The rise of electronic payments, coupled with advancements in technology—particularly artificial intelligence (AI) and deepfakes—has significantly amplified the risk of vendor payment fraud. Business email compromise (BEC) and vendor email compromise (VEC) are now regular threats. Fraudsters employ increasingly sophisticated tactics to deceive companies into making or misdirecting payments to criminal accounts.
While training employees and fostering a culture of fraud awareness are essential, they are insufficient to combat these evolving risks. To effectively mitigate vendor payment fraud, organizations must implement a secure vendor onboarding process. Critically, the processes must include a consistent and reliable bank account verification system. Automation, secure vendor portals, and third-party verification services play a pivotal role in strengthening risk defenses.
The Growing Threat of Vendor Payment Fraud
Vendor payment fraud has evolved rapidly, driven by the shift to electronic payments and the exploitation of new technologies. Fraudsters now leverage AI and deepfakes to create highly convincing impersonations of vendors or company executives, making it easier to deceive employees into approving fraudulent transactions. Here are two prominent examples of these threats:
Business Email Compromise (BEC): Criminals hack or spoof executive email accounts to send urgent payment requests to finance teams, often bypassing normal approval processes. In one case a company paid $2.46 million to a fraudulent account after receiving a seemingly legitimate invoice from one of its vendors via email.
Vendor Email Compromise (VEC): In this subset of BEC, fraudsters compromise a vendor’s email account and monitor email communications, observing the pace and tone of communications. Then they step in and send instructions or invoices with altered bank details.
These tactics are not only costly but also difficult to detect without proper controls. As AI and deepfake technologies become more accessible, fraudsters can create realistic audio and video impersonations, further blurring the line between legitimate and fraudulent communications.
Why Training and Awareness Are Not Enough
While it is crucial to educate employees about BEC and VEC, and to foster fraud awareness, it is insufficient. Human error remains a weak link, and even well-trained staff can fall victim to highly convincing scams. For instance, a finance employee might receive what appears to be a legitimate email from a vendor requesting a change in bank details. Without a robust verification process, the employee may process the request, leading to a fraudulent payment.
Moreover, fraudsters often exploit time-sensitive situations, such as end-of-month payment deadlines, to pressure employees into bypassing standard procedures. This underscores the need for a control process that goes beyond awareness and incorporates systematic checks and balances.
The Need for a Secure Vendor Onboarding Process
A secure vendor onboarding process is the first line of defense against payment fraud. This process should include thorough vendor verification and, for consistency and efficiency, automation.
Before onboarding a new vendor, companies must verify key details such as tax identification numbers (TINs), business registration documents and sanctions checks. This ensures the vendor is legitimate and not on any watchlists.
Manual verification is prone to errors and inconsistencies. Automating the onboarding process ensures that every vendor undergoes the same rigorous checks, reducing the risk of oversight. For example, a company using an automated onboarding system can instantly cross-reference vendor information against global sanctions lists and validate tax IDs, flagging any discrepancies for further review.
The Critical Role of Bank Account Verification
Even with a secure onboarding process, the risk of payment fraud persists when bank account details are not properly verified. Fraudsters often target this vulnerability by submitting fake invoices or requesting changes to banking information. To mitigate this risk companies must have a standardized process for verifying bank account details, both during onboarding and whenever account changes are requested. This should include direct confirmation with the vendor through a trusted communication channel.
Leveraging third-party services that specialize in bank account verification adds an extra layer of security. These services confirm the authenticity of bank details, verifying account owner, number and routing number.
Companies must also implement strict protocols for urgent payments. When the company CEO or CFO contacts an accounts payable specialist directly, coimpanies must have a process for confirmation. And that process must not circumvent bank account verification.
Criminals are adept at “social engineering” using effective emotional manipulation techniques. Technology has enabled very persuasive imitation of vendors and of company officers. Training and awareness are insufficient in the face of such sophisticated threats. Bank account verification must be a required part of a company’s process in making electronic payments, and should be simplified to ensure it occurs.
The Value of Automation and Secure Vendor Portals
Automation and secure vendor portals are essential tools in the fight against payment fraud.
Automation: Automating vendor verifications—such as tax ID checks, sanctions screening and bank account validation—ensures consistency and reduces the risk of human error. Automation also allows for real-time monitoring, alerting companies to any changes in vendor information that may indicate fraud.
Secure Vendor Portals: A secure portal provides a centralized platform for vendors to submit and update their information. This ensures that all data is stored securely and accessed only by authorized personnel. Additionally, portals can enforce multi-factor authentication and encrypt sensitive data, further reducing the risk of compromise.
For instance, a company using a secure vendor portal can require vendors to upload documents and confirm bank details through a verified login, minimizing the chances of fraudulent submissions.
Leveraging Reliable Vendor Portal Services
To maximize protection, companies should consider using a reliable vendor portal service that automatically handles verifications. These services offer:
Automatic Tax ID and Sanctions Checks: Continuous monitoring ensures that vendors remain compliant with regulatory requirements and are not added to sanctions lists after onboarding.
Bank Account Verifications: Automated services can verify bank account ownership and flag any discrepancies, such as mismatched account names or suspicious transaction histories.
By integrating these services, companies can offload the burden of manual checks and ensure that verifications are conducted consistently and accurately.
Conclusion
Vendor payment fraud, fueled by electronic payments, AI and deepfakes, poses a growing threat to businesses. While training and fraud awareness are important, they must be complemented by a secure vendor onboarding process and a reliable bank account verification system. Automation, secure vendor portals and third-party verification services are critical components of a robust control process. By implementing these measures, companies can significantly reduce the risk of fraudulent payments and protect their financial assets from increasingly sophisticated criminals.
To learn more about how to protect your payments against fraud, contact us.