Supplier Registration and the Bank Fraud Gap Nobody Rechecks
Most businesses treat supplier registration as a one-time event. A supplier submits identity, tax and bank details, someone checks them, and the record is trusted from that point forward. That single moment of scrutiny is also the last real check most vendor records ever get, and it is exactly where the exposure begins.
The exposure is not at supplier setup
The real risk sits at the point of change, months or years later, when a bank detail update arrives by email and is accepted on human judgement alone. A director of global procurement described it plainly: emails from a compromised vendor mailbox are indistinguishable from a genuine request, and bank accounts get changed as a result.
Fraud is growing fast enough that this gap matters more each year. TransUnion reports that close to 8% of global revenues are lost to fraud, and Juniper Research forecasts losses will keep climbing sharply through the end of the decade as social engineering and impersonation techniques improve.
One global survey of business leaders found that 24% named scam and authorised fraud as the leading cause of loss, ahead of synthetic identity fraud and account takeover, which tied at 20% each. Supplier registration sits directly upstream of all three.
The validation gap. Scrutiny is concentrated at creation, then absent for the whole life of the record.
How the fraud actually works
The pattern behind most of these losses is well understood, and it works on four levers. Authority discourages pushback, because the request appears to come from a senior executive. Urgency removes the time to verify, framed as a wire that has to go out today.
Isolation, dressed up as confidentiality, stops the employee checking with a colleague before acting. Plausibility comes from timing the request against a real acquisition, a year-end crunch, or another moment when an unusual payment would not seem out of place.
A fraudster researches the target company on LinkedIn, monitors email patterns through a single compromised account, and sends a message from a lookalike domain such as “compary.com” in place of “company.com”. The wire instructions look like a legitimate vendor payment, and the money moves offshore within hours.
Why payment-rail checks are not enough
Confirmation of Payee in the UK and Verification of Payee in the EU are useful controls, but they only confirm that a name matches an account at the payment rail. Neither proves the account actually belongs to your supplier, which is the distinction that matters most.
When supplier data is fragmented at source, with procurement creating records, finance updating bank details, and regional offices adding entities, no single team owns reconciliation. The result is thousands of vendors sharing addresses or accounts, and roughly half of vendor data out of date at any given moment.
Where supplier registration needs to catch up
This is exactly where a properly governed supplier registration process earns its value. Not by checking a name against a bank, but by validating every change against an independent source before it reaches your systems, at intake and every single time a detail is updated afterwards.
This is the gap the HICX report, Are You Inviting Trouble?, examines in detail. It sets out why records verified once at creation and never rechecked have become one of the highest-risk points in the payment cycle, and what a governed supplier registration process looks like in practice.
If bank detail changes at your organisation still move on email and judgement alone, the report is worth 15 minutes of your time. Read the full report here.
Posted in
