checked against the verification evidence.
Last updated 18 October 2026. General guidance for finance teams; check it against your own policies, systems and local rules.