A new vendor is added to your accounting software. The bank information appears to be correct. The format of the invoice appears to be fine. The amount is small, and thus no one doubts it. Three months later, it turns out that there was no such thing as “vendor.” It was a made-up name, a different account in the bank, and money that’s gone.
This is known as ghost vendor fraud, and one of the easiest frauds to catch is that cloud accounting tools were not designed to identify this type of fraud. They are designed to count and not who is behind the numbers. These are the spaces where identity verification solutions fit in, and that’s a space the majority of growing businesses don’t think about until it costs them money.
Why Your Spreadsheet Trusts Everyone By Default
The very basis of accounting platforms is the assumption that the data that is being entered into the platform is accurate. Once a vendor name is entered, along with a tax number and a bank account, these elements are facts. I don’t believe there is any step that asks “Is this a real business, run by a real person?” While inventory tools monitor stock and billing tools monitor billing, neither was created to monitor those behind the numbers.
The Three-Minute Vendor That Takes Three Months To Catch
Here is the typical scam played by ghost vendors. A message from the accounts team is received via email from a new supplier or a current supplier with “new bank details. The email appears to be professional and includes a logo and faux registration number. The person who is taking it on has 15 other things to do that day, so the vendor is added on, and the first invoice is paid.
No one asks if the business is legit, since no one asks them to. The scam is typically discovered when the legitimate vendor calls and asks where their money went or when someone runs a year-end audit and realises that there’s a vendor that doesn’t have a website and no records other than the invoices.
What “Verifying a Business” Actually Means
Many people hear the phrase “identity verification” and only think about the process of verifying a face with an ID card. In the case of B2B onboarding of VENDORS, it goes much further:
Document verification checks whether a business registration certificate or tax document is genuine and has not been altered.
Beneficial ownership checks look past the company name to find out who actually owns and controls it, since shell companies are often used to hide the real person behind a scam.
Address and registration matching confirms the business actually exists at the address it claims, registered with the authority it claims to be registered with.
Sanctions and watchlist screening flags whether the individuals behind the vendor appear on any government or financial crime list.
This should not be a deterrent to onboarding. Modern checks are not performed as a manual process days later as they are filled out while the vendor form is being filled out.
Where AI Quietly Changed The Fraud Game
Most invoice fraud was very careless a few years ago, including errors in spelling, mismatched logos, and clearly fake email addresses. This is no longer the case. In today’s context, where the fraud side has innovated first, AI identity verification has become a must. In minutes now, using generative tools, you can generate a convincing registration certificate or a fake voice that passes a phone confirmation call.
This is the awkward part: a human reader (who’s looking at a screen) is unable to tell the difference anymore. It’s a method that has been quietly superseded by recent changes, although perhaps the fraud policy hasn’t been updated to reflect that. What has happened is that the method “does it look legitimate?” has become obsolete, without anyone being aware of it. It’s precisely for that reason that these tools can now be based on signals that can’t be faked, such as liveness checks and document forensics, and not on how convincing something appears on the surface.
Strict Checks Are Not Just For Banks Anymore
The notion of a strict bank is commonly associated with banking or fintech. It’s that assumption that makes it so that many small and mid-sized businesses are targeted. A finance team working with a generic accounting software package is less likely than a bank’s compliance team to question a new vendor. Online verification is feasible enough to be incorporated into a vendor onboarding form or in a payment approval process without making it a long compliance process.
Biometric Checks Solve A Different Problem Than You’d Expect
For most people, biometric identity systems are linked with unlocking a phone or passing through airport security. In a B2B scenario, they address a more narrow issue: verifying who the person is who is approving a payment or updating bank details, and not someone impersonating the individual within the organisation.
This is more important than you think. Only a minor percentage of invoice fraud comes from outside vendors. It’s from a phishing email that uses inside information and tricks a legitimate employee into providing their bank information through a bogus email for a “routine” change. The door is closed at the approval stage when a face or fingerprint check is performed instead of a password check.
What Multi-Currency Vendors Make Harder To Verify
Verification becomes more difficult, not easier, if your business is engaged in cross-border sales and/or purchases. A vendor in one country might have documents and registration systems that are different from those you’ve encountered in your finance department. Manual checks fail most readily if what is considered a valid tax number in one country is different in another country. This is not a matter of guesswork or no check whatsoever, but is eliminated by automated systems designed to deal with regional variations in document formats.
Where This Actually Fits Into Your Workflow
But the biggest problem businesses encounter is that they believe verifying identity is a cumbersome process that they need to add to their current tools. Fortunately, businesses can take steps to prevent this from happening. Good ID verification software, typically AI-driven and using identity verification models that are trained to recognise fake IDs, should fit into the time when a vendor or customer is added, rather than being the accounting system itself.
A realistic scenario would be a new vendor completes an onboarding form, the form is processed automatically behind the scenes, and the results are a pass, fail, or flagged for review—determine whether that vendor gets into your accounting system in the first place. The accounting platform continues to do what it does best: keeping track of the numbers. The verification is just to ensure that the numbers represent an actual person.
The Real Cost Of Skipping This Step
Ghost vendor fraud doesn’t usually come in one big, dramatic loss. It appears as a leaky tap: a few thousand dollars here, someone not remembering to approve a “vendor,” an invoice paid because it seemed like a normal transaction. It is too late by the time it is caught to retrieve the money, and the time invested in investigating it is more costly than the amount of the fraud.
It’s not the largest finance team that is at fault here; it’s the businesses that chose not to have one. They’re the ones that filled in the one missing piece in the cloud accounting software world: knowledge with some certainty that the vendor at the other end of the invoice actually exists.
READ MORE: clocktimes