# Payment fraud: business email compromise and the controls that stop it

> Business email compromise, the vendor bank-detail change it runs through, and the segregation-of-duties controls that stop it.

Source: https://lopifi.com/learn/vendor-payment-runs-and-fraud-controls/payment-fraud-controls
Part of: Lopifi — US GAAP books on autopilot, checked by a CPA (https://lopifi.com)

---

**How do you stop vendor payment fraud and business email compromise?** Business email compromise, the vendor bank-detail change it runs through, and the segregation-of-duties controls that stop it.

The most expensive AP fraud is not a hacked bank. It is an email that looks like a real vendor's, asking for future payments to go to a new account. That is [business email compromise](https://lopifi.com/md/glossary/business-email-compromise), and the FBI's Internet Crime Complaint Center reported over $55 billion of exposed losses to it between October 2013 and December 2023. It works where one person can change a vendor's bank details and release a payment the same afternoon.

> “Use secondary channels and/or two-factor authentication to verify requests for changes in account information.”

— [FBI IC3 public service announcement, “Business Email Compromise: The $55 Billion Scam” (Sept. 11, 2024)](https://www.ic3.gov/PSA/2024/PSA240911), Business email compromise

| Control | What it stops |
| --- | --- |
| Bank-detail changes verified by calling a number already on file | A fake email changing where the money goes |
| Bank details versioned in the vendor master, never overwritten | A change nobody can trace afterwards |
| Whoever edits a vendor does not release payments to it | One person creating and paying a fake vendor |
| Whoever enters a bill does not approve it | Paying an invoice nobody checked |
| Two people to release a run above a threshold | One compromised login moving a large payment |
| Positive pay on checks | Altered or counterfeit checks |
| Monthly review of the payment register by someone outside AP | Anything the other controls missed |

The controls that stop it, and what each one stops.

— [SEC Release 33-8238 (June 2003) — Sarbanes-Oxley §404](https://www.sec.gov/rule-release/33-8238), Management's report on internal control over financial reporting

> **If a payment went to the wrong account.** Call the bank at once and ask for a recall of the funds; the FBI's guidance is that time is of the essence. Then file a complaint at ic3.gov, whatever the amount, and only then fix the vendor record.

> **Segregation of duties is the fraud control: no one person can both change where money goes and send it.**

## Where this page's rules come from

- [FBI IC3 public service announcement, “Business Email Compromise: The $55 Billion Scam” (Sept. 11, 2024)](https://www.ic3.gov/PSA/2024/PSA240911) — Business email compromise (agency)
- [SEC Release 33-8238 (June 2003) — Sarbanes-Oxley §404](https://www.sec.gov/rule-release/33-8238) — Management's report on internal control over financial reporting (sec)
- [Wikipedia, “Email spoofing”, § Business email](https://en.wikipedia.org/wiki/Email_spoofing#Business_email) — Business email compromise (reference)
- [Wikipedia, “Separation of duties”](https://en.wikipedia.org/wiki/Separation_of_duties) — Separation of duties (reference)

## Read further

- https://lopifi.com/md/startups/how-to-pay-vendors-ach-wire-check-card
- https://lopifi.com/md/startups/accounts-payable-process-for-startups
- https://lopifi.com/md/docs/domain/08-controls-and-audit

- **Track:** [Accounts payable](https://lopifi.com/md/learn/ap)
- **Part of:** [Payment runs, payment methods and fraud controls](https://lopifi.com/md/learn/vendor-payment-runs-and-fraud-controls) — 6 min
- **Terms taught:** [Business email compromise](https://lopifi.com/md/glossary/business-email-compromise), [Segregation of duties](https://lopifi.com/md/glossary/segregation-of-duties), [Vendor master](https://lopifi.com/md/glossary/vendor-master), [Positive pay](https://lopifi.com/md/glossary/positive-pay)
- **Previous:** [Payment runs, payment methods and fraud controls](https://lopifi.com/md/learn/vendor-payment-runs-and-fraud-controls)
- **Next:** [AP aging and days payable outstanding, AP · Lesson 7](https://lopifi.com/md/learn/ap-aging-and-days-payable-outstanding)
- **The course:** https://lopifi.com/md/learn