Invoice fraud targets the invoice: fake, altered, duplicated or inflated bills. Payment fraud targets the payment: money sent to an account that doesn’t belong to the supplier. The two often overlap, but different controls catch them. A genuine, fully approved invoice can still be paid to a fraudster if the supplier’s bank information has been changed.
Most accounting teams have invested heavily in invoice controls: three-way matching, approval workflows, duplicate detection. These controls answer an important question: should we pay this invoice? But they don’t answer a second one: are we paying the right account? That gap between invoice approval and payment is where many of today’s costliest invoice scams succeed, causing financial losses that are rarely recovered.
Who is this guide for?
This guide is for the people responsible for paying suppliers safely:
- Accounts payable and accounting teams who process and approve supplier invoices every day.
- Master data and procurement teams who create and update supplier information and payment details.
- Treasury teams who release payment runs.
- CFOs, financial controllers and senior executives accountable for protecting the organisation’s financial assets and evidencing that controls work to auditors and the board.
If your organisation pays hundreds or thousands of suppliers, across several entities or ERP systems, this guide will help you find where your process is exposed and how to protect your business.
Key takeaways
- Invoice fraud falsifies the invoice; payment fraud falsifies where the money goes.
- Three-way matching checks the invoice against the purchase order and goods receipt, not against the bank account.
- Supplier payment details live in the supplier master file and can be changed separately from the invoice, through business email compromise, insiders or human error.
- Confirmation of Payee helps, but it checks the account name, not whether the supplier actually requested a change.
- AI makes fake invoices and phishing emails harder to spot: 75% of anti-fraud professionals report an increase in AI-generated document fraud.
- Invoice-to-payment assurance confirms that the invoice is authentic and approved and that the payment reaches the supplier’s verified account.
Invoice fraud vs payment fraud: what’s the difference?
Invoice fraud manipulates the bill itself. Fraudsters submit fraudulent invoices from fictitious suppliers, send duplicates, inflate amounts or run billing schemes with an insider’s help. The goal is to get an organisation to pay for something it doesn’t owe.
Payment fraud manipulates where the money goes. The invoice may be completely legitimate, but the payment is redirected to an account controlled by a fraudster. In the UK, this is a form of authorised push payment (APP) fraud. The most common route is business email compromise: phishing emails that appear to come from a supplier, or from senior executives, asking the team to update bank information or pay urgently.
| Invoice fraud | Payment fraud | |
|---|---|---|
| What’s falsified | The invoice information (fake, altered, duplicated, inflated) | The destination of the money (sort code, account number, IBAN, payment instructions) |
| Typical examples | Fake supplier invoices, duplicate billing, AI-forged documents | Fraudulent bank detail changes, supplier email compromise, altered payment files |
| When it happens | When suppliers submit invoices and they’re approved | Supplier onboarding, changes to supplier payment details, payment run |
| Usual owner | Accounts payable | AP, master data, treasury |
| Controls that catch it | Three-way match, duplicate detection, approval workflows | Bank account ownership checks, callbacks, master data monitoring, payment file checks |
| What those controls miss | Whether the bank account belongs to the supplier | Whether the invoice itself is legitimate |
The two can also combine. In a fake supplier scheme, the fraudster registers a fictitious company, opens a real bank account in its name and sends invoices for services never delivered. Because the name and account genuinely match, Confirmation of Payee returns a match. See how to build a robust supplier verification process.
Why an approved invoice can still be paid to a fraudster
Invoice controls confirm that a bill is valid. They were never designed to confirm that the bank account receiving the money belongs to the supplier.
Three-way matching doesn’t check the bank account. It compares the invoice with the purchase order and the goods receipt. The bank account used for payment comes from the supplier master file, which the match doesn’t look at.
Bank details change separately from invoices. Supplier payment details can be changed weeks before an invoice arrives:
- through a request sent from a supplier’s hacked inbox
- by an insider with access to the ERP
- through simple human error during data entry or migration
When the genuine invoice is later approved, the payment goes to the new account automatically.
Name checks only go so far.Confirmation of Payee checks whether the payee name matches the account at the receiving bank. It doesn’t confirm that your supplier requested the change, and it doesn’t cover all international payments.
AI makes fraudulent activity harder to spot. According to the Association of Certified Fraud Examiners, 75% of anti-fraud professionals reported an increase in generative AI document fraud and forgery over the past two years, while only 7% said their organisations are more than moderately prepared to detect or prevent AI-powered fraud.
A typical scenario: a supplier’s email account is compromised. The fraudster sends a bank detail change request from the real address, and the change is entered in the ERP. Two weeks later, the supplier’s genuine invoice matches the purchase order perfectly and is approved. The payment run sends the money to the fraudster. Every invoice control worked, and the organisation still fell victim to financial crime.
Red flags: suspicious invoices and payment requests
Train your team to treat these signals as triggers for verification:
- Invoice numbers that break the supplier’s usual sequence, or duplicate numbers.
- Several invoices just under an approval threshold, or arriving at once from the same supplier.
- Any request to change bank information, especially to a new country or bank.
- Urgent requests from senior executives or suppliers asking to bypass normal authorisation.
- Phishing attempts that mimic a supplier’s domain, or messages asking to reply only by email.
- A “close match” or “no match” Confirmation of Payee result, or a mismatch between the supplier’s legal name and the account holder’s name.
Where fraud controls sit across procure-to-pay
| Stage | Main risk | Key control | Usual owner |
|---|---|---|---|
| Supplier onboarding | Fake supplier, fraudulent bank account | Verify the company and confirm the account belongs to it | Procurement / master data |
| Invoice receipt and approval | Fake, duplicate or inflated invoices | Duplicate detection, three-way match, segregation of duties | AP |
| Changes to supplier information | Fraudulent bank or contact detail changes | Independent verification, call back procedures, continuous master data monitoring | Master data / AP |
| Payment run | Payment to an account that isn’t the supplier’s | Check payment files against verified bank data before release | Treasury / AP |
Most organisations have strong controls on the invoice. The gaps usually sit in the stages about bank details: changes to supplier information and the payment run.
What is invoice-to-payment assurance?
Invoice-to-payment assurance is a set of controls that confirms both that an invoice is authentic and approved and that the payment reaches the supplier’s verified bank account, with one continuous audit trail from supplier onboarding to payment.
It rests on three principles:
- Verify the supplier and its account at onboarding. Automated account validation confirms the bank account belongs to the supplier before the first invoice is paid.
- Validate the invoice. Confirm it’s complete, authentic, not duplicated and authorised.
- Validate the payment, and every change in between. Re-verify bank details whenever they change, and check each payment before release.
How to protect your business: 6 practical steps
- Educate employees. Train accounting teams to recognise phishing emails, suspicious invoices and pressure tactics. Awareness reduces the risk of falling victim, but it can’t be your only control.
- Contact the supplier directly. Verify any change to supplier payment details by calling a trusted number from your records, never one from the email or invoice.
- Verify bank account ownership independently. Use Confirmation of Payee and independent account validation to confirm the account belongs to the supplier, not just that the invoice information is correct.
- Enable two-factor authentication on email accounts and finance systems so stolen passwords alone can’t be used to change supplier information or authorise payments.
- Reduce human error with automation. Manual checks across thousands of suppliers are inconsistent. Automated checks apply the same rule at onboarding, at every change and before payment.
- Report fraudulent activity quickly. Contact your bank immediately to request a recall, and report the fraud to Action Fraud. Bear in mind that the UK’s mandatory APP fraud reimbursement scheme is designed for consumers, micro-enterprises and small charities, so larger organisations need to stop the payment before it’s made.
If a fraud has already happened, follow our playbook for responding to an impersonation scam.
Who owns the gap?
In most organisations, AP owns invoices, master data owns bank details and treasury owns payments, so the gap between them often belongs to nobody. Name one owner for supplier bank data integrity, agree on one verification rule across the cycle, and keep one audit trail all three teams can rely on.
This matters more than ever for UK boards. Under Provision 29 of the UK Corporate Governance Code 2024, boards must declare the effectiveness of their material internal controls for reporting periods beginning on or after 1 January 2026. Where payment controls are considered material, a single, documented invoice-to-payment process makes that declaration far easier to support.
How Basware and Trustpair work together
Basware helps confirm that the invoice is legitimate and approved. Trustpair confirms that the payment reaches the intended supplier account. Together, they close the gap between invoice approval and payment execution.
Following Basware’s acquisition of Trustpair, Trustpair continues to operate independently. It continues to work with the ERP, procurement and treasury systems customers already use, including SAP, Oracle, Coupa, Ivalua, Jaggaer and Kyriba. Learn more about Trustpair’s approach to supplier fraud prevention and payment security.
Talk to a fraud expert about closing your invoice-to-payment gap
You might also like:How to Detect and Prevent Invoice Fraud · Call Back Procedures · Confirmation of Payee and APP Scams