Accounts payable fraud rarely looks like fraud at the time. It looks like a routine email from a known vendor asking to update bank details, or an urgent request from an executive who is travelling. This checklist covers the controls that stop the common schemes: independent verification of bank changes, red flags for business email compromise, duplicate payment checks, bank-side protections, and dual approval on payment release. Pair it with our software category guides to see which tools fit your team. Once you have a shortlist, check the vendor profiles and the finance glossary for unfamiliar terms, then use our head-to-head comparisons before your first demo.
Built for: Controller, AP manager, CFO, Internal audit
+1 more inside
Start with bank changes. Adopt the bank change verification procedure first. It addresses the scheme that most often succeeds against mid-market AP teams, and it costs nothing but a phone call.
Train on the red flags. Walk AP and anyone who can request payments through the red-flag list. Make it explicit that no one will be criticised for delaying a payment to verify it.
Turn on bank controls. Ask your bank about positive pay, payee positive pay, ACH debit blocks or filters, and dual control on payment release. Most are available on commercial accounts.
Review the change log monthly. Someone outside AP reviews every vendor master change against its supporting evidence each month, and signs the log.
Here's a preview. Unlock the free download to get all 6 sections (5 more below).
Apply to every change to vendor bank details, however the request arrives and however familiar the vendor.
More free templates finance teams use alongside this one.
Vendor onboarding is where most payment fraud is set up, weeks before any money moves. A vendor record created from an emailed form with unverified bank details is a standing instruction to pay whoever supplied them. This vendor onboarding checklist puts tax, sanctions, and bank verification ahead of activation, and keeps the person who creates the record separate from the person who approves it.
A payment run is the moment cash actually leaves the business, so it deserves the same rigour as the close. This checklist takes the run from cash position and invoice selection through approval, release, and reconciliation. It includes an early-payment discount calculator, since a 2/10 net 30 discount is worth about 37% a year and is often missed because nobody worked it out.
Segregation of duties rests on one idea: no single person should be able to both commit an error or fraud and conceal it. In practice that means separating custody of assets, authorization, recording, and reconciliation. This matrix lists the specific duty pairs that conflict, shows who can do what by role, and gives compensating controls for teams too small to separate everything.
Common schemes include vendor impersonation and business email compromise to redirect payments, fictitious vendors created in the vendor master, duplicate or inflated invoices, and altered checks. Most rely on a gap in vendor master controls or payment approval.
Call the vendor on a phone number already on file or from the contract, never one supplied in the change request, and confirm the new details with a known contact. Have a second person approve the change after reviewing the call-back evidence.
Positive pay is a bank service where you send a file of issued checks and the bank matches presented checks against it, flagging mismatches for you to approve or return. Payee positive pay also matches the payee name.
A block rejects all ACH debits to the account. A filter allows debits only from originators you have authorised, and rejects or flags the rest. Filters suit accounts that pay taxes or regular vendors by authorised debit.
