Could someone at my business be paying a fake vendor? How do I check my vendor list and payments for a shell company?

What should I check, step by step?

1. Export the vendor list with addresses, phone numbers, emails, tax IDs and bank details, plus a payments-by-vendor report for the last 12 to 24 months.

2. Compare vendor addresses, phone numbers and bank accounts with employee records from payroll. Compare vendors with each other too: two vendors sharing one bank account or address need an explanation.
3. Pull every vendor created in the review period and check who created it. In QuickBooks Online, the audit log records edits to vendors and can't be turned off. Look for vendors added and paid by the same user.
4. Flag the classic red flags the Journal of Accountancy lists: unfamiliar vendors, a P.O. box as the only address, names made of initials, vague services such as consulting, vendors billing more than once a month, fast-rising spend with one vendor, and big amounts split into invoices just under an approval limit.
5. Check that every vendor you pay for services has a W-9 on file. If you file Forms 1099, the IRS TIN Matching service lets authorized payers check a name and tax ID combination before filing.
6. Confirm a sample of new or unfamiliar vendors exists outside your books: a website, a listed phone number you call yourself, a state business registration, a real street address.
7. Match invoices to evidence the work happened: a purchase order, a delivery, a signed timesheet or a manager who can say what was done. An invoice with nothing behind it is the core of the scheme.
8. Split the jobs: whoever adds or edits vendors shouldn't approve bills or release payments. In a business too small to split them, the owner reviews every new vendor and the payments-by-vendor report each month.
9. If you find something, don't confront anyone yet. Keep the records as they are and talk to your accountant, a fraud examiner or a lawyer first.

How do fake vendor or shell company billing schemes work?

The ACFE defines a billing scheme as getting the employer to pay invoices for fictitious goods or services, inflated invoices, or invoices for personal purchases, and gives the example of an employee who creates a shell company and bills the employer for services never rendered. Its fraud tree splits billing schemes into shell company, non-accomplice vendor, and personal purchases.

• The 2024 report counts 424 billing cases out of 1,921, a median loss of $100,000 and a median loss of $5,600 a month. Small organizations are hit more often: billing schemes appeared in 31% of cases at organizations with fewer than 100 employees and 22% at organizations with 100 or more. An unusually close association with a vendor or customer was a behavioral red flag in 20% of cases.
• The scheme needs three things: a vendor record, an invoice the business accepts, and a payment. Each leaves a trace in the books, which is why the vendor list and audit log are the place to start.

What should I compare in my vendor list to find a fake vendor?

Employee against vendor. The Journal of Accountancy's billing-schemes case was solved by comparing vendor addresses with employees' home addresses. Run the same match on bank account numbers and phone numbers as well, and allow for small formatting differences.

• Vendor against vendor. Two vendor records with one bank account, address or tax ID can be a duplicate, a legitimate parent company, or a fake vendor hiding behind a real one's details.
• Vendor against reality. A vendor with no W-9, no street address, no outside presence and no delivery records behind its invoices should be confirmed by someone other than the person who added it. Form W-9 is the IRS form a vendor uses to give you its correct taxpayer identification number.

How do I approve a new vendor before its first payment?

Most of these checks are after the fact. The control that stops a fake vendor early is approval of the vendor itself, by someone other than the person who added it, before the first payment goes out.

• Rightshold can hold that approval outside your accounting software. request_human_approval hashes the exact vendor record you're approving (your vendor reference, a hash of its bank details, whether a W-9 and TIN check were done) and only the owner's account key can decide it, so the bookkeeper's or an agent's key can't approve its own vendor. Before paying a new vendor, verify_human_approval checks that the vendor record you're about to pay still matches what was approved.
• If an AI agent or another app adds vendors in QuickBooks Online, its changes appear in the audit log as System Administration, not a named user. Route its new vendors through the same owner approval.