Business Email Compromise: Why Accounts Payable Is the Last Line of Defense Against Vendor Payment Fraud
How Strong Authentication, Vendor Validation, and Internal Controls Can Prevent Fraudulent Payments
John C. Blackshire, Jr. Corporate Compliance Seminars (CCS) | Fraud Prevention, Accounts Payable, and Internal Controls
An Accounts Payable employee receives an urgent email from a familiar vendor requesting a change to the bank account used for electronic payments.
The message appears legitimate. It includes the vendor's name, familiar invoice references, and a convincing explanation for the change.
The employee updates the vendor master file, and the next payment is transmitted to the new account.
Several days later, the real vendor contacts the organization to ask why its invoice remains unpaid.
The payment was sent to a fraudster.
This is one of the most dangerous forms of Business Email Compromise (BEC), and it demonstrates why Accounts Payable has become a critical control point in organizational fraud prevention.
BEC fraud does not always require sophisticated malware or unauthorized access to an accounting system. Sometimes, the attacker only needs to persuade an employee to make a seemingly routine change to vendor payment information.
The challenge is becoming more complex as criminals use compromised email accounts, impersonation, social engineering, and artificial intelligence to make fraudulent communications more convincing.
Organizations must therefore recognize an important principle: An email requesting a change to vendor banking information is not evidence that the request is authentic.
Corporate Compliance Seminars offers a specialized two-CPE training program, Business Email Compromise (BEC) Accounts Payable, focused on strengthening the controls that protect vendor payments.
1. What Is Business Email Compromise?
Business Email Compromise is a form of fraud in which criminals use deceptive electronic communications to induce an organization to transfer money, disclose sensitive information, or change financial records.
The attacker may impersonate a vendor, executive, employee, or trusted business partner.
In an Accounts Payable environment, a common objective is to redirect legitimate vendor payments to a bank account controlled by the criminal.
BEC attacks may involve:
Spoofed email addresses that resemble legitimate vendor domains.
Compromised vendor email accounts.
Fraudulent invoices containing altered remittance instructions.
Requests to change vendor banking information.
Impersonation of senior executives.
Urgent instructions designed to bypass normal approval procedures.
AI-generated messages that imitate the writing style of legitimate business contacts.
The financial loss may not become apparent until the legitimate vendor reports that payment has not been received.
By then, recovery can be difficult.
2. Why Accounts Payable Is a Primary Target
Accounts Payable is responsible for processing large volumes of legitimate financial transactions.
Employees routinely communicate with vendors, receive invoices, update vendor information, and prepare payments.
These activities create opportunities for criminals to insert fraudulent instructions into normal business workflows.
Consider an organization processing $100 million in vendor payments annually.
A single fraudulent change involving a major supplier could redirect hundreds of thousands of dollars.
The criminal does not necessarily need to compromise the organization's banking system.
The attacker may simply persuade an authorized employee to change the destination of a legitimate payment.
This makes the vendor master file one of the most important assets in the payment process.
If a fraudster can control the banking information in the vendor master file, the organization may process an otherwise properly authorized payment to the wrong recipient.
3. The Problem With Trusting Email
Email is an efficient business communication tool, but it should not be treated as a reliable method of authenticating sensitive payment instructions.
A message can appear to originate from a legitimate vendor while actually being fraudulent.
Even the presence of an established email address does not guarantee authenticity because the vendor's account may have been compromised.
Criminals may also copy legitimate email signatures, use information from previous correspondence, and reference real invoices.
These details can make fraudulent requests difficult to distinguish from legitimate business communications.
Organizations should therefore establish a control principle:
A request received through email must be independently authenticated before sensitive vendor banking information is changed.
This applies even when the request appears to come from a familiar vendor.
4. Why a Confirmation Call May Not Be Enough
Many organizations believe they are protected because employees call vendors to confirm banking changes.
However, the effectiveness of that control depends on how the telephone number is obtained.
Suppose a fraudulent email contains the following instruction: "Please call our new Accounts Receivable Manager at the number below to confirm the banking change."
If the employee calls that number, the employee may be speaking directly with the fraudster.
The organization has completed a confirmation call without independently authenticating the request.
A stronger procedure requires employees to obtain contact information from a previously established, trusted source.
Examples include verified vendor master records, independently validated onboarding documentation, or an established contact confirmed through a separate trusted channel.
The employee should not rely solely on contact information supplied in the change request.
This distinction is critical.
A confirmation call is not an effective authentication control when the fraudster controls the telephone number being called.
5. Authentication, Validation, and Approval Are Different Controls
Organizations sometimes use the terms authentication, validation, and approval interchangeably.
They serve different purposes.
Control | Question answered |
Authentication | Is the person requesting the change genuinely authorized to represent the vendor? |
Validation | Is the vendor and its submitted information accurate, legitimate, and consistent? |
Approval | Has an authorized employee reviewed and approved the proposed change? |
All three can be necessary.
A supervisor may approve a change that was never properly authenticated.
A legitimate vendor may submit incomplete or incorrect banking information.
An employee may correctly authenticate the request but lack authority to make the change.
A strong process addresses these risks separately.
6. Six Practical Steps to Protect Vendor Banking Changes
Organizations should establish a risk-based process for handling requests to change vendor remittance information.
The following six-step approach illustrates how controls can work together.
Step 1: Capture and document the request
Record the original request, vendor identity, proposed changes, date received, and employee handling the transaction. Do not immediately update the vendor master file.
Step 2: Independently authenticate the requester
Contact a previously verified vendor representative using trusted contact information that was not obtained from the change request. Document the authentication process and its outcome.
Step 3: Validate the banking information
Review the submitted banking information for completeness, consistency, and relevant warning signs. Where available and appropriate, use independent banking or account-verification services. Remember that validation of an account's format or existence does not necessarily establish that the account belongs to the intended vendor.
Step 4: Require independent approval
Have an authorized employee who did not initiate the change review the evidence and approve the modification. Apply segregation of duties appropriate to the organization's risk and staffing.
Step 5: Notify the established vendor contact
Send confirmation of the change through a previously established and trusted communication channel. Unexpected changes or disputes should trigger further review.
Step 6: Review payments before release
Establish an additional control to identify payments associated with recent or high-risk vendor banking changes before the payment file is transmitted. This final step can provide an important opportunity to detect fraudulent changes before funds leave the organization.
The appropriate procedures will depend on the organization's systems, payment methods, transaction values, and risk profile.
7. The Critical Control: Review Payments Before the Bank File Is Released
One of the most valuable controls is a review of payments associated with recently changed vendor banking information.
Consider a vendor whose bank account was modified two days before a $350,000 electronic payment.
Even if the change was approved, the payment may warrant additional scrutiny because of its value and proximity to the modification.
A payment-release control can identify transactions involving recent bank changes, unusual amounts, or other risk indicators.
Management can then require additional verification before releasing the payment.
This is particularly important because a fraudulent banking change may otherwise remain undetected until after the payment has been transmitted.
A strong Accounts Payable process should not rely exclusively on controls performed when the vendor master file is updated.
It should also consider the risks present at the point of payment.
8. Artificial Intelligence Is Making BEC More Convincing
Artificial intelligence can make fraudulent communications more realistic and easier to produce.
Criminals can use AI to generate persuasive emails, imitate professional writing styles, translate communications, and create convincing supporting documents.
AI-enabled voice impersonation can also complicate telephone verification.
An employee may believe they are speaking with a familiar executive or vendor representative when the voice is artificially generated.
These developments reinforce the need for authentication processes that do not depend solely on recognizing a voice, email address, or writing style.
Organizations should use established verification channels, documented approval requirements, and independent evidence.
AI can also support fraud prevention by helping identify unusual payment patterns, duplicate banking information, and changes inconsistent with historical vendor activity.
However, AI-generated alerts require appropriate validation and human review.
The objective is not to make employees better at guessing whether an email is fraudulent. It is to establish controls that do not depend on guessing.
9. Warning Signs of Potential BEC Fraud
Accounts Payable employees should be trained to recognize indicators that warrant additional investigation.
Common warning signs include:
Unexpected requests to change banking information.
Urgent instructions to process payments immediately.
Requests to bypass established verification procedures.
Changes submitted shortly before large payments.
Banking instructions inconsistent with prior vendor information.
Requests involving unfamiliar contacts.
Unusual changes in communication patterns.
Requests to keep payment changes confidential.
Vendor banking accounts shared with unrelated vendors.
Pressure from someone claiming to be a senior executive.
No single warning sign proves fraud.
However, these conditions should prompt employees to follow established verification procedures rather than make exceptions.
10. Management Owns the BEC Internal Control Framework
Under the COSO Internal Control–Integrated Framework and the IIA Three Lines Model, management is responsible for establishing and maintaining effective internal controls.
Accounts Payable management should design and operate the procedures used to authenticate vendors, validate banking changes, approve modifications, and release payments.
Information Technology and Information Security personnel may provide important support concerning email security, identity management, access controls, and incident response.
Compliance and risk management personnel may provide additional oversight and specialized expertise.
Internal Audit should independently evaluate whether the resulting control framework is appropriately designed and operating effectively.
The auditor should not become responsible for operating the vendor change process.
If Internal Audit identifies a weakness, management should develop and own the corrective action plan.
This separation preserves accountability and internal audit objectivity.
11. What Should Internal Auditors Test?
An internal audit of BEC prevention should focus on the controls that prevent or detect unauthorized vendor payment changes.
Important questions include:
Vendor authentication: Are requests independently authenticated using trusted contact information?
Banking validation: Does management perform appropriate checks before accepting new remittance instructions?
Segregation of duties: Can one employee request, enter, approve, and release a payment change?
Access controls: Are vendor master file permissions restricted to authorized personnel?
Change logs: Can management identify who changed vendor banking information and when?
Notifications: Are changes communicated to established vendor contacts?
Payment review: Are high-risk payments associated with recent bank changes identified before release?
Exception monitoring: Does management review unusual vendor activity and unresolved verification exceptions?
Incident response: Are employees trained to escalate suspected BEC attempts promptly?
The auditor should evaluate both control design and operating effectiveness.
A written procedure is not sufficient evidence that employees consistently follow it.
12. Practical BEC Case Study
Consider a hypothetical manufacturing company that receives an email apparently originating from one of its largest suppliers.
The message requests an immediate change to the supplier's bank account.
The email references legitimate invoice numbers and includes a signed banking-information form.
The Accounts Payable employee updates the vendor master file.
The following day, the organization sends a $425,000 payment to the new account.
The real supplier subsequently reports that it never requested the change.
What went wrong?
The organization relied on email and submitted documentation without independently authenticating the requester.
The change was processed without an effective secondary verification procedure.
No additional review occurred before the payment was released.
What controls could have interrupted the fraud?
Independent contact with the established vendor representative could have identified the fraudulent request.
Independent approval could have provided another opportunity to challenge the change.
A payment-release review could have flagged the large payment associated with a recently modified bank account.
The lesson is that BEC prevention requires multiple complementary controls.
A single control failure should not automatically result in a significant financial loss.
13. Why Employee Training Alone Is Not Sufficient
Security awareness training is important, but organizations should not rely exclusively on employees recognizing suspicious emails.
Sophisticated BEC messages can appear legitimate.
Employees may also face heavy workloads, time pressure, and competing priorities.
A better approach combines training with documented procedures, access restrictions, independent verification, approval requirements, and monitoring.
Employees should know precisely what to do when a vendor requests a banking change.
The process should not depend on individual judgment alone.
Management should establish clear requirements that employees can consistently follow.
14. Practical Templates Can Strengthen Implementation
One of the challenges in BEC prevention is translating control concepts into usable procedures.
Organizations may understand that independent authentication is important but lack the forms and documentation needed to implement it consistently.
The CCS training program addresses this challenge through practical templates and resources, including:
Authentication Reference Template.
Vendor Banking Form Template.
Global Vendor Validation Reference List.
Confirmation Call Script and Log Templates.
Desktop Procedures for Vendor Inquiries.
These resources help Accounts Payable teams document vendor authentication, banking validation, and related control activities.
The objective is to establish procedures that are repeatable, reviewable, and auditable.
15. What Should Management Do Immediately?
Organizations should evaluate their current vendor banking change process and identify weaknesses that could permit fraudulent payment redirection.
Management should determine whether requests are independently authenticated, whether approvals are documented, and whether recent bank changes receive additional scrutiny before payment release.
It should also ensure that employees know how to report suspicious requests and that the organization has a documented incident response procedure.
If a suspicious payment has already been initiated, the organization should immediately contact its financial institution and follow appropriate fraud reporting and recovery procedures.
Speed matters when attempting to recover fraudulently transferred funds.
Conclusion: BEC Prevention Depends on Controls, Not Trust in Email
Business Email Compromise represents a serious threat because it exploits the normal activities of Accounts Payable.
Fraudsters do not always need to defeat sophisticated cybersecurity defenses.
They may simply persuade an employee to change a bank account.
Organizations must recognize that email communications, familiar names, convincing documents, and even confirmation telephone calls can be manipulated.
Effective prevention requires independent authentication, appropriate vendor validation, segregation of duties, documented approvals, and payment-release controls.
Management must own these processes.
Internal Audit should independently evaluate their effectiveness.
The most important question is not whether an email looks legitimate. It is whether the organization has independently established that the payment instructions are authentic before the money is sent.
That is the foundation of effective BEC prevention.
Earn 2 CPE Credits: Business Email Compromise (BEC) Accounts Payable
Corporate Compliance Seminars offers the Business Email Compromise (BEC) Accounts Payable training event to help finance professionals strengthen vendor authentication, banking validation, and payment controls.
The program examines the weaknesses in traditional email-based processes, problems with ineffective confirmation calls, practical internal control improvements, and tools that participants can adapt to their organizations.
Instructor: Debra R. Richardson, MBA, CFE, APM, APPM, CPRS
Format: Live, interactive online training
CPE credits: 2 in Auditing
Program price: $140 per participant
Intended audience: Accounts Payable professionals, finance managers, internal auditors, compliance officers, and personnel responsible for vendor master data and payment controls.
Register or review available dates:
Protect your vendor payments by strengthening the internal controls that matter most.
Comments