How to verify a vendor before you pay them

To verify a vendor before you pay them, check two things separately: that the business is real and is the one you think you are dealing with, and that the bank account on the invoice belongs to it. The first comes from public records: the company registry, the domain the vendor emails from, the people who sign its messages and the footprint it has built up with other customers. The second comes from one step: calling the vendor on a number you already hold, not one supplied with the request, and confirming the account before any money moves. A change of bank details is the moment that call matters most.

This piece takes the checks in the order an accounts payable team can run them, with what each one is evidence of and a worked example. Our guides to KYB verification and shell company red flags cover deeper company research.

Vendor payment fraud takes two main shapes. The first is an impersonated vendor: the supplier is real and you owe it money, but someone gets between you and it, usually with an email asking you to pay into a new account. UK Finance, which collects fraud data from banks and payment providers, describes invoice and mandate scams as cases where the victim tries to pay a legitimate payee and the criminal convinces them to redirect the payment, including by "posing as a supplier, and claiming that the bank account details have changed". It adds that this fraud often involves "intercepting emails or compromising an email account".

The second is a fake vendor, set up to collect payments for work nobody did. Sometimes it is an outsider. The US Federal Trade Commission warns that scammers "create phony invoices that look like you ordered products or services for your business". Sometimes it is an insider. In the Association of Certified Fraud Examiners' 2026 study of 2,402 occupational fraud cases, billing schemes, a category that includes an employee who "creates a shell company and bills employer for services not actually rendered", appeared in 21 percent of cases, with a median loss of $90,000.

The FBI's Internet Crime Complaint Center (IC3) received 24,768 complaints of business email compromise in 2025, with reported losses of just over $3 billion, the largest loss of any crime type after investment fraud. In the UK, invoice and mandate scams cost £41.3 million in 2025, down 4 percent on 2024, and 68 percent of those losses were on business accounts. UK Finance gives the reason AP teams will recognise: businesses "make genuine higher-value payments more regularly, making it harder to spot and stop a fraudulent one."

In an impersonation, the theft happens when the payment destination changes, because every later payment follows the new account. The Association for Financial Professionals surveyed 465 corporate professionals in January 2026 about the year before. The AFP reports that about three in four organisations were affected by business email compromise in 2025, and found that fraudsters "primarily impersonate vendors or executives to request changes to payment instructions". One respondent described a scammer who "took over the email box of one of our key vendors" and sent fake invoices that were "processed in the normal way with all approval steps", while asking for a bank change "which was entered into the system before Treasury could confirm the same".

The invoices named the right supplier, came from its real address and were approved at every step. Only the account was wrong. The bank account is the one detail a fraudster has to change, so it is the one detail to confirm, on a number you already hold.

Treat every request to change where you pay a vendor as unverified until someone has confirmed it by a second route. The IC3 advises businesses to "use secondary channels and/or two-factor authentication to verify requests for changes in account information", and the UK's National Cyber Security Centre recommends that "all important email requests are verified using a second type of communication".

In practice:

1. Call the vendor on a number you already hold: from your vendor master file, the signed contract or an invoice you have already paid. Use none of the numbers in the email, letter or attachment that asks for the change, and if the number in your file was itself changed recently, verify that change first.
2. Ask for someone you have dealt with before, and have them confirm the old account, the new account and the reason for the change.
3. Hold any payment to the new account until the call is done, and have a second person approve the change in your system.
4. If your bank offers a check of the name on the receiving account, use it. In the UK this is Confirmation of Payee, which Pay.UK describes as "an account name checking service designed to help reduce misdirected payments". A close match shows you the actual account name to check, and a no match advises you to contact the organisation you are trying to pay.

Finance teams rate the callback highest. In the AFP's 2026 survey, 94 percent of organisations verified fund transfer requests "by calling an authorized contact at the payee organization using a phone number from official records, not from email", and 63 percent of those using it rated it very effective, the largest share for any of the eight controls the survey listed.

Where the number comes from matters as much as the call. A call to a number supplied in the request confirms only that whoever wrote the request answers the phone. In another case from the same survey, someone posing as a client sent new banking details, and "AP called the number on the email to confirm the banking details."

For a vendor you have not paid before, check the business itself before the first payment.

Is it registered, and is the registration current? In the UK, Companies House gives free details of any company on its register, including its registered address, date of incorporation, current and resigned officers and previous names, and records a status such as active, dissolved or in liquidation. In the US, companies register with a state, usually through the secretary of state's office, and the National Association of Secretaries of State links to each state's business registration pages and name databases. Free searches vary: Delaware's entity search returns active and inactive entities alike and says a result "is not an indication of the current status of an entity". A certificate of status, ordered for a fee, confirms it. Check the legal name on the invoice and the bank letter against the registry's spelling. Our KYB guide explains why a registry match shows a filing exists and leaves open whether the business trades.

Do the people exist and work there? Look up the people who sign the vendor's emails and invoices on its website, in its filings and in their professional history. In a 2022 joint advisory, the FBI, the FDA's Office of Criminal Investigations and the US Department of Agriculture described a sugar supplier that noticed an extra letter in the email domain of a would-be buyer and "independently contacted the actual company to verify there was no employee by that name working there". The same advisory lists fraudsters "using the names of actual officers or employees of a legitimate business" among their tactics, so a real name says nothing about who wrote the email.

Does it have a footprint built by other people? A trading business leaves traces it did not write itself: customers who mention it, reviews built up over years, trade association memberships, news. The joint advisory recommends verifying a new vendor's contact details "through reputable online sources like associations or business directories", and the FTC suggests searching a new company's name online with the words "scam" or "complaint" before doing business with it. Our guide to adverse media screening covers telling whether a news hit is about the vendor or a namesake.

Compare the domain on every payment-related email with the domain in your vendor file, character by character. The joint advisory describes fraudulent addresses that "include extra letters or words, substitute characters", such as the number 1 for a lower-case l, "or use a different top level domain". The IC3 adds that you should check that "the sender's address appears to match who it is coming from".

Then date the domain. For a generic domain such as .com, the public registration record includes the date the domain was created. ICANN's Lookup tool reads that record through RDAP, which replaced WHOIS as the definitive source of the data in January 2025. A supplier you have paid for years rarely starts emailing from a domain registered last week. Our guides to finding out who owns a website and investigating an email address go further.

A matching domain is still not proof. When the vendor's own mailbox is compromised, the email comes from the right address, often inside a real thread. In the AFP's 2026 survey, 39 percent of organisations said they continue to receive genuine emails that have been intercepted by fraudsters. That is why the callback comes first and the domain check second.

Count only independent evidence: a registry record and a website that copies its address are one fact seen twice.

Set the depth by the risk.

• Every change of bank details, for every vendor: a callback on a number you hold, a second approver, and an account-name check where your bank offers one, whatever the size of the payment.
• Every new vendor, before the first payment: the registry record, the named contacts, and the email domain and its age.
• A new vendor with a large first order, an account that does not fit it, such as one in another country, or pressure to pay quickly: the footprint and adverse media checks too, and a call on a number you found yourself.
• Existing vendors: watch for change. Companies House offers free email alerts when a company updates its details, such as a change of director or address.

A check that depends on one person remembering it under deadline pressure will eventually be skipped. These controls make it part of the process.

• Separate the people who can create vendors or change their bank details from the people who approve payments, so that one person cannot do both.
• Accept no bank change on the strength of an email alone. In the AFP's 2026 survey, 96 percent of organisations had "established policies to verify changes to invoices, bank deposits and contact details", and 91 percent prohibited "payment initiation based on emails or other less secure messaging systems".
• Require senior sign-off above a payment threshold. In the same survey, 94 percent of organisations did.
• Hold the first payment to a changed account until the callback is done, and consider a short hold after that too, so that the real vendor would notice a missing payment before much money moves.
• Tell your vendors how you handle changes. The NCSC suggests telling suppliers and customers what to look out for, with messages such as "our bank details will not change at any point". A buyer can tell its vendors that every change to their bank details will be confirmed by a call to the number on file. Genuine vendors then expect the call, and pressure to skip it stands out.

The case is a composite. Kemberwick Packaging is invented, its domains use the .example names reserved for documentation, and its phone numbers come from the 555-0100 to 555-0199 range reserved for fictional use.

A food manufacturer in Ohio has bought corrugated boxes from Kemberwick Packaging for six years, paying by wire to the same account. In September 2026 its AP team receives an email from Kemberwick's accounts team about two open invoices totalling $184,000. It quotes real earlier messages, is signed with the name of Kemberwick's real finance manager, and says Kemberwick has moved its banking. An attached letter on Kemberwick letterhead gives a new account at a different bank, in another country, and asks for payment by Friday.

The domain. The email comes from accounts@kernberwick.example. The vendor file says kemberwick.example. Read quickly, rn passes for m. An RDAP lookup shows the lookalike domain was created eight days earlier. The quoted thread is genuine, so whoever sent the email has read the real correspondence, most likely through a compromised mailbox at one end.

The people. The finance manager named in the signature appears on Kemberwick's website. The name is real, which shows the sender knows whom to impersonate and nothing more.

The phone number. The signature gives a direct line, +1 614 555 0182. The vendor file holds Kemberwick's main number, +1 614 555 0137, taken from the contract. The AP lead calls the number from the file.

The callback. Kemberwick's main line puts her through to the finance manager, who has not changed banks, did not send the email and has been wondering why the invoices are late.

The registry. Kemberwick's state registration is active and unchanged, because the fraud never touched the company. It touched the correspondence.

Put together, the request is an impersonation. The new domain, its age and an account abroad for a local supplier were each reason enough to call, and the call settled it. The manufacturer pays both invoices into the account on file, keeps the emails with their full headers, reports the lookalike domain to its registrar's abuse contact, files a complaint with the IC3 and tells Kemberwick, whose mailbox or a correspondent's needs checking. Who sent the email stays open, and the file says so.

The IC3's guidance begins: "If you discover a fraudulent transfer, time is of the essence." Call your bank at once on its official number, ask it to recall the payment and give it the full transaction details. Then report it.

• In the US, file a complaint with the IC3, which asks for one "regardless of the amount lost", with the full transaction details. Its Recovery Asset Team works with banks to freeze funds, and in 2025 it ran that process on 3,900 incidents involving $1.16 billion of attempted theft and froze $679 million, a 58 percent success rate.
• In the UK, the NCSC advises contacting your bank directly, using its official website or phone number. Report the fraud to Report Fraud, which replaced Action Fraud in December 2025 for England, Wales and Northern Ireland, or to Police Scotland on 101. UK Finance's figures show that £10.6 million of the £28 million lost to invoice and mandate scams on business accounts in 2025 was returned, a little under two-fifths.

Keep the emails with their full headers, the bank letter, call notes and payment records. Tell the real vendor, whose mailbox may be the compromised one, and have your IT team check yours.

Each check has a known way around it.

• A compromised vendor mailbox passes every domain check. The callback is what catches it, which is why it comes first.
• A callback to a number the fraudster supplied reaches the fraudster. The number has to come from your own records.
• A cloned voice can sound like a contact you know. The IC3 warns that "voice cloning can also be used to request wire payment", and businesses reported more than $30 million in losses in 2025 to business email compromise involving AI. A call you place to a number you hold is much harder to fake than a call you receive.
• An insider can create a vendor and approve its invoices. The ACFE found that billing schemes ran a median 14 months before they were detected. Separating who sets up vendors from who approves payments is the control, and the registry and footprint checks show whether a vendor has any history outside your ledger. A registered company can still be a front, which our shell company guide covers.

Most of what makes a vendor request look odd has an ordinary explanation, and a fair review checks it first.

• Vendors do change banks, after mergers or when they move to a new bank. The callback answers those requests too, and it is the same call whether the request is real or not.
• New and small vendors are thin. A sole trader may have no website, no reviews and a free email address. Ask for different evidence: a call, a reference from another customer, a registration document.
• An account-name check can return a close match or no match on a genuine account. The service's guidance is to enter a business's registered name or a trading name registered to the account, so an invoice that uses another trading name can produce a mismatch. A mismatch is a reason to call.
• A second domain is not always a lookalike. Businesses buy domains for new brands and acquisitions, and the callback tells the two apart.
• A vendor that checked out can change. Run the checks again when its details change, and every time its bank details do.

For a new supplier, the checks on the business take the longest by hand. Sixtyfour's agent starts from what you already have, such as a company name, a director or a website, researches public sources such as registry filings and the business's web footprint, links what it finds to the right company and people, and returns every finding with its source. Anything it could not establish is reported as open, and a person on your team decides. It does not check bank accounts or replace the callback. There is more on how financial crime teams use it on our financial institutions page.

Treat every change of vendor bank details as unverified until you have confirmed it on a phone number you already hold, with a second approver and an account-name check where your bank offers one. Before paying a new vendor, check its registry record, the people who sign its emails, its email domain and that domain's age, and the footprint other people have left. If money has already gone, call your bank to request a recall and report it straight away.