Question 1

What is vendor invoice fraud?

Accepted Answer

Vendor invoice fraud is an attack in which a criminal impersonates a real supplier - usually by registering a one-character lookalike domain or compromising a vendor mailbox - and sends a fraudulent invoice to the victim's accounts payable team. The invoice typically references services or goods that were never delivered, lists attacker-controlled bank details, and is timed to blend in with the natural volume of month-end invoices. The FBI's Internet Crime Complaint Center consistently lists supplier-impersonation invoice fraud and business email compromise among the most financially damaging cybercrime categories, with billions of dollars in annual reported losses.

Question 2

What is the 3-way match in accounts payable?

Accepted Answer

The 3-way match is the standard control AP teams use to validate every invoice before it joins a payment run. It compares three independent records: the invoice from the vendor, the purchase order opened by the buyer who originally requested the goods or services, and the goods receipt logged by the receiving dock when the goods actually arrived. All three must line up on item, quantity, and price. If any leg is missing or mismatched, the invoice is held back until the discrepancy is resolved. The 3-way match is what stops fraudulent invoices for goods that were never ordered or never delivered, because no PO and no goods receipt will ever exist for them.

Question 3

Why are the bank details printed on an invoice not authoritative?

Accepted Answer

An invoice is a document the sender controls. If the sender is a fraudster, the bank account printed on the invoice is part of the attack - typically a mule account at a bank the real vendor has never used. The authoritative source for vendor banking is the vendor master in your AP or ERP system, which is maintained by Procurement under change control: every banking change has to flow through a formal request, be verified out-of-band with a known vendor contact, and be approved by a named owner before AP can act on it. Banking on the invoice and banking in the vendor master must match. If they do not, the invoice is suspect until verified.

Question 4

How do I spot a lookalike vendor domain?

Accepted Answer

Lookalike domains are designed to defeat a quick read of the From address by matching the real domain at a glance. The most common patterns are: a hyphen inserted into a normally hyphen-free domain (apex-steelfab.com vs apexsteelfab.com), a transposed or doubled letter (acmecorp.com vs accmecorp.com), a different top-level domain (acmecorp.net vs acmecorp.com), and a swapped homoglyph (replacing a Latin letter with a similar-looking character from another script). Always compare the sender address character by character against the verified email in the vendor master. Email gateways can catch many of these, but they cannot catch all of them - the human review is part of the control.

Question 5

What should I do if a 3-way match fails on a vendor invoice?

Accepted Answer

Do not approve the invoice and do not push it to a downstream reviewer hoping someone else catches it. Open the verified vendor record in your AP system and compare the email and invoice against the verified contact and banking. Place an out-of-band callback to the verified phone number from the vendor master - never a number from the suspicious invoice or email - and confirm directly with the real vendor contact whether the invoice was sent. If the vendor confirms it is fraud, reject the invoice in the AP system with a structured reason code that creates an audit trail, then file a fraud report with the security team so they can hunt for parallel attempts.

Question 6

Why report a fraudulent invoice attempt even if I caught it and no money moved?

Accepted Answer

The indicators in the report - lookalike sender domain, spoofed phone number, fraudulent destination bank account - let the security team pivot to find other AP coordinators who received the same campaign, block the lookalike domain at the email gateway, and share the bank account details with industry financial-fraud sharing groups so other companies cannot wire money into the same mule account either. A single rejected invoice is high-quality intelligence that protects every other AP team the same campaign reaches. Silently dropping the invoice means the next coordinator has to re-discover the attack from scratch.

Шахрайство з рахунками та платежами

Що таке Шахрайство з рахунками та платежами?

Що ви дізнаєтесь у Шахрайство з рахунками та платежами

Шахрайство з рахунками та платежами — Кроки навчання

Понеділок Ранок черги рахунків

Рахунок-фактура від Apex Steel

Детальніше про електронну пошту

Завантажити рахунок-фактуру у форматі PDF

Відкрийте завантажений PDF

Що стверджує рахунок-фактура

Запустіть 3-Way Match

Увійдіть у InvoiceFlow

Завантажте рахунок-фактуру для відповідності

Результати матчу