Vendor Verification: How Procurement Teams Can Prevent Fraud

Depending on the size of your business, your procurement and accounts payable teams may work with dozens or even hundreds of vendors each month. Vendors keep your organization running, but managing so many outside parties creates real fraud risk.

Every contract, invoice, email, and phone call is one more opportunity for a bad actor to steal from your business. A 2022 Creditsafe survey found that more than half of US companies face at least one vendor fraud attempt each year, while 12% see more than 10 attempts annually. Even one successful attempt could mean tens to hundreds of thousands of dollars in losses.

The good news is that there are steps you can take to reduce the risk of vendor fraud without paralyzing your procurement or accounts payable processes. It all starts with vendor verification.

Below, we take a closer look at the different types of vendor fraud your business should be aware of and how vendor verification can help you mitigate these risks. We also offer a guide to help you implement vendor verification within your organization.

What is vendor verification?

Vendor verification is the process of evaluating a vendor’s legitimacy — both before you initially engage with them and over the course of your doing business with them. As such, it falls under the broader umbrella of your Know Your Business (KYB) strategy.

The goal of initial vendor verification is to ensure that the vendor is legitimate and meets your compliance and risk requirements before you engage. Vendor reverification checks whether a vendor’s risk profile has changed and whether their accounts or systems have since been compromised. Together, vendor verification and reverification can be extremely effective at catching many types of vendor fraud.

What are the common types of vendor fraud?

Vendor fraud can take several different forms, each of which works differently and poses a distinct risk to your organization.

Vendor impersonation fraud (vendor spoofing)

A bad actor poses as a known vendor and exploits your existing relationship to divert payments to their own accounts. Often, they spoof the vendor’s legitimate email domain by creating an email address nearly identical to the one you are familiar with. Then, they use that email to submit an invoice in the hopes that you’ll pay. Alternatively, they may submit a change request with new banking details so they will receive future payments for invoices submitted by the vendor.

Vendor email compromise or account takeover

When a bad actor gains access to a legitimate vendor’s email account through phishing, credential theft, or similar means, they can use it to submit fraudulent invoices or request banking detail changes, redirecting future payments to their own account. Similarly, if you require your vendors to log into a procurement system or portal to submit invoices, a bad actor may attempt to take over their account to change payment details and submit fraudulent invoices.

Business impersonation fraud

A bad actor impersonates a legitimate business to become one of your vendors. Once onboarded, they submit a fake invoice or deposit request and then ghost you after they’ve received payment. Business impersonation is often powered by cloned websites, fake social media profiles, and spoofed email addresses created specifically to make the business appear legitimate during onboarding.

Ghost vendor fraud

Instead of impersonating a legitimate business, a bad actor creates an entirely fictional enterprise with the goal of onboarding as a vendor with your organization. Once onboarded, they submit invoices or deposit requests for work that has not been done (and will never be done).

Invoice fraud

A legitimate vendor submits a fraudulent invoice in the hopes that you will pay without asking questions. Alternatively, they may submit duplicate invoices to try to double bill or overbill you for work that has been completed.

Why does automated vendor verification matter for procurement teams?

The most obvious benefit of implementing vendor verification is that it can help you detect and mitigate many types of fraud that could otherwise result in theft, redirected payments, and other financial losses. But that’s not the only benefit. Vendor verification can also help you reduce compliance risk while improving operational efficiency if thoughtfully automated.

Compliance risk

At a minimum, you’ll need to be sure that none of the vendors you engage with (or their owners) are included on a sanctions list. Likewise, you’ll need to verify the vendor’s tax identification number (TIN).

Depending on the industry and jurisdictions you operate within, you may also be subject to one or multiple compliance requirements that further influence the vendors you can and can’t engage with. For example, you may be prohibited from engaging with vendors that operate within certain restricted industries (like the marijuana industry) or high-risk jurisdictions. Standardizing your vendor verification process to include these checks by default can go far in reducing your overall compliance risk.

Operational efficiency

If you’re currently handling vendor verification manually, you already know what a slog it can be. Back-and-forth emails between your team and the vendor requesting forms, IDs, and other documents; correction requests for the inevitable errors that pop up; manual checks of sanctions lists, Secretary of State (SOS) registries, and other databases — it all takes time. The longer it takes to onboard your vendors, the longer it’ll take for them to get started delivering what you’re hiring them to deliver.

Automating your vendor verification processes gives you the opportunity to streamline how you onboard new vendors. Instead of multiple emails requesting forms and documents, you can have a single workflow that collects everything up front. Instead of requesting corrections, the vendor can be notified immediately when an error occurs. Instead of manual database checks, you can check them in real-time to speed your decisioning.

How to implement vendor verification

There is no single correct way of verifying vendors that applies to all businesses. The vendor verification strategy that’s right for you depends on a number of factors, including:

The industries and jurisdictions you operate within
The laws and regulations you’re subject to
Your unique tolerance for risk

That said, the framework below offers a solid jumping-off point you can use to begin designing your strategy.

1. Determine what you should verify

In order to implement vendor verification, you first need to determine what information you will collect and verify.

As noted above, this will be heavily influenced by the industry and jurisdictions you operate within. Some broad categories to consider include:

Business legitimacy: Checks that confirm a vendor is a real, operating business entity, such as business registration verification, business document verification, Secretary of State (SOS) filing checks, and address lookup.
Beneficial ownership: Checks that verify the identities of a vendor’s ultimate beneficial owners (UBOs), such as government ID verification, document verification, selfie verification, and database verification.
Tax and compliance: Checks that confirm a vendor’s tax status, such as TIN verification, VAT validation (for international vendors), and business license verification.
Payment information: Checks that confirm a vendor’s payment and remittance details. This is typically focused on bank account validation.

2. Consider supplemental screenings and risk reports

The verifications outlined above will help you determine if a vendor and its owners are real and legitimate but may not offer insight into their broader risk profile. For this additional context, you’ll likely need to layer on additional screenings such as:

Sanctions and watchlist screenings: Database checks to ensure that neither a vendor nor its beneficial owners are sanctioned or on a global watchlist.
Politically exposed persons (PEP) screenings: Database checks to determine if a vendor or its beneficial owners have political connections that warrant further scrutiny.
Adverse media screenings and social media lookups: Database checks to surface negative news reports or social media activity that can help you gauge the legitimacy and trustworthiness of a vendor.
Web presence, phone, and email risk reports: Reports that gauge the age and reputation of a vendor’s website, email address, and phone number.

While some of these screenings (such as sanctions list screenings) are required for all vendors, you might decide to reserve others only for vendors that meet certain criteria. Only you can decide what risk signals or scoring should trigger these additional screenings.

3. Determine when you should verify

To protect yourself from many types of vendor fraud and meet compliance requirements, you’ll want to perform verification before you sign any contracts or issue purchase orders.

But that’s not the only time you can or should perform verification. Other times it can make sense include:

Before you issue your first payment: This can be a good time to validate the vendor’s bank account information, even after initial verification is complete.
When you detect suspicious or risky activity: Reverifying during these moments, such as when a vendor submits a particularly large invoice or attempts to change account details like payment information, can help you avoid vendor impersonation or spoofing attempts initiated by a fraudster.
Periodically: Reverifying regularly, such as annually or when a vendor ID or document expires, can protect against fraudsters taking over dormant accounts.

4. Consider how you can streamline verification

Vendor verification can be a heavy lift if you perform it manually. But there are several ways you can streamline the process.

The most impactful change you can make is adopting automated KYB or vendor verification software. These offerings make it possible for you to collect, validate, and verify all of the necessary information and evidence (IDs, documents, etc.) much faster and often with greater accuracy than manual processes.

If you’re worried about friction, consider a solution that allows for progressive risk segmentation. This allows you to tailor the level of friction a vendor experiences to the amount of risk you detect during onboarding. Under such a framework, vendors deemed low risk might be asked to provide less information and evidence or be subject to fewer verification checks than vendors deemed a higher risk. This can also help you control costs if your solution charges on a per-verification basis.

Finally, consider whether the solution you choose is capable of integrating directly into your procurement software or vendor management platforms like Ramp, Zip, Ariba, etc. The right integrations can go far in not only streamlining your processes, but also reducing friction for your vendors.

Persona’s approach to vendor verification

Here at Persona, we understand how important it is that you have confidence in any business that you decide to engage with, whether it be a vendor, a supplier, or even a contractor. That’s why we’ve built KYB solutions specifically designed to empower you to verify that a business or individual is who they say they are while gauging their risk of fraud.

With Persona’s KYB solution, you can automatically:

Screen vendors and their UBOs against sanctions lists, watchlists, PEP databases, and more to ensure that engaging with them doesn’t violate applicable regulations
Perform additional online credibility reports, including adverse media screenings and social media screenings, to further inform your decision whether to engage with a vendor
Collect and verify a vendor’s taxpayer ID, business registration, Secretary of State filing, and other business documents to ensure they’re a legitimate entity
Establish reverification protocols to take place periodically or during high-risk moments
Continuously monitor vendors and their UBOs with relevant screenings and reports to understand any changes to their reputation or risk profile

Ready to learn more about how Persona can help you get vendor verification right? Reach out today to speak with a member of our team.

Vendor verification: How procurement teams can prevent fraud and streamline onboarding