# Payment runs, payment methods and fraud controls

> Payment runs, the four ways to pay a vendor, and the controls that stop business email compromise and duplicate payments.

Source: https://lopifi.com/learn/vendor-payment-runs-and-fraud-controls
Part of: Lopifi — US GAAP books on autopilot, checked by a CPA (https://lopifi.com)

---

**How should a startup pay vendors safely: ACH, wire, check or card?** Payment runs, the four ways to pay a vendor, and the controls that stop business email compromise and duplicate payments.

A [payment run](https://lopifi.com/md/glossary/payment-run) pays every approved bill due before the next run, at once, on a fixed day. It is easier to review than bills paid one at a time, and it makes the cash forecast a calendar. At September 30 Northwind's next run has one bill in it: the $6,000 left on the drill bill, due in 3 days.

*[Figure: ap payment run]*

Northwind's first October run: the open drill bill, due October 3, 2026.

1. **Select the bills.** Every approved bill due before the next run, plus any whose discount closes before then.
2. **Preview the run.** Vendor, amount, method, bank account, and the cash left in the bank afterwards. That last number is the one that matters.
3. **Hold changed bank details.** Any vendor whose bank details changed since the last payment is held until the change is verified by a call to a number already on file.
4. **Approve and release.** Someone other than the person who built the run releases it.
5. **Record and match.** Each payment is matched to its bill, so AP goes down and the aging clears. A payment coded straight to expense from the bank feed books the cost twice.

Running a payment run.

## ACH, wire, check or card

**ACH**
- Pro: A whole run goes as one batch
- Pro: No paper, and nothing to mail
- Con: Settles in batches, not instantly
- Con: A changed bank account in the vendor master redirects every future payment, which is what fraudsters aim for
- Best for: Recurring domestic vendors

**Wire**
- Pro: Same-day, settled individually and in full
- Con: Final once sent: getting it back depends on a recall request to the bank
- Con: The rail business email compromise prefers
- Best for: Large, urgent or international payments, after a call-back

**Check**
- Pro: The vendor needs no bank details from you
- Pro: [Positive pay](https://lopifi.com/md/glossary/positive-pay) lets the bank stop a check you did not issue
- Con: Sits as an [outstanding check](https://lopifi.com/md/glossary/outstanding-check) until presented
- Con: Paper can be altered or stolen in transit
- Best for: Vendors who will not take electronic payment

**Card**
- Pro: Reported by the processor on Form 1099-K, so it stays out of your 1099 count
- Pro: Cash leaves when the statement is paid
- Con: The charge goes to the card's liability, not AP, and needs its own receipt
- Best for: Subscriptions and small vendors

The four ways to pay a vendor.

**Northwind — A check in the books before it is in the bank.** Northwind's rent was paid by check on September 28 (JE-13). The books recorded it that day; the bank had not seen it by the 30th. It is the outstanding check on September's bank reconciliation, and it explains why the bank showed more cash than the ledger.

Every method carries the same weak point: the bank details in the [vendor master](https://lopifi.com/md/glossary/vendor-master). Change them, and every payment that follows goes somewhere else. The controls around that change are the subject of the sub-page below.

In this lesson: **payment fraud**, how business email compromise works and the controls that stop it.

## Pages in this lesson

- [Payment fraud: business email compromise and the controls that stop it](https://lopifi.com/md/learn/vendor-payment-runs-and-fraud-controls/payment-fraud-controls) — 6 min. How do you stop vendor payment fraud and business email compromise?

## Where this lesson's rules come from

- [FBI IC3 public service announcement, “Business Email Compromise: The $55 Billion Scam” (Sept. 11, 2024)](https://www.ic3.gov/PSA/2024/PSA240911) — Business email compromise (agency)
- [SEC Release 33-8238 (June 2003) — Sarbanes-Oxley §404](https://www.sec.gov/rule-release/33-8238) — Management's report on internal control over financial reporting (sec)
- [Wikipedia, “Automated clearing house”](https://en.wikipedia.org/wiki/Automated_clearing_house) — Automated clearing house (reference)
- [Wikipedia, “Email spoofing”, § Business email](https://en.wikipedia.org/wiki/Email_spoofing#Business_email) — Business email compromise (reference)
- [Wikipedia, “Separation of duties”](https://en.wikipedia.org/wiki/Separation_of_duties) — Separation of duties (reference)
- [Instructions for Forms 1099-MISC and 1099-NEC (Rev. December 2026), Form 1099-K](https://www.irs.gov/instructions/i1099mec) — Card and payment-network payments are reported on Form 1099-K, not the NEC or MISC (irs)

## Read further

- https://lopifi.com/md/journal-entries/accounts-payable
- https://lopifi.com/md/journal-entries/credit-card-expenses
- https://lopifi.com/md/startups/how-to-pay-vendors-ach-wire-check-card
- https://lopifi.com/md/startups/company-cards-and-receipts
- https://lopifi.com/md/startups/accounts-payable-process-for-startups
- https://lopifi.com/md/tools/duplicates
- https://lopifi.com/md/tools/identifiers
- https://lopifi.com/md/docs/domain/06-procure-to-pay
- https://lopifi.com/md/docs/domain/08-controls-and-audit

- **Track:** [Accounts payable](https://lopifi.com/md/learn/ap)
- **Lesson:** Lesson 6 of 8 — 7 min
- **Terms taught:** [Payment run](https://lopifi.com/md/glossary/payment-run), [ACH](https://lopifi.com/md/glossary/ach), [Wire transfer](https://lopifi.com/md/glossary/wire-transfer), [Outstanding check](https://lopifi.com/md/glossary/outstanding-check), [Positive pay](https://lopifi.com/md/glossary/positive-pay), [Business email compromise](https://lopifi.com/md/glossary/business-email-compromise), [Segregation of duties](https://lopifi.com/md/glossary/segregation-of-duties), [Vendor master](https://lopifi.com/md/glossary/vendor-master)
- **Previous:** [Bills on the books: posting, paying and accruing, AP · Lesson 5](https://lopifi.com/md/learn/recording-bills-and-accrued-expenses)
- **Next:** [Payment fraud: business email compromise and the controls that stop it](https://lopifi.com/md/learn/vendor-payment-runs-and-fraud-controls/payment-fraud-controls)
- **The course:** https://lopifi.com/md/learn