Questions
Payment fraud questions, answered
Answers to the questions finance teams ask about payment fraud, verification and payment controls, each linked to the research behind it.
Payment operations
Call the vendor back on a number you already had, never one from the request. Then confirm the new account belongs to them, have a second person approve the change, and review the first payment before it goes out.
From: How to Verify a Vendor Bank Detail Change: A US Checklist
It confirms the request is real, but not that the account belongs to your vendor. A callback plus <a href="https://getcoffr.com/blog/research-and-data/what-is-bank-account-ownership-verification">ownership verification</a> covers both.
From: How to Verify a Vendor Bank Detail Change: A US Checklist
No. If the vendor's inbox is hacked, the email comes from their real address. Treat every emailed change as unconfirmed until you've called back.
From: How to Verify a Vendor Bank Detail Change: A US Checklist
No. Nacha requires risk-based procedures to catch payments made under false pretenses, and it leaves the method to you. A callback is a common, low-cost way to help meet that expectation.
From: How to Verify a Vendor Bank Detail Change: A US Checklist
Someone other than the person who took the request, and never anyone who can also release payments.
From: How to Verify a Vendor Bank Detail Change: A US Checklist
Usually a day or two at most. A callback takes a few minutes. Instant account verification takes seconds; micro-deposits take one to two business days. Hold payments to that vendor until it's done.
From: How to Verify a Vendor Bank Detail Change: A US Checklist
Mostly, yes. Payment diversion fraud describes the outcome: a payment sent to the wrong account. Business email compromise describes the method: impersonation by email. Most payment diversion fraud starts with BEC.
Sometimes, if you act fast. Call your bank to request a recall and report to ic3.gov right away. The FBI's Recovery Asset Team froze 58% of the funds it was asked to stop in 2025, and the FBI stresses that time is of the essence ([FBI IC3 2025 Internet Crime Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)).
Any business that pays suppliers by wire or ACH. Accounts payable, treasury and payroll teams are the main targets because they can change bank details and release payments.
Call the vendor on a number you already have, never one from the request. Then confirm the new account is actually owned by the vendor, and have a second person approve the change.
No. A callback confirms the vendor made the request. It does not confirm the account belongs to them, and if the vendor's own email was hacked, the details they give may already be the criminal's. Verifying account ownership closes that gap.
Research and data
Usually not. If your own employee approved and sent the payment, UCC Article 4A treats it as your authorized order, even if a fraudster tricked them. Bank refund rights are aimed at payments you never authorized.
From: Who Pays When a Vendor Payment Is Diverted? US Liability Explained
Sometimes, if you act within hours. Call your bank right away and ask it to contact the receiving bank to freeze the funds, then file a report with the FBI's IC3. Once the money has been moved out, recovery gets much less likely.
From: Who Pays When a Vendor Payment Is Diverted? US Liability Explained
Not as a right. Nacha reversals are limited to specific errors and a five banking day window, and they fail if the money has already left the account. Your bank can also ask the receiving bank to return the money, but that bank isn't required to.
From: Who Pays When a Vendor Payment Is Diverted? US Liability Explained
No. Regulation E only covers accounts set up mainly for personal, family or household use. Business accounts rely on the bank agreement and UCC Article 4A instead.
From: Who Pays When a Vendor Payment Is Diverted? US Liability Explained
It depends on your contract and state law. Courts often ask which side was in the best position to prevent the fraud and may split the loss by comparative fault, as in Beau Townsend Ford v. Don Hinds Ford.
From: Who Pays When a Vendor Payment Is Diverted? US Liability Explained
Only if your policy covers social engineering or funds transfer fraud, and many policies have sublimits and callback conditions. Check with your broker before you need it.
From: Who Pays When a Vendor Payment Is Diverted? US Liability Explained
Right away. Call your bank the moment you spot it and ask it to recall the funds, then file a complaint at ic3.gov with the full transaction details. The FBI's Recovery Asset Team froze $679 million in 2025, but it can only act while the money is still in the account.
From: Who Pays When a Vendor Payment Is Diverted? US Liability Explained
It depends on what you need. If you want one platform to run invoices and payments, an AP platform such as Tipalti, BILL, AvidXchange, Ramp or Stampli includes some verification. If you need to prove a vendor owns a bank account before you trust it, whatever you pay from, a dedicated tool such as Coffr is built for that one job.
Some publish more than others. Tipalti publishes IRS TIN matching, sanctions screening and review flows for payee changes. BILL, AvidXchange, Ramp and Stampli don't publish how they confirm who owns a bank account, so ask for a demo of that step.
If you want another AP platform, BILL, AvidXchange, Ramp and Stampli all include some vendor checks. If you want to keep your AP tool and add stronger bank detail verification, a dedicated tool such as Coffr works alongside it.
No. Vendor management software stores vendor records, documents and approvals. A verification tool checks that the bank details and the people behind them are real. Some platforms do both.
Published prices range from free plans to about $99 a month to start, plus per-user or per-transaction fees. AvidXchange and Stampli price by quote.
Yes. Call the vendor back on a number you already had, have a second person approve every bank change, and keep a log. Our [vendor bank detail change checklist](https://getcoffr.com/blog/payment-operations/verify-vendor-bank-detail-change) walks through it. Software makes it faster and adds proof of account ownership.
Vendor data is any information you hold about a supplier: who they are, their tax ID, how to reach them, what you've bought from them and how you pay them. Vendor master data is the core part of it, the record your payment system reads to decide who gets paid and where.
Only people with specific rights to the bank fields, and never anyone who can also release payments. Each change needs a second person to approve it before it's saved.
Hold the first payment to the new account for review, and tell the vendor about the change through a contact you already had on file. If they didn't ask for it, you've caught the fraud before the money left.
Review the change log monthly, clean up inactive and duplicate vendors quarterly, and check vendor records against employee records at least once a year.
No. A W-9 gives you the vendor's tax ID, but it doesn't prove who owns the bank account they give you. Verify the account before it goes into the vendor file.
Segregation of duties, controlled changes to vendor master data, verification of bank detail changes, approval limits, three-way match, duplicate checks, bank reconciliation and regular review of access and the vendor file.
From: Accounts Payable Internal Controls: A Checklist for AP Teams
Split the one job that matters most: whoever changes vendor bank details should not release payments. Where you can't split further, add review. COSO says that when segregation of duties "is not practical, management selects and develops alternative control activities" (COSO), such as an owner approving payments or an outside accountant reviewing the vendor file.
From: Accounts Payable Internal Controls: A Checklist for AP Teams
As few people as possible, and never anyone who can also release payments. Every change should be verified with the vendor and approved by a second person.
From: Accounts Payable Internal Controls: A Checklist for AP Teams
Test vendor changes and access quarterly, review the vendor change report monthly, and do a full review of policies and approval limits at least once a year or after any fraud attempt.
From: Accounts Payable Internal Controls: A Checklist for AP Teams
Evidence. They want to see that duties are separated, that system access matches job roles, that vendor changes were verified and approved, and that each control was performed as written. A control with no record behind it is treated as a control that didn't happen.
From: Accounts Payable Internal Controls: A Checklist for AP Teams
It depends on the pricing model. Some charge per verification, some per vendor, and some a flat monthly subscription. API pricing is often usage-based. Compare the cost against a single diverted payment, which can run into six figures.
From: Bank Account Verification Service: How It Works and How to Choose One
Yes. With bank login, the account holder signs in to their bank and the account is confirmed in seconds. If they can't connect, micro-deposits take one to two business days.
From: Bank Account Verification Service: How It Works and How to Choose One
Account validation confirms the account is open and can accept ACH payments. That's Nacha's minimum standard for online debits (Nacha). Ownership verification confirms the account belongs to the person or business you're paying. Only ownership stops a criminal who sends you their own valid account.
From: Bank Account Verification Service: How It Works and How to Choose One
It takes developer time to integrate, test and maintain. If you don't have developers, a verification tool with shareable links does the same checks with no code.
From: Bank Account Verification Service: How It Works and How to Choose One
It does when you verify every change, not just new vendors. If a request to change bank details can't pass ownership verification, don't update the vendor file or release the payment.
From: Bank Account Verification Service: How It Works and How to Choose One
Compare it to what you already have. Check that the vendor is in your system, the bank details match your vendor file, the sender's email domain is exact, and there's a purchase order and receipt behind it. If the bank details are new or anything feels rushed, call the vendor on a number you already had before paying.
From: Accounts Payable Fraud: Vendor Fraud, Invoice Fraud and Invoice Scams
From outside, it's email-driven schemes: fake invoices and vendor impersonation asking for new bank details. From inside, corruption such as kickbacks was the most common occupational fraud scheme in the United States and Canada, at 33% of cases (ACFE, p. 96).
From: Accounts Payable Fraud: Vendor Fraud, Invoice Fraud and Invoice Scams
Yes. If a criminal gets into your vendor's inbox, the fake invoice comes from the right address, often in an existing thread. That's why matching the sender isn't enough. Verify any bank change by phone on a number you already had.
From: Accounts Payable Fraud: Vendor Fraud, Invoice Fraud and Invoice Scams
The controller or CFO usually owns the controls, but everyone in the payment chain plays a part: whoever sets up vendors, whoever approves invoices and whoever releases payments. Treasury often spots it first. In the AFP's 2026 survey, treasury was the department most likely to discover attempted fraud, at 83% (AFP).
From: Accounts Payable Fraud: Vendor Fraud, Invoice Fraud and Invoice Scams
Yes. File a complaint at ic3.gov as soon as possible, ideally the same day, and call your bank first. Reporting fast gives the FBI and your bank the best chance to freeze the funds.
From: Accounts Payable Fraud: Vendor Fraud, Invoice Fraud and Invoice Scams
Sometimes. Nacha allows a reversal within 5 banking days, but only for errors: a duplicate payment, the wrong receiver, the wrong amount or the wrong date. Fraud isn't one of those reasons. For fraud, your bank can ask the receiving bank to return the money, but the receiving bank doesn't have to agree (Nacha).
For unauthorized debits, business accounts generally have a short window of about 2 banking days, while consumer accounts have up to 60 days (Nacha, Originator Essentials). Your bank agreement may set its own deadlines, so check it and reconcile daily.
Neither is safe from fraud. ACH has a few more ways to fix mistakes, but a fraudulent ACH payment you sent can be just as hard to recover as a wire. The protection is verifying the account before you pay, not the payment rail.
Usually the business, when its own staff sent the payment. Consumer protections under Regulation E apply only to personal accounts (CFPB). For business accounts, if the bank followed an agreed, commercially reasonable security procedure in good faith, the payment is generally treated as the customer's own order, even if it wasn't authorized (UCC 4A-202). This isn't legal advice; check your bank agreement with counsel.
They can try, by setting up unauthorized ACH debits from your account. Ask your bank about ACH debit blocks or filters, and review your account daily so you can return unauthorized debits within the window.
At minimum a signed W-9, the vendor's legal name and address, contact details and verified bank details. Some contractors also need insurance certificates or licenses.
From: Vendor Onboarding Checklist: 9 Steps for AP Teams (2026)
Ideally not. Email is easy to fake or take over, and business email compromise affected 74% of US organizations in 2025. If you have a secure portal or verification tool, use it. If you don't, treat emailed bank details as unverified until you confirm them by phone on a number you found yourself.
From: Vendor Onboarding Checklist: 9 Steps for AP Teams (2026)
Confirm the business is registered, match its legal name and EIN against IRS records, verify your contact by calling a number you found yourself, and confirm the bank account belongs to the vendor.
From: Vendor Onboarding Checklist: 9 Steps for AP Teams (2026)
Onboarding is the one-time setup of a new vendor. Vendor management is everything after: performance, contracts, renewals and keeping details current.
From: Vendor Onboarding Checklist: 9 Steps for AP Teams (2026)
At least once a year, and every time a vendor changes its bank details, address or contacts.
From: Vendor Onboarding Checklist: 9 Steps for AP Teams (2026)
A vendor setup form, or vendor information form, collects a new vendor's legal name, tax ID, address, contacts and payment terms. Keep bank details off the form and collect them separately: through a secure channel if you have one, or confirmed by callback to a known number if not.
From: Vendor Onboarding Checklist: 9 Steps for AP Teams (2026)
Not always. A small team can run this checklist by hand. As volume grows, vendor onboarding software or a verification tool saves time and takes email out of the process, which closes the easiest way for fake bank details to get in.
From: Vendor Onboarding Checklist: 9 Steps for AP Teams (2026)
Collect the details through a secure channel, confirm the account is open, then match the account holder's name to the vendor's legal name. Confirm any bank detail change by calling a phone number already on file.
From: Proof of Bank Account Ownership: How Verification Works
Use an ownership match based on data from the receiving bank, or have the vendor sign in to their own bank. A voided check or emailed letter can be forged, and micro-deposits prove access to the account, not the owner's legal name.
From: Proof of Bank Account Ownership: How Verification Works
Most use a verification service that returns an ownership match on the account holder's name.
From: Proof of Bank Account Ownership: How Verification Works
No. Validation confirms the account exists, and ownership verification confirms it belongs to the payee you mean to pay.
From: Proof of Bank Account Ownership: How Verification Works
Before the first payment, and again every time the vendor's bank details change.
From: Proof of Bank Account Ownership: How Verification Works
Hold the payment and contact the vendor through a known channel. A mismatch can be fraud, or a legitimate trading name or subsidiary account.
From: Proof of Bank Account Ownership: How Verification Works
It takes retyping out of the process. A bank login pulls the numbers directly from the bank, and a micro-deposit can only be confirmed if the numbers entered reach the right account. Either way, a typo can't pass verification.
From: Proof of Bank Account Ownership: How Verification Works
Definitions
Phishing usually harvests credentials or delivers malware to a broad list. Business email compromise targets a specific payment relationship and often uses a genuine mailbox, so there is no malicious link or attachment to detect.
Rarely. A domestic wire is final once settled, so recovery depends on the receiving bank freezing funds before they are withdrawn or moved onward. Speed of reporting matters more than anything else.
Accounts payable staff, controllers, and anyone who can change vendor master data. Attackers also impersonate executives to pressure a single approver into bypassing normal steps.
An emailed request to update remittance details on an existing supplier record, usually justified by a bank change and often arriving from a genuine or near identical domain.
Treat a bank detail change as a privileged change: verify out of band against a number already on file, require a second approver, and hold the first payment for a short review window.
It removes the simplest path, password reuse, but token theft, consent phishing, and help desk social engineering all produce authenticated sessions without a password prompt.
From: Account takeover
Unexplained inbox rules, especially rules that move or delete messages containing words such as invoice, payment, or remittance.
From: Account takeover
Yes. It remains one of the most frequently reported payment fraud types affecting organizations, largely because checks expose account credentials in physical form.
From: Check fraud
Positive pay with payee name verification, combined with moving high value disbursements off paper entirely.
From: Check fraud
Usually not for business payments. Commercial funds transfers are governed largely by UCC Article 4A, which turns on the agreed security procedure rather than on the fact that a scam occurred.
Card networks carry built in dispute rights and issuer liability, while push payments settle to the beneficiary account with no equivalent chargeback path.
Not unilaterally. Once settled, the funds belong to the beneficiary, so recovery depends on the receiving bank voluntarily freezing or returning them before they are moved.
From: Wire transfer
Hours, in practice. Reporting immediately to the originating bank and to the FBI IC3 gives the best chance of a freeze at the receiving institution.
From: Wire transfer
Usually the business. Under UCC Article 4A a payment order the customer authorised, or one accepted under an agreed commercially reasonable security procedure, generally remains the customer's loss, and Regulation E consumer protections do not apply to business wires.
From: Wire transfer
A wire settles individually and with finality, usually the same day. ACH settles in batches and has defined return windows, so an ACH credit has limited return paths that a wire does not.
From: Wire transfer
Call the originating bank and ask for a recall to the receiving institution, file with the FBI IC3 so the Recovery Asset Team can engage, preserve the original instruction and mail headers, and check whether other pending payments used the same account details.
From: Wire transfer
Only in limited circumstances defined by the Nacha rules, such as duplicate or erroneous entries, and within short windows. Fraudulently redirected business credits are not automatically returnable.
From: ACH
Standard entries settle in one to two business days, and same day ACH settles within defined processing windows on the same business day.
From: ACH
They are separate networks with the same shape: RTP is operated by The Clearing House, FedNow by the Federal Reserve. Both settle instantly and both are credit push only.
From: RTP and FedNow
No. Both networks settle with finality, so a returned payment requires the receiver to send funds back voluntarily.
From: RTP and FedNow
Only a number obtained independently of the request, such as one already stored in the vendor master record or published on the supplier's official site.
From: Callback verification
Partially. It still defeats email only attacks, but it should be paired with a shared secret or with verification of the account itself rather than the speaker.
From: Callback verification
No. A reply travels the same channel as the request, so a compromised mailbox can answer it.
From: Out of band verification
One that does not depend on the same credentials or identity provider as the original channel, such as a phone call to a previously stored number.
From: Out of band verification
Only when the number came from your own records rather than from the request, and when the number itself is protected against porting or device takeover.
From: Out of band verification
It holds up when the confirmation depends on information the counterparty holds, such as a stored reference or a validated account, rather than on recognising the speaker.
From: Out of band verification
No. Positive pay confirms that a payment matches the issue file, and in a redirection attack the fraudulent account details are already in that file.
From: Positive pay
Positive pay compares items against an issue file sent by the company. Reverse positive pay puts the review burden on the company, which examines presented items each day and decides what to return.
From: Positive pay
Only if the method returns an ownership match. Status only checks confirm the account is open, which does not tell you who controls it.
From: Bank account validation
Typically one to two business days, which is why many organizations pair them with a faster network based check for time sensitive onboarding.
From: Bank account validation
Before first payment and again at every change to bank details, because the change request is the event attackers actually use.
From: Bank account validation
It means the name presented does not match the name associated with the account. That can indicate fraud, or a legitimate difference such as a trading name or a subsidiary, so it should stop the payment and start a check rather than be dismissed.
From: Bank account validation
No. A callback verifies a person, account validation verifies the destination. The two answer different questions and the strongest processes use both.
From: Bank account validation
A role separate from anyone who can approve or release payments, with every change logged and independently verified before it takes effect.
From: Vendor master data
Hold the first payment on the new details for review and notify the supplier through a previously known contact that a change was made.
From: Vendor master data
Split the highest risk pair first, changing bank details and releasing payments, and use the bank's own approval tiers to enforce a second approver even when only two people are available.
From: Segregation of duties
Dual approval is one implementation of it. Segregation of duties also covers who can create records and who can execute, not only who signs off.
From: Segregation of duties
Changing a vendor's bank details and releasing payments to that vendor. When one person holds both, a single deception completes the whole fraud.
From: Segregation of duties
Define the exception path in advance with a named alternate approver, require the same verification evidence, and log each use so exceptions can be reviewed rather than repeated quietly.
From: Segregation of duties
On a fixed schedule and again after every role change, because separated duties on paper are frequently rejoined by leftover access in the banking portal or the accounting system.
From: Segregation of duties
Not directly. It allocates the loss, and the allocation usually favors the bank when a commercially reasonable agreed security procedure was followed.
From: UCC Article 4A
It is assessed against the customer's circumstances, including the size and frequency of payments and the alternatives the bank offered, so it varies by relationship rather than being a fixed checklist.
From: UCC Article 4A
No. It applies to consumer asset accounts, so commercial payments fall under the deposit agreement and UCC Article 4A.
From: Regulation E
Its core protections address unauthorized transfers, and authorized but induced payments have been the subject of continuing regulatory attention rather than settled coverage.
From: Regulation E
No. Filing is an obligation of financial institutions. A defrauded business reports to its bank and to the FBI IC3.
It is one of the few sources describing incident mechanics at national scale, and FinCEN publishes trend analyses derived from it.
No. The law prohibits an institution from disclosing the existence of a filing to the subject of the report, so the absence of confirmation says nothing about whether one was filed.
Not directly. Recovery depends on the receiving institution freezing funds, usually through the originating bank and the FBI IC3, and it runs on a separate and much shorter clock than the reporting obligation.
The payment references, the beneficiary account and routing numbers, the amount and settlement date, the channel the instruction arrived through, and who acted on it.
Immediately. Recovery depends on reaching the receiving bank before funds are withdrawn, so the useful window is hours rather than days.
From: Recovery Asset Team
The transaction details, the originating and receiving bank information, the account numbers involved, the amount, and the date, filed through the IC3 portal alongside a call to your own bank.
From: Recovery Asset Team
Blockchain is one way to build one. An immutable ledger can also be a single append-only database secured with hash chaining. Blockchain adds distribution, holding copies across multiple parties so no single participant can rewrite the record.
From: Immutable ledger
Yes, by appending a new correcting entry. The original entry is never removed, so the complete history, including the mistake and its correction, stays visible.
From: Immutable ledger
It preserves the evidence of which bank details were verified, when, and by whom. When a fraudster submits changed account details, the ledger shows the verified record, so the change cannot masquerade as long standing information.
From: Immutable ledger
No. Entries cannot be changed after they are written. Whether an entry is true depends on the verification performed before it was recorded.
From: Immutable ledger