Accounts Payable Fraud: Vendor Fraud, Invoice Fraud and Invoice Scams

What is accounts payable fraud?

Accounts payable fraud is any scheme that gets a company's AP team to pay money it doesn't owe, or to pay a real bill into the wrong account. It can come from outside, through fake invoices, vendor impersonation and changed bank details, or from inside, through billing schemes and shell vendors set up by employees.

AP is a target because it handles the payments. Most AP fraud relies on deception rather than hacking: an invoice, an email or an edited vendor record. This guide covers the main types of vendor fraud and invoice fraud, how invoice scams work, the red flags, and best practices to stop these criminals.

What are the main types of accounts payable fraud?

AP fraud comes from two directions. Outsiders pose as vendors or send fake bills. Insiders use their access to the vendor list or the payment run to pay themselves.

Type	Comes from	How it works	Control that stops it
Fake invoices	Outside	A criminal sends a bill from a made-up or lookalike vendor for goods or services you never ordered.	Pay only vendors already approved in your system, and match each invoice to a purchase order and receipt.
Vendor impersonation	Outside	A criminal poses as a real vendor and asks AP to update its bank account. The next real invoice is paid to them. See payment diversion fraud.	Confirm every bank change through a channel you already trust, then verify who owns the new account.
Business email compromise	Outside	A criminal takes over or spoofs a real email account, yours or a vendor's, and uses it to send invoices or payment changes.	Never act on payment changes from email alone.
Overbilling and duplicate invoices	A real vendor	A vendor inflates prices, bills for work not done, or sends the same invoice twice.	Three-way match and an automatic duplicate check.
Billing schemes and shell vendors	Inside	An employee sets up a fake vendor, or bills through a real one, and approves payments to an account they control.	Split vendor setup, invoice approval and payment release across different people.
Kickbacks	Inside and a vendor	An employee approves inflated invoices from a vendor in exchange for a cut.	Rotate who approves each vendor and review spend by vendor over time.
Check tampering	Outside or inside	Someone steals, alters or forges a vendor check, changing the recipient or amount.	Positive pay and secure check handling.

What is vendor fraud?

Vendor fraud is any fraud that runs through your supplier relationships. It takes three forms:

• A criminal poses as a vendor. This is vendor impersonation: someone pretends to be a supplier you already pay and redirects the money.
• A real vendor cheats you. It overbills, charges for work it didn't do, or sends duplicate invoices and hopes no one notices.
• An employee invents a vendor. A fake supplier is added to your vendor master data, and payments to it go to the employee.

All three exploit the same weak spot: your vendor file. Whoever can add a vendor or change its bank account controls where money goes. That's why following a vendor onboarding process is so important.

What is invoice fraud and how do invoice scams work?

Invoice fraud is getting paid with a bill that is fake, inflated or sent to the wrong bank account. Invoice scams are the outside version: a criminal sends the bill and hopes AP pays it without checking. FinCEN found that fraudulent vendor and client invoices are generally tied to larger losses than other business email compromise schemes (FinCEN Advisory FIN-2019-A005).

Most invoice scams follow the same steps:

1. Research. The criminal learns who your vendors are from your website, press releases, LinkedIn or a hacked inbox.
2. Build the invoice. They copy a real vendor's logo and layout, or invent a vendor with a believable name.
3. Send it the normal way. It arrives by email to AP, often near month end when the team is busy.
4. Add pressure. The email says the account is past due, or that the vendor has "new banking details."
5. Collect and move the money. Once paid, the funds are moved out of the receiving account quickly.

Small amounts are common too. A fake bill for a few hundred dollars for "directory listings" or "domain renewal" often gets paid because the amount seems insignificant.

How do criminals impersonate a real vendor?

They don't need to fake a whole company. They only need AP to believe one email. FinCEN describes attackers using "compromised or spoofed email accounts to exploit existing business relationships" and "authentic-looking payment requests to direct funds to domestic bank accounts they control" (FinCEN Advisory FIN-2019-A005).

The common methods:

• Lookalike domains. The email comes from a domain one letter off, like acme-supp1y.com instead of acme-supply.com.
• Display name spoofing. The sender name says your vendor's AR contact, but the address behind it is different.
• A hacked vendor inbox. The criminal is inside your vendor's real email. The message comes from the right address, in the same thread, with the right invoice numbers. This is the hardest to catch.
• Phone follow-ups. A call to "confirm" the change, using the number in the email signature, which the criminal controls.

The ask is almost always the same: new bank details, effective now. That's why a bank change request is the single highest-risk moment in AP, whatever channel it arrives through.

What does internal AP fraud look like?

Internal AP fraud is an employee using their access to the vendor file or payment process to pay themselves. It's usually one of these:

• Shell vendors. The employee creates a fake company, adds it as a vendor and approves its invoices. The "vendor" is a bank account they control.
• Pass-through billing. A real vendor is used, but the employee inflates its invoices or adds fake line items and pockets the difference.
• Changed bank details on a real vendor. The employee quietly swaps a vendor's account for their own, then changes it back after the payment run.
• Kickbacks. The employee approves overpriced invoices in exchange for a cut. In the United States and Canada, corruption, which includes kickbacks, was the most common occupational fraud scheme at 33% of cases, and check and payment tampering showed up in 13% (ACFE, Occupational Fraud 2026, p. 96).

These schemes last because no one is looking for them. In the same ACFE data, 36% of US and Canadian cases were first caught through a tip, while just 4% were caught by automated transaction monitoring (p. 96). The fix is segregation of duties: the person who adds or changes a vendor should never be the one who approves or releases its payments.

What are the red flags on a fake invoice?

A fake invoice usually looks right at a glance. The tells are in the details AP checks every day:

Red flag	What it might mean
Bank details differ from the vendor file	Vendor impersonation or a hacked vendor inbox
"We've changed banks" in the email or on the invoice	The classic setup for payment diversion
Sender domain is slightly off	A lookalike domain, not your real vendor
No matching purchase order or receipt	A bill for something you never ordered
Urgency or secrecy ("past due," "pay today," "don't call")	Pressure to skip your normal checks
Round numbers or amounts just under an approval limit	An insider avoiding a second approver
A vendor with only a P.O. box, no phone or no website	A possible shell vendor
Vendor address or bank account matches an employee's	An insider scheme
Same invoice number or amount as a recent payment	A duplicate billing attempt

One red flag doesn't prove fraud, but any bank detail change should stop payments until it's confirmed.

How much does AP fraud cost US businesses?

Enough that most companies have taken a loss, and few get the money back.

• Losses are common. In 2025, 48% of organizations with under $1 billion in revenue and 66% of those above $1 billion reported a financial loss from payments fraud (AFP 2026 Payments Fraud and Control Survey).
• Checks are still the top target. 58% of organizations said their checks were hit by fraud, more than any other payment type (AFP 2026).
• Email scams are among the costliest crimes. Business email compromise ranked second among all crime types for reported losses in 2025, behind only investment fraud (FBI IC3 2025 Internet Crime Report).
• Most money is never recovered. In US and Canadian occupational fraud cases, 59% of organizations recovered nothing and only 15% recovered all of their losses (ACFE, Occupational Fraud 2026, p. 97).

The loss is also more than the payment. A diverted payment usually means the real vendor still needs to be paid, plus staff time, audit work and a harder conversation with your insurer.

How do you prevent accounts payable fraud?

Accounts payable fraud prevention comes down to two things: knowing every vendor is real, and making sure no one person can move money alone.

1. Verify vendors before they're added. Check that the company exists and that the person setting it up works there. Don't add a vendor straight from an emailed form.
2. Verify who owns the bank account. A valid account number only proves the account exists, not that it belongs to your vendor. See what bank account ownership verification is.
3. Collect bank details through a secure channel if you have one. If you don't, treat details that arrive by email or PDF as unconfirmed until you've verified them.
4. Call back on a number you already have. For any bank change, call the vendor on a number from your vendor file or their website, never the one in the request.
5. Split the duties. One person adds or changes vendors, another approves invoices, and a third releases payments. Small teams can at least require a second approver on vendor changes.
6. Match before you pay. Pay only invoices that match a purchase order and a receipt, and run a duplicate check on invoice numbers and amounts.
7. Review the vendor file. Look for vendors with no activity, P.O. box addresses, or bank accounts and addresses that match an employee's.
8. Protect check payments. Ask your bank about positive pay, which flags checks that don't match what you issued.

What should you do if you paid a fake invoice?

Act within hours, not days. The faster the banks know, the better the chance the money is still in the receiving account.

1. Call your bank's fraud line. Give them the payment details and ask them to contact the receiving bank right away.
2. Report it to the FBI at ic3.gov. Speed matters: in 2025 the FBI's Recovery Asset Team froze $679 million and succeeded in 58% of the cases it worked (FBI IC3 2025 Internet Crime Report).
3. Stop related payments. Hold anything pending to that vendor or bank account.
4. Call the real vendor on a number you already had to confirm what happened.
5. Check your email. If an inbox was compromised, reset passwords and look for forwarding rules the attacker set up.
6. Save the evidence: the invoice, emails, change requests and payment records.
7. Tell your insurer if you have crime or cyber coverage, since many policies have notice deadlines.

Then find out how the invoice got through, and close that gap.

How does Coffr help stop AP fraud?

Most AP fraud starts with bank details your team can't trust: an emailed form, an invoice PDF, or a "we've changed banks" message. With Coffr, vendors share bank details through Coffr's secure channel instead of email or PDF. Coffr verifies the person sharing them and confirms the bank account belongs to them before the details reach your team.

Each verification is recorded on an immutable blockchain ledger, so a later change to those details stands out.

See how Coffr can prevent accounts payable fraud in your business. Book a demo.

Sources

• AFP 2026 Payments Fraud and Control Survey
• ACFE, Occupational Fraud 2026: A Report to the Nations
• FBI IC3 2025 Internet Crime Report
• FinCEN Advisory FIN-2019-A005