AP Automation Fraud Controls: What to Test Before You Buy
- How does AP automation reduce fraud risk in accounts payable?
- How do you test vendor bank-change verification?
- How does AP automation reduce invoice fraud?
- Why is check fraud so common in AP, and how do companies prevent it?
- What should a vendor prove before you sign?
- Build fraud controls into every payment with Corpay
AP automation reduces fraud by applying the same controls to every invoice and payment, with no quiet override. That makes accounts payable fraud prevention testable, so test it in the demo, starting with vendor bank changes and duplicate invoices.
The pressure is real. According to AFP's 2026 Payments Fraud and Control Survey, 76% of U.S. organizations experienced attempted or actual payments fraud in 2025. Every vendor you're evaluating knows that number, and every demo will include a slide about fraud controls. The slide isn't the control. Ask to try breaking the system yourself.
Key Takeaways
AP automation cuts fraud risk by enforcing the same rules on every invoice and payment, logging every action, and stopping one person from overriding a control alone.
The bank-change workflow is the most important control to test, since most payment fraud ends with a request to send money to a new account.
Duplicate detection should catch reformatted invoice numbers and split invoices as well as exact matches.
Segregation of duties only counts if the system blocks a user from approving an invoice they entered or a payment to a vendor they added.
Payment rails limit the damage when something gets through, which is why single-use virtual cards and positive pay belong in the evaluation.
How does AP automation reduce fraud risk in accounts payable?
AP automation reduces fraud risk by running every invoice and payment through the same checks, with matching, approval routing, and bank-detail verification enforced by the system instead of by habit. It also records who did what, so a gap shows up in the log.
The mechanism matters more than the feature list. Manual AP controls depend on people following the procedure every time, including on the Friday before close. Automated controls run whether anyone remembers them or not. The ACFE's Occupational Fraud 2026: A Report to the Nations found that the presence of an internal control reduced fraud losses by 37% on average, and that a lack of internal controls was the most cited primary weakness, at 33% of cases.
Most schemes are well documented in this guide to accounts payable fraud. A buyer's question is narrower. Does this platform enforce the control, or merely offer it?
Use the table as a demo script. Ask the vendor to run each test live on a sandbox, with you choosing the data.
Control | How to test it in the demo | What a pass looks like |
Vendor bank-change verification | Request a bank change by email, in the vendor portal, and as an internal user | Change is held, verified out of band, and approved by a second person before any payment |
Duplicate invoice detection | Submit the same invoice with a reformatted number | System flags it before approval, with the original shown |
Split invoice detection | Submit two invoices just under an approval limit | System flags the pair or routes both to the higher approver |
Approval bypass | Have the invoice entrant try to approve it | Blocked, and the attempt is logged |
Vendor master segregation | Have the user who added a vendor try to pay it | Blocked or routed to someone else |
Payment release | Try to release a payment batch with one login | Requires a second approver above your threshold |
Audit log | Ask for the log of everything you just did | Every action shows user, time, and before-and-after values |
How do you test vendor bank-change verification?
Test vendor bank-change verification by trying to change a vendor's bank account through every channel the platform accepts, then watching what happens before the next payment. A passing system holds the change, verifies it through a channel the requester didn't supply, and needs a second approver.
This is the test I'd fight hardest to run. Most payment fraud ends with a request to send money somewhere new, whether it arrives as an email from a "vendor," a call to AP, or a login to the supplier portal. Business email compromise alone caused $3,046,598,558 in reported losses in 2025, according to the FBI's 2025 Internet Crime Report. The schemes behind those losses are laid out in this explainer on business email compromise in AP, and newer variants that start inside a real vendor's mailbox are covered in this piece on vendor email compromise.
Run the test in this order:
Email AP from an outside address that looks like a real vendor and ask for new bank details. See whether anyone can enter that change without a callback.
Log in to the vendor portal as the vendor and change the account. Check whether the change takes effect immediately.
Have an internal AP user change the bank account on the vendor record. Check whether a second person has to approve it.
Ask whether the platform validates the new account, confirming the account exists and the name matches, as described in this guide to bank account validation.
Schedule a payment right after the change and see whether it's held.
The regulators are moving the same way. Nacha's fraud monitoring rules took effect March 20, 2026, for non-consumer ACH originators with 6 million or more entries in 2023, according to its Phase 1 guidance. From June 19, 2026, the Phase 2 rules extend that to all non-consumer originators, regardless of volume, and require risk-based processes to identify fraudulent entries, reviewed at least once a year. Nacha's own examples include change controls on vendor payment instructions. If you originate ACH, the bank-change control in your AP platform is now part of your compliance story.
Who collects the bank details matters as much as how they're checked. Corpay's fully managed AP enrolls suppliers and collects their payment details as part of the service, so AP staff aren't the ones taking a new account number over the phone.
What should happen to payments already scheduled?
Payments already scheduled to a vendor whose bank details just changed should be held until the change is verified. A platform that verifies the change but still releases tomorrow's payment to the new account hasn't stopped anything.
Ask the vendor to show you the hold, not describe it. A common gap is a bank change verified correctly while a payment already queued for the next day goes out to the new account anyway, because the batch was built before the change and nobody rebuilt it. The control works. The timing doesn't.
Protect cash flow with modern AP
Modernize AP to cut costs, speed approvals, and mitigate payment risk — gaining the real-time visibility to protect cash flow and scale with confidence.
Download the whitepaper
How does AP automation reduce invoice fraud?
AP automation reduces invoice fraud by checking every invoice against the purchase order, the receipt, and past invoices before it can be approved. It catches duplicates, inflated amounts, and invoices from vendors that don't exist, and routes anything unusual to a person.
Billing schemes are where this pays off. In the ACFE's 2026 study, billing schemes made up 21% of 2,402 occupational fraud cases, with a median loss of $90,000 and a median duration of 14 months before anyone caught them. Fourteen months is a long time for a fake vendor to get paid, and a lot of that time is invoices that looked normal one at a time.
Test duplicate and invoice-level detection with cases that real fraud uses:
The same invoice resubmitted with the number reformatted, such as "INV-1043" and "1043"
The same amount and date from the same vendor with a different invoice number
Two invoices from one vendor just under an approval limit on the same day
An invoice with no matching purchase order or receipt, for a vendor added last week
A vendor whose bank account or address matches an employee's
Exact-match duplicate checks are table stakes, and the reformatted and near-duplicate cases are where platforms differ. This explainer on duplicate payment detection covers the matching logic in more depth. For PO-backed spend, check that three-way matching runs at the line level, so an invoice can't sneak through with one inflated line.
Can someone approve their own invoice?
In a well-configured platform, no. The system should block a user from approving an invoice they entered, paying a vendor they added, or releasing a payment batch they built, and it should log every attempt.
Test it with real roles. Create a user with entry and approval rights and try it. Some platforms allow it by default and expect you to configure the restriction, which is fine if you know, and dangerous if you don't. Check the results against your segregation of duties in AP, and ask who can change roles. An administrator who can grant themselves approval rights is a bypass with extra steps. Every role change should land in the AP audit trail with a name and a timestamp.
Why is check fraud so common in AP, and how do companies prevent it?
Check fraud is common because a paper check carries the company's bank account number and travels through the mail, where it can be stolen and altered. Companies prevent it with positive pay and by paying fewer vendors by check.
The numbers are stubborn. AFP's 2026 survey found that 58% of organizations reported checks are subject to fraud. Mail theft made it worse. FinCEN's 2023 alert on mail theft-related check fraud reported that check-fraud suspicious activity reports passed 680,000 in 2022, nearly double the more than 350,000 filed in 2021. The rise of check fraud has outpaced most companies' controls.
In a demo, ask how the platform handles the checks you still write:
Does it send a positive pay file to your bank before checks are mailed?
Who holds the check stock, and who signs?
Can it move check-paid vendors onto electronic payments, and who does the outreach to make that happen?
Which payment-rail controls limit losses?
Payment-rail controls limit how much a fraudster can take when another control fails. Single-use virtual cards, positive pay for checks, and ACH debit blocks on your accounts are the three that matter most for AP.
A single-use virtual card is good for one amount and one vendor, so a stolen card number is worth almost nothing. Corpay pays suppliers by virtual card, ACH, or check from one approval flow, and its single-use virtual cards are issued for one payment at a time. The fraud mechanics of single-use cards are covered in this guide to single-use cards and fraud prevention. ACH needs its own protection, including debit blocks and filters at the bank, as these tips on preventing ACH credit fraud explain.
What should a vendor prove before you sign?
Before you sign, the vendor should run your tests live, show you the audit log for everything you did, and name every role that can override a control. If it can't do those three things in a sandbox, assume it can't do them in production.
Ask for one more thing, a customer reference who has had a fraud attempt on the platform. How the system and the vendor's team behaved during a real attempt tells you more than any demo.
One area no demo fully covers is invoices written by AI tools, with clean formatting, plausible line items, and real vendor names. Matching against POs and receipts still catches most of them, because a fake invoice has no receipt behind it. Non-PO spend is harder, and I don't think anyone has a complete answer yet.
Build fraud controls into every payment with Corpay
The test list above keeps coming back to the moment a payment goes to a new account, or a check leaves the building.
Corpay AP automation runs invoices and payments through one approval flow, and Corpay pays suppliers by virtual card, ACH, or check from it. Corpay virtual cards are single-use, issued for one payment and one supplier. Corpay's fully managed AP enrolls suppliers, collects payment details, and handles follow-up, so your AP team isn't fielding bank-change requests. Corpay connects through 100+ ERP integrations, including NetSuite, Sage Intacct, Business Central, and Acumatica, AP teams save about 40% of the time they spend on processing, and most customers are live in weeks.
Frequently Asked Questions
How does AP automation prevent fraud?
AP automation prevents fraud by enforcing matching, approval routing, duplicate checks, and bank-change verification on every invoice and payment, and by logging every action. It also stops one person from entering, approving, and paying the same invoice.
What are the key internal controls for accounts payable?
The core internal controls for accounts payable are segregation of duties, three-way matching, duplicate invoice checks, verified vendor bank changes, dual approval for payment release, positive pay for checks, and a complete audit trail of every change.
How do you test fraud controls in an AP software demo?
Ask the vendor to run your tests live in a sandbox. Try to change a vendor's bank account, submit a reformatted duplicate, approve your own invoice, and release a payment alone, then review the audit log of every attempt.
How do companies prevent check fraud?
Companies prevent check fraud by sending a positive pay file to the bank before checks are mailed, keeping check stock locked, separating who prints and signs checks, and moving vendors off checks onto ACH or virtual cards.
What is the most common type of AP fraud?
Billing schemes are among the most common types of AP fraud, including fake vendors, inflated invoices, and duplicate invoices. In the ACFE's 2026 study they ran a median 14 months before detection, which is why automated invoice checks matter.
- How does AP automation reduce fraud risk in accounts payable?
- How do you test vendor bank-change verification?
- How does AP automation reduce invoice fraud?
- Why is check fraud so common in AP, and how do companies prevent it?
- What should a vendor prove before you sign?
- Build fraud controls into every payment with Corpay
Switch to Corpay
Discover how making the move to Corpay streamlines payments and strengthens your business.
Talk to an ExpertSmarter payments. Stronger growth. Keep business moving.
Corpay powers payments for 800,000+ businesses worldwide. Let’s build what’s next for yours.