Invoice fraud targets the invoice: fake, altered, duplicated or inflated bills. Payment fraud targets the payment: money sent to an account that doesn’t belong to the supplier. The two often overlap, but different controls catch them. A genuine, fully approved invoice can still be paid to a fraudster if the supplier’s bank information has been changed.
Most accounting teams have invested heavily in invoice controls: three-way matching, approval workflows, duplicate detection. These controls answer an important question: should we pay this invoice? But they don’t answer a second one: are we paying the right account? That gap between invoice approval and payment is where many of today’s costliest invoice scams succeed, causing financial losses that are rarely recovered.
Who is this guide for?
This guide is for the people responsible for paying suppliers safely:
- Accounts payable and accounting teams who process and approve supplier invoices every day.
- Master data and procurement teams who create and update vendor information and vendor payment details.
- Treasury teams who release payment runs.
- CFOs, controllers and senior executives accountable for protecting the company’s financial assets and showing auditors that controls work.
If your company pays hundreds or thousands of suppliers, across several entities or ERP systems, this guide will help you find where your process is exposed and how to protect your business.
Key takeaways
- Invoice fraud falsifies the invoice; payment fraud falsifies where the money goes.
- Three-way matching checks the invoice against the purchase order and goods receipt, not against the bank account.
- Vendor payment details live in the supplier master file and can be changed separately from the invoice, through business email compromise, insiders or human error.
- AI makes fake invoices and phishing emails harder to spot: 75% of anti-fraud professionals report an increase in AI-generated document fraud.
- Invoice-to-payment assurance confirms that the invoice is authentic and approved and that the payment reaches the supplier’s verified account.
Invoice fraud vs payment fraud: what’s the difference?
Invoice fraud manipulates the bill itself. Fraudsters submit fraudulent invoices from fictitious suppliers, send duplicates, inflate amounts or run billing schemes with an insider’s help. The goal is to get a company to pay for something it doesn’t owe.
Payment fraud manipulates where the money goes. The invoice may be completely legitimate, but the payment is redirected to an account controlled by a fraudster. The most common route is business email compromise: phishing emails that appear to come from a supplier, or from senior executives, asking the team to update bank information or pay urgently.
| Invoice fraud | Payment fraud | |
|---|---|---|
| What’s falsified | The invoice information (fake, altered, duplicated, inflated) | The destination of the money (bank account, payment instructions) |
| Typical examples | Fake supplier invoices, duplicate billing, AI-forged documents | Fraudulent bank detail changes, vendor email compromise, altered payment files |
| When it happens | When suppliers submit invoices and they’re approved | Supplier onboarding, changes to vendor payment details, payment run |
| Usual owner | Accounts payable | AP, master data, treasury |
| Controls that catch it | Three-way match, duplicate detection, approval workflows | Bank account ownership checks, callbacks, master data monitoring, payment file checks |
| What those controls miss | Whether the bank account belongs to the supplier | Whether the invoice itself is legitimate |
The two can also combine. In a fake supplier scheme, the fraudster creates a fictitious company, opens a real bank account in its name and sends invoices for services never delivered. See more vendor fraud examples.
Why an approved invoice can still be paid to a fraudster
Invoice controls confirm that a bill is valid. They were never designed to confirm that the bank account receiving the money belongs to the supplier.
Three-way matching doesn’t check the bank account. It compares the invoice with the purchase order and the goods receipt. The bank account used for payment comes from the supplier master file, which the match doesn’t look at.
Bank details change separately from invoices. Vendor payment details can be changed weeks before an invoice arrives:
- through a request sent from a supplier’s hacked inbox (vendor email compromise)
- by an insider with access to the ERP
- through simple human error during data entry or migration
When the genuine invoice is later approved, the payment goes to the new account automatically.
AI makes fraudulent activity harder to spot. According to the Association of Certified Fraud Examiners, 75% of anti-fraud professionals reported an increase in generative AI document fraud and forgery over the past two years, while only 7% said their organizations are more than moderately prepared to detect or prevent AI-powered fraud.
A typical scenario: a supplier’s email account is compromised. The fraudster sends a bank detail change request from the real address, and the change is entered in the ERP. Two weeks later, the supplier’s genuine invoice matches the purchase order perfectly and is approved. The payment run sends the money to the fraudster. Every invoice control worked, and the company still fell victim to financial crime.
Red flags: suspicious invoices and payment requests
Train your team to treat these signals as triggers for verification:
- Invoice numbers that break the supplier’s usual sequence, or duplicate numbers.
- Several invoices just under an approval threshold, or arriving at once from the same supplier.
- Any request to change bank information, especially to a new country or bank.
- Urgent requests from senior executives or suppliers asking to bypass normal approval.
- Phishing attempts that mimic a supplier’s domain, or messages asking to reply only by email.
- A mismatch between the supplier’s legal name and the account holder’s name.
For a broader list, see the most common red flags for fraud.
Where fraud controls sit across procure-to-pay
| Stage | Main risk | Key control | Usual owner |
|---|---|---|---|
| Supplier onboarding | Fake supplier, fraudulent bank account | Verify the company and confirm the account belongs to it | Procurement / master data |
| Invoice receipt and approval | Fake, duplicate or inflated invoices | Duplicate detection, three-way match, segregation of duties | AP |
| Changes to vendor information | Fraudulent bank or contact detail changes | Independent verification, callback procedures, continuous master data monitoring | Master data / AP |
| Payment run | Payment to an account that isn’t the supplier’s | Check payment files against verified bank data before release | Treasury / AP |
Most companies have strong controls on the invoice. The gaps usually sit in the stages about bank details: changes to vendor information and the payment run.
What is invoice-to-payment assurance?
Invoice-to-payment assurance is a set of controls that confirms both that an invoice is authentic and approved and that the payment reaches the supplier’s verified bank account, with one continuous audit trail from supplier onboarding to payment.
It rests on three principles:
- Verify the supplier and its account at onboarding. Automated account validation confirms the bank account belongs to the supplier before the first invoice is paid.
- Validate the invoice. Confirm it’s complete, authentic, not duplicated and approved.
- Validate the payment, and every change in between. Re-verify bank details whenever they change, and check each payment before release.
How to protect your business: 6 practical steps
- Educate employees. Train accounting teams to recognize phishing emails, suspicious invoices and pressure tactics. Awareness reduces the risk of falling victim, but it can’t be your only control.
- Contact the vendor directly. Verify any change to vendor payment details by calling a trusted number from your records, never one from the email or invoice.
- Verify bank account ownership independently. Confirm that the account belongs to the supplier, not just that the invoice information is correct.
- Enable two-factor authentication on email accounts and finance systems so stolen passwords alone can’t be used to change vendor information or approve payments.
- Reduce human error with automation. Manual checks across thousands of suppliers are inconsistent. Automated checks apply the same rule at onboarding, at every change and before payment.
- Report fraudulent activity quickly. Contact your bank immediately to request a recall. In the US, report incidents to the FBI’s IC3 and invoice scams to the Federal Trade Commission.
Who owns the gap?
In most companies, AP owns invoices, master data owns bank details and treasury owns payments, so the gap between them often belongs to nobody. Name one owner for supplier bank data integrity, agree on one verification rule across the cycle, and keep one audit trail all three teams can rely on. Learn more about accounts payable fraud controls.
How Basware and Trustpair work together
Basware helps confirm that the invoice is legitimate and approved. Trustpair confirms that the payment reaches the intended supplier account. Together, they close the gap between invoice approval and payment execution.
Following Basware’s acquisition of Trustpair, Trustpair continues to operate independently. It continues to work with the ERP, procurement and treasury systems customers already use, including SAP, Oracle, Coupa, Ivalua, Jaggaer and Kyriba. Learn more about Trustpair and Basware and Trustpair’s approach to vendor fraud prevention.
Talk to a fraud expert about closing your invoice-to-payment gap
You might also like: How to Detect and Prevent Invoice Fraud · Vendor Email Compromise: What to Do When a Supplier’s Email Is Hacked · What Are Call Back Procedures?