{
  "question": "Could someone at my business be paying a fake vendor? How do I check my vendor list and payments for a shell company?",
  "slug": "how-to-spot-a-fake-vendor-in-your-accounts-payable",
  "url": "https://www.rightshold.com/answers/how-to-spot-a-fake-vendor-in-your-accounts-payable",
  "short_answer": "Start with the vendor list, not the invoices. In a fake-vendor scheme, someone sets up a company that does nothing, adds it as a vendor, and sends invoices your business pays, often to an account they control. The ACFE calls these billing schemes. In its 2024 Report to the Nations, billing schemes appeared in 22% of the 1,921 fraud cases studied, with a median loss of $100,000 and a typical run of 18 months before discovery. They showed up in 31% of cases at organizations with fewer than 100 employees, against 22% at larger ones. To check, export your vendor list and compare each vendor's address, phone and bank account with your employees' records and with each other. Then look at vendors added recently, vendors with only a P.O. box, vendors without a W-9 on file, vague services like \"consulting\", and invoices just under your approval limit. Check who added each vendor in the audit log. Going forward, the person who adds vendors shouldn't be the person who approves or pays them, and a new vendor should get the owner's approval before its first payment. Not legal, tax or accounting advice.",
  "checklist": [
    "Export the vendor list with addresses, phone numbers, emails, tax IDs and bank details, plus a payments-by-vendor report for the last 12 to 24 months.",
    "Compare vendor addresses, phone numbers and bank accounts with employee records from payroll. Compare vendors with each other too: two vendors sharing one bank account or address need an explanation.",
    "Pull every vendor created in the review period and check who created it. In QuickBooks Online, the audit log records edits to vendors and can't be turned off. Look for vendors added and paid by the same user.",
    "Flag the classic red flags the Journal of Accountancy lists: unfamiliar vendors, a P.O. box as the only address, names made of initials, vague services such as consulting, vendors billing more than once a month, fast-rising spend with one vendor, and big amounts split into invoices just under an approval limit.",
    "Check that every vendor you pay for services has a W-9 on file. If you file Forms 1099, the IRS TIN Matching service lets authorized payers check a name and tax ID combination before filing.",
    "Confirm a sample of new or unfamiliar vendors exists outside your books: a website, a listed phone number you call yourself, a state business registration, a real street address.",
    "Match invoices to evidence the work happened: a purchase order, a delivery, a signed timesheet or a manager who can say what was done. An invoice with nothing behind it is the core of the scheme.",
    "Split the jobs: whoever adds or edits vendors shouldn't approve bills or release payments. In a business too small to split them, the owner reviews every new vendor and the payments-by-vendor report each month.",
    "If you find something, don't confront anyone yet. Keep the records as they are and talk to your accountant, a fraud examiner or a lawyer first."
  ],
  "sections": [
    {
      "heading": "How fake-vendor schemes work",
      "points": [
        "The ACFE defines a billing scheme as getting the employer to pay invoices for fictitious goods or services, inflated invoices, or invoices for personal purchases, and gives the example of an employee who creates a shell company and bills the employer for services never rendered. Its fraud tree splits billing schemes into shell company, non-accomplice vendor, and personal purchases.",
        "The 2024 report counts 424 billing cases out of 1,921, a median loss of $100,000 and a median loss of $5,600 a month. Small organizations are hit more often: billing schemes appeared in 31% of cases at organizations with fewer than 100 employees and 22% at organizations with 100 or more. An unusually close association with a vendor or customer was a behavioral red flag in 20% of cases.",
        "The scheme needs three things: a vendor record, an invoice the business accepts, and a payment. Each leaves a trace in the books, which is why the vendor list and audit log are the place to start."
      ]
    },
    {
      "heading": "What to compare",
      "points": [
        "Employee against vendor. The Journal of Accountancy's billing-schemes case was solved by comparing vendor addresses with employees' home addresses. Run the same match on bank account numbers and phone numbers as well, and allow for small formatting differences.",
        "Vendor against vendor. Two vendor records with one bank account, address or tax ID can be a duplicate, a legitimate parent company, or a fake vendor hiding behind a real one's details.",
        "Vendor against reality. A vendor with no W-9, no street address, no outside presence and no delivery records behind its invoices should be confirmed by someone other than the person who added it. Form W-9 is the IRS form a vendor uses to give you its correct taxpayer identification number."
      ]
    },
    {
      "heading": "Approving new vendors before the first payment",
      "points": [
        "Most of these checks are after the fact. The control that stops a fake vendor early is approval of the vendor itself, by someone other than the person who added it, before the first payment goes out.",
        "Rightshold can hold that approval outside your accounting software. request_human_approval hashes the exact vendor record you're approving (your vendor reference, a hash of its bank details, whether a W-9 and TIN check were done) and only the owner's account key can decide it, so the bookkeeper's or an agent's key can't approve its own vendor. Before paying a new vendor, verify_human_approval checks that the vendor record you're about to pay still matches what was approved.",
        "If an AI agent or another app adds vendors in QuickBooks Online, its changes appear in the audit log as System Administration, not a named user. Route its new vendors through the same owner approval."
      ]
    }
  ],
  "checks": [],
  "ask_rightshold": {
    "start": "https://www.rightshold.com/start?ref=seo",
    "mcp_endpoint": "https://www.rightshold.com/mcp",
    "ask": "Before paying a vendor for the first time, ask me to approve the vendor record: our vendor reference, a hash of its bank details and which checks were done. Wait for my yes or no.",
    "mcp_call": {
      "tool": "request_human_approval",
      "arguments": {
        "action": {
          "type": "vendor_approval",
          "vendor_ref": "V-0142",
          "bank_details_sha256": "<sha256 of routing and account number as stored>",
          "w9_on_file": true,
          "tin_match": "matched",
          "added_by_ref": "<user reference>"
        },
        "summary": "Approve new vendor V-0142 before its first payment",
        "expires_in_minutes": 1440
      }
    },
    "also": [
      "Needs an API key. Only the owner's account key can decide (decide_human_approval); delegated agent keys are refused. The signed, timestamped decision goes on Rightshold's ledger.",
      "verify_human_approval (free) checks a decision receipt and that the vendor record you're about to pay matches the approved action, so a changed bank account doesn't ride on the old approval.",
      "Send references and hashes, not names, tax IDs or account numbers. The summary must not contain personal data.",
      "To keep a record of payments your bookkeeper can't rewrite, seal each vendor payment to a mirror ledger (payment type, your invoice_ref and amount_cents, plus your own vendor_ref) and check it with ledger_verify (free)."
    ],
    "scope": "Rightshold doesn't connect to your accounting software, vendor list or bank, and it doesn't detect fraud or check that a vendor is real. It records the approvals and entries you send and lets anyone verify them. It only stops a payment if your process refuses to pay a vendor without a matching approval. If you suspect theft, talk to your accountant, a fraud examiner or a lawyer before confronting anyone. Not legal, tax, audit or accounting advice."
  },
  "sources": [
    {
      "title": "ACFE: Occupational Fraud 2024: A Report to the Nations (billing schemes: 22% of cases, $100,000 median loss, 18-month median duration; 31% of cases at organizations with fewer than 100 employees)",
      "url": "https://www.acfe.com/en-us/-/media/files/acfe/pdfs/rttn/2024/2024-report-to-the-nations.pdf"
    },
    {
      "title": "Journal of Accountancy: Billing Schemes, Part 1: Shell Companies That Don't Deliver (red flags, vendor vs employee address match)",
      "url": "https://www.journalofaccountancy.com/issues/2002/jul/billingschemespart1shellcompaniesthatdontdeliver/"
    },
    {
      "title": "QuickBooks Online: Use the audit log (vendor edits recorded, can't be turned off, two years, third-party app changes show as System Administration)",
      "url": "https://quickbooks.intuit.com/learn-support/en-us/help-article/audit-log/use-audit-log-quickbooks-online/L2WoVnW6I_US_en_US"
    },
    {
      "title": "IRS: About Form W-9, Request for Taxpayer Identification Number and Certification",
      "url": "https://www.irs.gov/forms-pubs/about-form-w-9"
    },
    {
      "title": "IRS: Taxpayer Identification Number (TIN) Matching",
      "url": "https://www.irs.gov/tax-professionals/taxpayer-identification-number-tin-matching"
    }
  ],
  "related": [
    {
      "title": "How to verify a vendor's bank account change request before you pay",
      "url": "https://www.rightshold.com/answers/how-to-verify-a-vendors-bank-account-change-request-before-you-pay"
    },
    {
      "title": "Signs someone is hiding theft in your bank reconciliation",
      "url": "https://www.rightshold.com/answers/how-to-spot-signs-someone-is-hiding-theft-in-your-bank-reconciliation"
    },
    {
      "title": "How to keep segregation of duties when an AI agent pays bills",
      "url": "https://www.rightshold.com/answers/how-to-keep-segregation-of-duties-when-an-ai-agent-pays-bills"
    },
    {
      "title": "How to stop two AI agents from paying the same vendor invoice twice",
      "url": "https://www.rightshold.com/answers/how-to-stop-two-ai-agents-from-paying-the-same-vendor-invoice-twice"
    }
  ],
  "computed_from": "Curated guidance; license verdicts computed from Rightshold's license profiles at render time. Not legal advice.",
  "updated": "2026-11-09"
}