What Is Vendor Master Data?

What is vendor master data?

Vendor master data is the record your company keeps on every supplier it pays: legal name, tax ID, address, contacts, payment terms and bank details. Your AP or ERP system reads this record every time it pays an invoice, so whatever bank account is on file is where the money goes.

It's also called the vendor master file, supplier master file or vendor record. Because one edit to it can redirect every future payment to that vendor, it's the most important file in accounts payable to protect.

What's in a vendor master record?

Most vendor records hold the same basic fields. The bank details carry the most risk, because they decide where money is sent.

Field	Example	Risk if it's wrong
Legal name	Acme Supply, Inc.	Paying a fake or lookalike company
Tax ID (EIN)	From the vendor's W-9	Wrong 1099 reporting, or a vendor that isn't real
Address	Remit-to and physical address	Checks mailed to the wrong place; shell vendors using P.O. boxes
Contacts	AR contact name, email and phone	Fraudsters reaching AP through a contact they control
Payment terms	Net 30	Paying early or late
Bank details	Routing and account number	Every future payment goes to the wrong account

In most systems the invoice doesn't decide which account gets paid. The vendor record does. That's why a criminal doesn't need a fake invoice if they can change the bank details on file.

Why is vendor master data a fraud target?

Because one change pays off again and again. A fake invoice gets paid once. A changed bank account on a real vendor gets paid every time that vendor bills you, until someone notices.

Criminals get to the vendor file in two ways:

• From outside. They pose as a vendor, usually by email, and ask AP to update the bank details. This is vendor impersonation, and it's the usual start of payment diversion fraud.

• From inside. An employee with edit access adds a fake vendor or swaps a real vendor's account for their own.

Some industries are hit harder than others. In FinCEN's 2019 analysis of business email compromise, manufacturing and construction accounted for 25% of reported cases, commercial services 18% and real estate 16% (FinCEN Advisory FIN-2019-A005). These are businesses that pay a lot of vendors and subcontractors, which means a lot of vendor records to protect.

Who should be allowed to change vendor bank details?

Only a small, named group, and never anyone who can also release payments. In practice that means:

• Edit rights to bank fields are separate from edit rights to the rest of the vendor record. Someone updating a phone number or address shouldn't be able to touch the routing and account number.

• The person who enters a bank change isn't the one who approves it. A second person, usually the AP manager or controller, signs off before the new details go live.

• No one with payment release rights can edit the vendor master file. If one person can do both, they can point a vendor's payments to their own account and pay it.

• Your system logs every edit with who made it, when, and the old and new values.

Small teams may not have enough people to split everything. At minimum, keep bank detail changes and payment release with different people, and have the owner or an outside accountant review the vendor change log every month. See segregation of duties for how to split the rest.

How should changes to the vendor master file be verified?

Every bank detail change should be verified before it's saved, not after the first payment goes out.

1. Log the request. Record who asked, how it came in (email, phone, portal) and when.

2. Don't trust the channel it came in on. If the request came by email, the email may be from a criminal, even if it's from the vendor's real address.

3. Collect the new details through a secure channel if you have one. If you don't, call the vendor back on a number already in your vendor file or on their website. See callback verification.

4. Verify the account. Account validation confirms the account is open. Ownership verification confirms it belongs to your vendor.

5. Get a second approval, then save the change.

6. Hold the first payment to the new account for review, and let the vendor know a change was made using a contact you already had.

The last step matters. If the change was fraud, the real vendor can tell you before any money goes out.

How do you keep vendor master data clean?

A messy vendor file hides fraud. Old, duplicate and unused vendors give criminals and insiders places to slip in unnoticed. Clean it on a schedule:

• Monthly: review a report of every vendor change, run by someone outside AP.

• Quarterly: deactivate vendors with no payments in 12 to 18 months, merge duplicates, and review who has edit access.

• Yearly: compare vendor addresses and bank accounts against employee records, and re-verify bank details for your highest-spend vendors.

New vendors should only be added through your vendor onboarding process, never straight from an emailed form. For the full set of controls around the vendor file, see our accounts payable internal controls checklist.

How does Coffr protect vendor master data?

With Coffr, vendors share their bank details through Coffr's secure channel instead of email or PDF. Coffr verifies the person sharing them and confirms the bank account belongs to them before the details reach your team, so what goes into your vendor master file is already verified.

Each verification is recorded on an immutable blockchain ledger, so a later change to those details stands out.

See how Coffr can protect your vendor master data. Book a demo.