Most payment fraud conversations focus on the moment of payment. But many losses are set up weeks earlier, when a vendor record is created or changed. A fraudulent vendor that passes onboarding can be paid again and again, and no one notices because the record looks legitimate.
Strong vendor onboarding is one of the most effective and least expensive fraud controls a contractor can build. It lives in accounting, not in the email filter.
Why Onboarding Is a Target
Attackers use several approaches:
- Creating a fictitious supplier and submitting invoices for plausible materials or services
- Impersonating a real vendor and asking to be set up with new banking details
- Compromising an employee's email to approve or submit a new vendor form
- Pressuring a junior employee to skip steps because the project is urgent
Construction has many vendors, many one-time purchases, and urgent field needs. That environment makes shortcuts tempting.
Build the Process in Layers
Layer One: Require a Standard Intake
Every new vendor starts with the same form, submitted through the same channel. The form should capture legal name, address, tax identification information, contact names, banking details, and the business reason for the vendor. A vendor who cannot or will not complete it is a signal.
Do not accept intake requests from verbal requests, text messages, or ad hoc emails. A single front door is easier to protect.
Layer Two: Verify Independently
Check the vendor's existence and identity using sources you find yourself, not details they provided:
- Confirm the business is registered and in good standing
- Verify the tax identification using your standard process
- Look up a phone number independently and call to confirm the relationship and the banking details
- Check the address, and consider whether it is a real business location
- For subcontractors, confirm licensing and insurance certificates directly with the issuer where feasible
Record who verified, when, and how.
Layer Three: Separate Duties
The person who creates a vendor should not be the person who approves payments to it. The person who changes banking details should not release the payment. In a small team where full separation is impossible, add a second reviewer for new vendors and for any change to payment information.
Layer Four: Review Changes More Strictly Than Creations
Banking change requests deserve extra scrutiny because they are the most common attack. Require:
- A callback to a known number already on file
- A written request through the standard channel
- A second approver
- A temporary hold or a small test payment, where policy allows, before the first large payment
Layer Five: Monitor and Review
Run periodic reports on:
- New vendors added in the last month
- Banking changes made in the last month
- Vendors sharing addresses, phone numbers, or bank accounts with employees or other vendors
- Vendors with no activity that suddenly receive a payment
- Duplicate invoices or payments just under approval thresholds
Have someone outside the payables team review these. A short monthly review is enough to catch problems early.
Train the People Who Receive Requests
Project managers, superintendents, and purchasing staff are often the ones asked to add a vendor quickly. Teach them to send every new vendor to accounting and to say no to workarounds, even when a foreman is waiting. Give them a script: "I can get this vendor set up as soon as the form is verified. It usually takes a day."
Make sure leadership backs them. Controls fail when the person who enforces them gets overruled.
Keep the Records
Maintain the intake form, verification notes, and approval trail. These records support audits, insurance claims, and investigations. If a fraudulent payment does occur, they help you show that reasonable controls existed.
Start Where You Are
If your process is informal today, begin with two changes: require a standard intake form and require a callback to a known number for all banking changes. Those two steps address a large portion of the common attack paths.
Ironfield Cyber helps contractors and energy firms build payment controls that fit their accounting systems and staff. If you would like a review of your vendor setup process, we can walk through it with your finance team.