Most conversations about payment fraud focus on emails asking to change a bank account. A related problem begins earlier: a fraudulent vendor gets added to the system in the first place. Once a fake supplier exists in your accounting software with a valid-looking record, invoices can be paid like any other.
Strong onboarding is a quiet control. It takes a few extra minutes per vendor and removes a whole category of loss. It also protects against insiders who might create a vendor for personal gain.
How Fake Vendors Get In
- An outsider emails a plausible request to become a supplier, with a convincing W-9 and invoice.
- A criminal impersonates a real supplier and submits new account information as if it were an existing vendor.
- An employee with excess system access creates a vendor and approves its invoices.
- Someone duplicates an existing vendor with a slightly different name and different banking details.
Construction companies are exposed because they add new vendors constantly: subcontractors, suppliers, rental yards and consultants for each project.
A Vendor Onboarding Process
1. Use a standard request form
Require every new vendor to complete a form with legal name, address, tax identification, contacts and banking details. Do not accept information by informal email or text. A consistent form makes anomalies easier to see.
2. Verify the business exists
Confirm that the company is real before setting it up. Reasonable checks include:
- Matching the legal name and tax ID on the W-9 to an official record where available.
- Confirming the business address, and viewing it through public maps or records.
- Checking that contractor licenses and insurance certificates, where required, are valid by contacting the issuer using independent contact details.
- Looking for a real web presence and verifiable references.
3. Verify banking details independently
Call the vendor at a phone number you have obtained independently, not from the request itself, and confirm the account details verbally with someone known to you. Some companies use bank account validation services; if you do, understand what the service actually verifies. Record who performed the verification and when.
4. Separate the duties
The person who requests a vendor should not be the one who creates it, and neither should approve payments to it. Where a small team cannot fully separate duties, add an independent review of new vendors by an owner or controller.
5. Check for duplicates and conflicts
Before creating a record, search for similar names, tax IDs, addresses and bank accounts. Duplicates may point to a mistake or fraud. Many companies also compare vendor addresses and bank accounts against employee records to find conflicts.
6. Limit first payments
Apply extra scrutiny to the first payment to any new vendor, especially large ones. A second approval or confirmation call before the first payment is inexpensive insurance.
Controls After Onboarding
Onboarding is only the start. Keep these in place afterward:
- Any change to bank details triggers the same verification as a new vendor.
- A monthly report shows all new and changed vendor records for review.
- Inactive vendors are deactivated after a defined period, so dormant records cannot be used.
- Access to edit vendor records is limited, and audit logs are retained.
Special Issues in Construction
- Subcontractor churn. Short project timelines tempt teams to rush setup. Build a standard turnaround so the process is quick, not skipped.
- Joint ventures and affiliates. Payments may route through other entities, so confirm the payee matches the contract party.
- Lien waivers and compliance documents. Collect them from the verified vendor identity, not from forwarded emails.
- Emergency work. Storm response and urgent repairs create pressure to bypass controls. Have a documented fast-track with extra approvals instead.
Training and Culture
Staff who set up vendors should know why the steps exist. Give them explicit permission to slow down and ask questions, even when a project manager is pushing. Practice with a hypothetical scenario: a vendor requests setup and payment within a day, and the contact will not take a phone call. What does your team do? The right answer is to pause.
Keep Records
For each vendor, keep a file showing the request, the verification steps performed, who approved it and when. If a payment dispute ever arises, or if you need to show an insurer or auditor your controls, this record matters.
Putting It in Place
If you do not have a written vendor onboarding procedure, start with a one-page checklist and a standard form. Ironfield Cyber helps finance teams in construction and energy build payment controls that fit their systems, including configuring approvals and reports in accounting software. We are glad to review your current process.