Red Flags in a Vendor’s Banking and Remittance Details You Should Never Ignore
Most payment fraud doesn’t announce itself. It doesn’t arrive in a poorly worded email from a Nigerian prince. It shows up looking almost exactly like a routine vendor update — a polite note, a new bank account number, maybe a slightly different email address. By the time you notice the money is gone, it’s already been swept through three intermediary accounts and converted to cryptocurrency. Remittance fraud is a precision crime, and it preys on businesses that have never built the habit of questioning what looks normal.
The warning signs are consistent enough that once you know them, they become hard to unsee. The problem is that most accounts payable teams only learn them after a painful incident. This article walks through the specific, concrete red flags that should make you stop, pick up the phone, and verify before you approve any payment.
1. A Bank Account Change Request Arrives by Email Alone
This is the single most common setup for vendor impersonation fraud, also called business email compromise (BEC). A fraudster gains access to a vendor’s email — or simply spoofs a convincing lookalike domain — and sends your AP team a friendly note explaining that the vendor has switched banks and all future payments should go to a new account. The email looks legitimate. It may even reference a real invoice number.
The rule here is blunt: no banking change should ever be processed based solely on an email request. Full stop. Your verification protocol must require a phone call to a number already on file — not a number provided in the email — and ideally a second sign-off from a manager before the change is made. The FBI’s Internet Crime Complaint Center (IC3) consistently ranks BEC among the highest-loss cybercrime categories, with annual losses in the billions. A simple callback policy eliminates the majority of these attempts.
2. The Routing Number Doesn’t Match the Claimed Bank
Every legitimate U.S. bank account has an ABA routing number tied to a specific financial institution. If a vendor tells you they bank with Chase and the routing number they provide belongs to a small credit union in another state, that’s a payment red flag worth investigating immediately. You can cross-reference routing numbers against the Federal Reserve’s published database or a number of free lookup tools in under sixty seconds.
Fraudsters sometimes use real but obscure routing numbers, counting on the fact that AP teams rarely verify them. They also sometimes use routing numbers for prepaid debit card processors — accounts that are difficult to trace and easy to drain quickly. If the routing number resolves to anything other than a major commercial bank or a financial institution you can actually call and verify, treat it as suspect. This check costs you nothing and takes less than a minute.
3. The Account Name Doesn’t Match the Vendor’s Legal Name
When you send a wire transfer or ACH payment, you’re providing a routing number and account number. Most U.S. bank systems don’t automatically verify that the account name matches what you’ve entered — the money goes where the numbers point, not where the name says. This is a known gap in the payment system, and fraudsters exploit it deliberately.
Always ask for written confirmation of the exact legal name on the account and compare it against your vendor’s W-9 or onboarding documents. If a vendor says their business name is “Atlantic Electrical Services LLC” but the account is held under “AES Holdings,” you need an explanation before you pay. Legitimate discrepancies happen — a vendor may bank under a parent company name — but those discrepancies should be documented and verified, not assumed to be fine.
4. Payment Instructions Are Buried in an Invoice PDF
Fraudsters who compromise a vendor’s email account will sometimes modify invoice PDFs before forwarding them to the victim company. The body of the email looks normal, the invoice number is correct, but buried in the footer or remittance section is a new bank account number. Because the document looks official, AP teams process it without cross-referencing previous payment records.
Your policy should require that banking details in any invoice be compared against the master vendor record in your accounting system before payment is released. If the details don’t match, that’s not an administrative quirk to work around — that’s a flag to escalate. It’s also worth auditing how your team handles PDF invoices specifically, since they’re a common vector for this type of manipulation. Even a minor discrepancy in font or formatting can sometimes indicate a modified document.
5. The Vendor Is Unusually Urgent About Getting Paid to a New Account
Pressure is a social engineering tool. Fraudsters know that urgency short-circuits careful thinking, so they manufacture it. You’ll see language like “our old account is being closed today,” “we need this processed before end of business or there will be service interruption,” or “our accountant made an error and funds sent to the old account will be lost.” Any of these should slow you down, not speed you up.
Legitimate vendors understand that banking changes require verification. If a real vendor is pushing back on a reasonable verification request, that’s a relationship conversation worth having — but it doesn’t justify bypassing your controls. Fraudsters, on the other hand, will disappear or escalate pressure when asked to verify through official channels. The urgency itself is diagnostic. A genuine business partner doesn’t need you to skip your security protocols.
6. The New Account Is Overseas When the Vendor Is Domestic
If you’ve been paying a Florida-based contractor via ACH for two years and they suddenly request a wire to a foreign bank account — especially in a jurisdiction with limited financial oversight — that should trigger an immediate hold and a direct call to your primary contact at the vendor using a number you’ve independently verified.
International wire fraud is harder to reverse than domestic ACH fraud. Once a wire hits a foreign account, recovery is extremely difficult and often impossible. Some jurisdictions have no meaningful cooperation with U.S. law enforcement, and the money moves fast. This doesn’t mean that all foreign payment requests are fraudulent — businesses do have legitimate international banking relationships — but the combination of a sudden change, a foreign account, and any of the other flags on this list is reason to pause the entire payment until you can get a video call with a known contact at the vendor company.
7. The Vendor Was Recently Onboarded and the Banking Details Can’t Be Independently Verified
New vendor fraud is underappreciated as a risk category. Someone creates a convincing business entity — often a real LLC with a real EIN, set up specifically to defraud — submits it for vendor onboarding, performs a small amount of legitimate work or none at all, and then submits a large invoice. Because they’re new, there’s no payment history to compare against. Because they did some work, the payment seems earned.
Your vendor onboarding process should include verification steps that go beyond accepting whatever documents the vendor provides. For significant payment amounts, that means calling the bank listed on the W-9 to confirm the account exists and matches the business name, checking the business against state registration databases (in Florida, that’s the Division of Corporations through Sunbiz), and having a manager review the first payment. The investment of thirty minutes in due diligence on a new vendor can prevent a five-figure loss.
8. The Email Domain Is Off by One Character
Typosquatting — registering a domain that’s one letter or character away from a legitimate vendor’s domain — is cheap, easy, and devastatingly effective. “atlant1c-electrical.com” versus “atlantic-electrical.com.” “vendorname-invoicing.com” versus “vendorname.com.” These are easy to miss when you’re processing twenty invoices on a Tuesday afternoon.
Train your AP team to check the full email address, not just the display name, on any payment-related correspondence. Display names are completely spoofable — anyone can make an email appear to come from “John Smith at Atlantic Electrical” while the actual sending address is a lookalike domain. Some email clients hide the full address by default; your team should know how to check it. Building a master list of verified vendor email domains and cross-referencing it during payment processing is a low-tech but effective control.
9. Remittance Details Change Immediately After a Data Breach or Vendor Incident
If a vendor notifies you of a cybersecurity incident — or if you read about one in the news — treat any subsequent payment instruction changes from that vendor as potentially compromised until you’ve done out-of-band verification. This includes calls, video verification, or written confirmation via a secondary channel you’ve independently established.
This scenario is more common than most businesses realize. Attackers who compromise a vendor’s systems will often lurk in email accounts for weeks, studying communication patterns before they make a move. They wait for a large invoice cycle, then intercept or redirect payment instructions at the optimal moment. A vendor breach is a signal to tighten your verification process temporarily, not to relax it.
Remittance fraud succeeds because it’s designed to look routine. The accounts involved often pass a surface-level check; the emails read professionally; the urgency feels plausible. What it can’t survive is a team that’s been trained to pause on specific signals and verify through independent channels. None of the controls described here require expensive software — they require policy, training, and the organizational willingness to make a phone call before releasing a payment. Build that habit now, before a well-crafted email tests whether you have it.
