Payment runs, payment methods and fraud controls
Payment runs, the four ways to pay a vendor, and the controls that stop business email compromise and duplicate payments.
A payment run pays every approved bill due before the next run, at once, on a fixed day. It is easier to review than bills paid one at a time, and it makes the cash forecast a calendar. At September 30 Northwind's next run has one bill in it: the $6,000 left on the drill bill, due in 3 days.
Step 1: Select the bills
Every approved bill due before the next run, plus any whose discount closes before then.
Step 2: Preview the run
Vendor, amount, method, bank account, and the cash left in the bank afterwards. That last number is the one that matters.
Step 3: Hold changed bank details
Any vendor whose bank details changed since the last payment is held until the change is verified by a call to a number already on file.
Step 4: Approve and release
Someone other than the person who built the run releases it.
Step 5: Record and match
Each payment is matched to its bill, so AP goes down and the aging clears. A payment coded straight to expense from the bank feed books the cost twice.
ACH, wire, check or card
ACH
- Good at
- A whole run goes as one batch
- No paper, and nothing to mail
- Watch for
- Settles in batches, not instantly
- A changed bank account in the vendor master redirects every future payment, which is what fraudsters aim for
- Best for
- Recurring domestic vendors
Wire
- Good at
Same-day, settled individually and in full
- Watch for
- Final once sent: getting it back depends on a recall request to the bank
- The rail business email compromise prefers
- Best for
- Large, urgent or international payments, after a call-back
Check
- Good at
- The vendor needs no bank details from you
- Positive pay lets the bank stop a check you did not issue
- Watch for
- Sits as an outstanding check until presented
- Paper can be altered or stolen in transit
- Best for
- Vendors who will not take electronic payment
Card
- Good at
- Reported by the processor on Form 1099-K, so it stays out of your 1099 count
- Cash leaves when the statement is paid
- Watch for
The charge goes to the card's liability, not AP, and needs its own receipt
- Best for
- Subscriptions and small vendors
Every method carries the same weak point: the bank details in the vendor master. Change them, and every payment that follows goes somewhere else. The controls around that change are the subject of the sub-page below.
In this lesson: payment fraud, how business email compromise works and the controls that stop it.
Pages in this lesson
1 page goes deeper, about 6 minutes in all. Read them in order, or open the one you need.
Where this lesson's rules come from
The sources behind this lesson's requirements, by kind. Background reading explains; it is never the authority for a rule. Anything marked as a convention is ours, not the rule-maker's.
- IRS guidance
- Instructions for Forms 1099-MISC and 1099-NEC (Rev. December 2026), Form 1099-K (opens in a new tab)Card and payment-network payments are reported on Form 1099-K, not the NEC or MISCFree to read
- Federal agency guidance
- FBI IC3 public service announcement, “Business Email Compromise: The $55 Billion Scam” (Sept. 11, 2024) (opens in a new tab)Business email compromiseFree to read
- SEC
- SEC Release 33-8238 (June 2003) — Sarbanes-Oxley §404 (opens in a new tab)Management's report on internal control over financial reportingFree to read
- Background reading — not an authority
- Wikipedia, “Automated clearing house” (opens in a new tab)Automated clearing houseFree to read
- Wikipedia, “Email spoofing”, § Business email (opens in a new tab)Business email compromiseFree to read
- Wikipedia, “Separation of duties” (opens in a new tab)Separation of dutiesFree to read
The full map is in US GAAP, and where these rules come from.
The words this lesson teaches
Each links to its glossary definition, which also names the authority behind it and the components that render it.
- Payment runA batch of payments released togetherConvention
- ACHThe Automated Clearing House network — the US batch system for electronic credits and debits under Nacha rules; same-day to two-day settlement, with limited return rights
- Wire transferA payment settled individually and in full — domestically over Fedwire, cross-border through correspondent banks via SWIFT — same-day and final once sent, which is why it carries the highest fraud risk
- Outstanding checkA check recorded as paid in the books but not yet presented to the bank — deducted from the bank balance in a reconciliationConvention
- Positive payA bank fraud control: the company sends the bank a file of issued checks (or approved ACH debits) and the bank returns any presented item that does not match for a decisionConvention
- Business email compromiseFraud that uses a compromised or impersonated email account — often a vendor's or an executive's — to have payments sent to an account the fraudster controls, typically by "updating" a vendor's bank details
- Segregation of dutiesSplitting authorization, recording, custody of assets and reconciliation across different people, so no one person can both commit and conceal an error or fraud — at minimum, preparer ≠ approver
- Vendor masterThe record of every approved vendor — legal name, tax classification, TIN, tax form on file, bank details, default terms and who approved the setup. Bank details are versioned, never overwritten
See also
- Procure to pay (AP)The payables stack from requisition to reconciliation: requisition → PO → receipt → bill → approval → payment → reconciliation.
- Controls & auditAccounting software is a system of controls, and most of them are enforced in the UI: segregation of duties, approvals bound to a version, an append-only audit trail, and evidence attached wherever an auditor will ask for it.
- Duplicate paymentsSame vendor, same amount, close in time. Or the same reference on any date.
- IBAN, routing, VAT, EINCheck an IBAN, routing number, VAT, EIN, ISIN or LEI offline, by format and checksum.
- Journal entry for accounts payableWhen an approved vendor bill is entered, debit the expense or asset it bought and credit Accounts payable. When it is paid, debit Accounts payable and credit Cash.
- Journal entry for credit card expensesFor each company card charge, debit the expense it paid for and credit Credit card payable. When the statement is paid, debit Credit card payable and credit Cash.
- How to pay vendors: ACH vs wire vs check vs cardACH, wire, check or card: what each payment rail costs, how long it takes, where the fraud risk sits, and how each payment is recorded in the books.
- Company cards and receipts: coding, matching, reconcilingCompany cards without the month-end receipt chase: how to code card spend, match receipts, handle missing ones and reconcile the card to its statement.
- Accounts payable process for startups: intake to paymentHow a bill moves from inbox to paid: intake, coding, approval, scheduling and recording, plus AP aging and who approves what at a 10-person startup.
- PaymentRunBuilderShows the cash balance remaining after the run.
- PaymentRunPreviewHold-to-confirm. Partial failure is a first-class state.
- BankDetailChangeAlertThe fraud-prevention surface.
- VendorMasterBank details versioned, never overwritten.
- CashRequirementsDue in 7/14/30 vs. available, payroll broken out.