Vendor Fraud

A business may pay hundreds of suppliers each month, and fraud can enter when someone creates a fake vendor, inflates an invoice or changes payment details. It may involve an outsider, an employee or collusion, so controls should protect legitimate suppliers as well as the company's money.

The Association of Certified Fraud Examiners discusses shell-company patterns in vendor data and US Bank explains business-email-compromise tactics affecting payments; these are examples of risks, not a basis to accuse any particular vendor, so investigate evidence and preserve records before drawing conclusions. A fictitious vendor can be created with plausible details and invoices for services never delivered, and a staff member with authority over both vendor setup and payment approval has a dangerous concentration of duties.

Check legal identity, tax details, contact and beneficial-owner signals under a risk-based process. An existing vendor's details can also be changed fraudulently, as when a message claiming a new bank account comes from a compromised email thread, so verify the request using an independently known contact, not only the number in that message, and keep original and revised records with who approved the change.

False invoices may duplicate a genuine bill, alter quantity or bill for work not completed, so match invoices with purchase orders and receipt evidence where appropriate. For services, require a manager who knows the work to confirm delivery, because a technically valid PDF is not proof that work occurred.

Kickbacks can distort supplier selection when a buyer steers contracts to a favoured vendor in exchange for a benefit, so look at unusual pricing, repeated exceptions and relationships, avoid treating a friendship alone as proof of wrongdoing, and use conflict declarations and competitive review to reduce risk. Controls need separation, since one person should not create a vendor, approve its invoices and release bank payments without oversight.

Small firms can use owner review and independent bank reconciliation when staffing is limited, but two usernames controlled by one employee do not create dual control. Data tests can reveal patterns such as suppliers sharing addresses with employees, repeated invoice numbers or payments just below an approval limit; such matches generate leads, not verdicts, and shared office buildings and legitimate recurring charges can create false positives, so review supporting facts before escalation.

Bank changes deserve heightened review even when the invoice is familiar, because a real vendor can have its email compromised. Confirm the full beneficiary name and account using a verified route, since a rushed deadline is a reason to strengthen verification, not skip it.

If a payment is diverted, contact the bank's fraud team immediately to seek recall or trace options, preserve the original message, headers, invoice and approval trail, and report through appropriate authorities and insurer channels as advised, remembering that a recall may fail and recovery should not be promised. The vendor onboarding process should be usable, because if it takes weeks to add an ordinary supplier staff may create workarounds, so balance checks with a clear emergency route and later review.

For illustration, a company reviews 1,000 supplier payments and flags 20 for independent checks: a 2% exception rate describes review workload, not 20 frauds or the safety of the other 980, so track confirmed errors and losses separately. Train staff to recognise unexpected urgency, bank changes and mismatched domains and to pause a suspicious payment without blame, and manage vendor fraud through accurate vendor records, independent checks and careful payment approval, moving quickly on suspected diversion while keeping legitimate buying practical.