Most invoice-redirection fraud does not break into your systems — it simply asks, politely and convincingly, for a supplier's bank details to be changed. Once the vendor master record points at the fraudster's account, every future invoice pays the wrong party automatically. Accounts payable automation makes that failure faster and quieter, which is exactly why a verification control belongs in the workflow.
Where fraud enters the AP process
A clear-eyed look at the AP lifecycle shows the single highest-risk event:
- A supplier (or someone impersonating them) requests a change of bank account.
- An onboarding form supplies an IBAN that nobody independently confirms belongs to the supplier.
- A one-off, urgent payment is set up outside the usual approval path.
Placing the VoP check correctly
Verification of Payee answers a question manual controls struggle with at scale: does this IBAN actually belong to the name on the invoice? Put the check at the point of change, before the record is trusted.
- 1 Trigger a VoP check whenever a new or changed IBAN is entered for a supplier.
- 2 Compare the verified payee name to the legal name on file, not just the trading name.
- 3 Hold the change for review on a close match or no match, instead of saving it automatically.
- 4 Log the outcome against the vendor record so the control is auditable.
Verify before you trust the master data
The goal is to confirm the account before it becomes the default payee, not to discover the problem in a post-payment reconciliation. A check at the point of change is worth far more than a report after the funds have gone.
For high-volume AP teams, RoxPay can verify a single changed IBAN in real time or a whole supplier file in bulk, so the control scales with your payment runs.