Fraud involving vendor payments is one of the most common and costly schemes targeting organizations that use ACH. In many cases, fraud doesn’t involve a system breach. Instead, it exploits gaps in how you verify new vendors, process payment instructions, and handle requests to update banking information. The good news? Effective vendor payment controls1 don’t require a large compliance department or sophisticated software. With a few documented procedures and consistent follow-through, you can significantly reduce your exposure.
How vendor payment fraud happens
The most common scenario is vendor impersonation. A fraudster contacts your team by email—posing as a known vendor—and requests that banking information be updated before an upcoming payment. If that request is processed without independent verification, the next payment goes to the wrong person.
Common warning signs:
- A request to change payment instructions tied to an upcoming payment
- Language describing the change as urgent
- An email address that looks similar to but isn’t exactly the vendor’s real domain
- A callback number provided in the request itself (which may connect to the fraudster, not the vendor)
Best practices for managing vendor payment risk
1. Verify banking changes through a separate channel
Before processing any request to update a vendor’s payment information, verify the request through an independent and trusted source, such as a phone number maintained in your own records or obtained from the vendor’s official website. Consider documenting the verification for your records.
2. Require a second set of eyes
Using dual control within online banking can help reduce payment fraud risk by separating responsibilities for updating payment information and approving transactions. Where available, system-based dual controls may provide stronger safeguards than manual review processes alone.
3. Set up transaction alerts
Transaction alerts can help organizations identify unusual payment activity more quickly. Ask us about setting up alerts for ACH payments by emailing treasurymanagementsolutions@georgiasown.org or calling 404.874.1166, ext. 9818.
4. Write it down
Consider documenting your payment verification steps and approval processes, even if only in a simple internal summary. A concise description of who can authorize payment changes and how those changes are verified can help support consistency, training, and oversight. While Nacha does not prescribe a specific documentation format, maintaining written procedures may help organizations demonstrate and consistently apply their fraud monitoring and payment control practices.
