Payment fraud: business email compromise and the controls that stop it
Business email compromise, the vendor bank-detail change it runs through, and the segregation-of-duties controls that stop it.
The most expensive AP fraud is not a hacked bank. It is an email that looks like a real vendor's, asking for future payments to go to a new account. That is business email compromise, and the FBI's Internet Crime Complaint Center reported over $55 billion of exposed losses to it between October 2013 and December 2023. It works where one person can change a vendor's bank details and release a payment the same afternoon.
Segregation of duties is the fraud control: no one person can both change where money goes and send it.
Where this lesson's rules come from
The sources behind this lesson's requirements, by kind. Background reading explains; it is never the authority for a rule. Anything marked as a convention is ours, not the rule-maker's.
- Federal agency guidance
- FBI IC3 public service announcement, “Business Email Compromise: The $55 Billion Scam” (Sept. 11, 2024) (opens in a new tab)Business email compromiseFree to read
- SEC
- SEC Release 33-8238 (June 2003) — Sarbanes-Oxley §404 (opens in a new tab)Management's report on internal control over financial reportingFree to read
- Background reading — not an authority
- Wikipedia, “Email spoofing”, § Business email (opens in a new tab)Business email compromiseFree to read
- Wikipedia, “Separation of duties” (opens in a new tab)Separation of dutiesFree to read
The full map is in US GAAP, and where these rules come from.
The words this page teaches
Each links to its glossary definition, which also names the authority behind it and the components that render it.
- Business email compromiseFraud that uses a compromised or impersonated email account — often a vendor's or an executive's — to have payments sent to an account the fraudster controls, typically by "updating" a vendor's bank details
- Segregation of dutiesSplitting authorization, recording, custody of assets and reconciliation across different people, so no one person can both commit and conceal an error or fraud — at minimum, preparer ≠ approver
- Vendor masterThe record of every approved vendor — legal name, tax classification, TIN, tax form on file, bank details, default terms and who approved the setup. Bank details are versioned, never overwritten
- Positive payA bank fraud control: the company sends the bank a file of issued checks (or approved ACH debits) and the bank returns any presented item that does not match for a decisionConvention
See also
- Controls & auditAccounting software is a system of controls, and most of them are enforced in the UI: segregation of duties, approvals bound to a version, an append-only audit trail, and evidence attached wherever an auditor will ask for it.
- How to pay vendors: ACH vs wire vs check vs cardACH, wire, check or card: what each payment rail costs, how long it takes, where the fraud risk sits, and how each payment is recorded in the books.
- Accounts payable process for startups: intake to paymentHow a bill moves from inbox to paid: intake, coding, approval, scheduling and recording, plus AP aging and who approves what at a 10-person startup.
- BankDetailChangeAlertThe fraud-prevention surface.
- VendorMasterBank details versioned, never overwritten.
- ApprovalChainSegregation of duties enforced. Approvals bind to a version.