Invoice fraud costs organizations billions of dollars annually. Business Email Compromise (BEC) attacks targeting vendor payments are among the most financially damaging forms of cybercrime. Understanding how these attacks work—and how to detect them—is essential for any accounts payable operation.

How Invoice Fraud Works

Invoice fraud typically follows a pattern:

1. Reconnaissance: Attackers research the target organization, identifying vendors, payment patterns, and key personnel.

2. Impersonation: Using spoofed emails, lookalike domains, or compromised accounts, attackers pose as legitimate vendors.

3. Request: The fraudulent invoice includes changed payment details—usually a new bank account or remit-to address.

4. Execution: If the change goes undetected, payment is made to the fraudulent account.

The sophistication of these attacks has increased dramatically. Modern BEC attacks often:

• Use domains that differ by a single character from legitimate vendor domains
• Reference real invoice numbers and amounts
• Time requests to coincide with normal billing cycles
• Include realistic-looking invoice documents

Why Traditional Controls Fail

Most organizations rely on manual verification processes:

• Callbacks: AP staff call vendors to verify changes, but call volumes make this inconsistent
• Dual authorization: Multiple approvers may not catch subtle changes
• Training: Staff awareness helps, but sophisticated attacks bypass trained reviewers

The fundamental problem is that there’s no single source of truth for vendor payment details. Without a verified baseline, it’s difficult to know what’s legitimate and what’s fraudulent.

Detection Through Vendor Truth

Effective invoice fraud detection requires:

1. Verified Vendor Baselines

Every vendor should have a documented, verified profile including:

• Bank account numbers and routing numbers
• Authorized sender email domains
• Contact information for verification
• Historical payment patterns

2. Change Detection

Every invoice should be compared against the verified baseline. Flag changes to:

• Bank accounts (the most common fraud vector)
• Remit-to addresses
• Sender email domains
• Contact information

3. Verification Workflows

When changes are detected, a consistent verification process should:

• Use verified contact information (not details from the suspicious invoice)
• Document the verification for audit purposes
• Update the baseline only after verification

4. Payment Controls

High-risk invoices should require additional approval or hold payment until verification is complete.

The TruePayables Approach

TruePayables builds vendor truth over time. Every invoice processed contributes to a verified vendor profile. When something changes, you know immediately—before the payment goes out.

The key insight is that fraud becomes obvious when you have a verified baseline. A new bank account from an established vendor is a red flag. A first invoice from an unknown domain requires scrutiny. Subtle changes that might slip past manual review are automatically detected.

Getting Started

Organizations looking to improve invoice fraud detection should:

1. Establish a vendor master data authority: Create a single source of truth for vendor payment details
2. Implement systematic change detection: Don’t rely on manual review alone
3. Document verification processes: Create audit trails for compliance
4. Build controls into the payment process: Make verification a gate, not an afterthought

Invoice fraud is preventable. The organizations that suffer losses are typically those without systematic controls. By building vendor truth and detecting changes before payment, you can significantly reduce your fraud risk.