Avoiding Vendor Fraud: The Scam Hiding in Plain Sight

by MMBB Business Liaison and Technical Trainer Sharon McDowell

Internet scams have become more sophisticated and difficult to detect in recent years. One type of financial crime that is on the rise that both organizations and consumers should be aware of is invoice fraud -- also known as vendor fraud. Falling victim to this type of fraud can result in significant financial losses and operational disruptions.  

Electronic vendor fraud can occur through various tactics, so being aware of the many types of scams and how to protect yourself can help reduce your risk. Common examples of vendor fraud are:

Fake Invoices 

Scammers will send urgent invoices via email about goods or services that were not purchased -- typically for large payment amounts. They’ll often pose as retailers and trick the recipient into sending money or sharing banking information. 

Prevention: Always check the sender, match invoices to purchase orders and receiving records before submitting a payment. Exercise a three-way match system with accounts payable, verifying the purchase order, delivery receipt and the invoice.

Phishing Emails

Phishing has become a common internet scam; however, fraudsters will pose as a vendor or internal staff to deceive someone into sending money or to retrieve banking credentials. These emails often create a sense of urgency and appear to come from a trusted source, but they may contain subtle spelling, grammar, or formatting mistakes.

Prevention: Do not reply directly to the email, verify all requests using the vendor’s trusted contact number -- not the contact number in the email. Always check the email sender details for mistakes and never change payment details based on an email.

Stealing Bank Information

This may be the most extreme form of fraud. Check tampering occurs when an untrustworthy employee of an organization or someone they know alters physical check information for personal gain by changing the recipient and the amount of the check.

Prevention: It’s best to switch to electronic payment options when possible because digital payments are harder for bad actors to intercept when appropriate cybersecurity measures are in place.

Many financial institutions also offer fraud prevention services such as Positive Pay. With this system, a business submits payment details, including check numbers, dates, amounts, and payee information. The bank then compares presented checks against the provided information and flags discrepancies before processing payment.

For individual consumers, it’s best to utilize any fraud prevention features your bank or financial organization offers such as payment alerts and transaction notifications.

Duplicate Invoices

Duplicate invoices occur when the same bill is submitted more than once. Sometimes this may just be a discrepancy with your vendor; however, it can be intentional fraud. In these cases, the scammer relies on the duplicate going unnoticed. 

Prevention: Tiny details such as changes in the banking information, a new mailing address or invoice number are red flags. If a vendor suddenly advises you of a change in banking information, you may want to speak with a trusted contact to confirm. Match your invoices to order numbers and receipts and follow the three-way match system.

Verify Before You Pay

Regardless of the type of fraud, the most important step is to verify information before submitting a payment. Strong verification procedures, employee awareness, and clear internal controls can help protect your finances, sensitive data, and business operations from fraud.

Sharon McDowell serves as the business liaison and technical trainer at MMBB. She joined MMBB’s staff in 1992 and served on MMBB’s Help Desk team as a network analyst for more than 15 years. She is currently responsible for coordinating MMBB’s ongoing cybersecurity training. Her education includes a BS in computer science from State University of New York, College at New Paltz.