Consider the following: Jane, an AP specialist, gets an email from a vendor her company has paid for three years. The vendor has switched banks, the message says, and the open invoice should go to the new account. The idea of vendor bank account change fraud has never crossed her mind. And why would it? The signature is right. The invoice number is real. The email even lands in the same thread as last month’s invoices.
But the vendor never sent it. Their mailbox had been compromised for weeks, and someone had been reading every thread, waiting for the right moment. Nobody hacked Jane’s company. The fraud arrived looking exactly like work Jane was already going to do.
This is business email compromise (BEC), and it is one of the most expensive threats accounts payable teams face. Reported BEC losses reached $3 billion last year, with an average of $123,000 per incident according to the ACFE 2026 Report to the Nations. And once the money moves, it often doesn’t come back: recovery efforts fail nearly half the time.
Stopping this kind of fraud starts with understanding how it gets in. This guide covers what vendor bank account change fraud is, why accounts payable is the target, and the four email-based patterns fraudsters use most often. It also explains why written policies break down under pressure, and why Nacha’s new fraud monitoring rules make formal controls more urgent for any business that pays vendors by ACH.
From there, we walk through a six-layer control framework built inside NetSuite: one system of record, secure outreach to known vendor contacts, automatic bank validation, human review before any change is saved, controls on the vendor master itself, and ongoing monitoring. Finally, we replay Jane’s email against those layers to show exactly where it would have been stopped.
What is vendor bank account change fraud?
Vendor bank account change fraud is a scheme in which a fraudster convinces an accounts payable team to update a vendor’s banking details to an account the fraudster controls. The next legitimate payment to that vendor goes to the fraudster instead.
What makes it effective is that it doesn’t look like an attack. There’s no malware, no breach of the payer’s systems, and often no red flag in the invoice itself. The request looks like routine vendor maintenance, which AP teams handle every week. The payment goes out on schedule, and the real vendor usually discovers the problem only when they follow up on an invoice they believe is unpaid.
How does business email compromise target accounts payable?
Business email compromise targets accounts payable because AP is where email turns into money. An AP team receives invoices, vendor updates, and payment questions by email all day, and acting on those emails quickly is part of the job.
Payments fraud of all kinds is widespread: according to the 2026 AFP Payments Fraud and Control Survey Report 76% of U.S. organizations experienced attempted or actual payments fraud in 2025. BEC stands out because it exploits trust rather than technology. The fraudster’s goal is simple: get a change into the vendor master file before anyone checks whether the request is real.
What are the four most common ways vendor fraud gets in?
Most vendor fraud arrives through one of four email-based patterns:
- The compromised vendor mailbox. A fraudster gains access to a real vendor’s inbox and waits, reading invoice threads. At the right moment, they send new bank details from the vendor’s genuine address.
- The lookalike domain. The fraudster registers an email address that differs by a single character, such as swapping a lowercase “l” for a capital “I.” A busy AP specialist can easily miss it.
- The fake vendor. An invoice arrives from a company that doesn’t exist. The business looks legitimate enough that AP onboards it and pays the bill.
- The internal impersonator. The email appears to come from someone inside your own company, such as an executive or colleague, asking AP to pay a vendor at new, unverified bank details.
Every one of these patterns ends at the same place: a request to create or change vendor master data. The attack depends on that change going through without an independent check.
Why aren’t fraud prevention policies enough on their own?
A written fraud prevention policy is the right starting point, and every AP team should have one. At a minimum, it should include four rules:
- Never treat an inbound email as approval to change vendor master data, no matter how legitimate it looks.
- Always verify changes with a trusted contact, using contact details already on file. Never call a number from the email itself.
- Require approval for every vendor master data change, and make sure the person entering the change is never the one approving it.
- Document the process and train on it regularly.
There’s also a regulatory reason to formalize this now. Nacha, the organization that governs the ACH network, introduced new fraud monitoring rules in 2026. As of June 19, 2026, they apply to every non-consumer business that originates ACH payments, regardless of volume, and they specifically cover fraud involving business email compromise and vendor impersonation. Teams should review the impact with their bank and legal counsel.
The problem is such a policy depends on people following manual steps every time. Under quarter-end pressure, with a vendor waiting and a payment run due, steps get skipped. The fix isn’t more training. It’s moving the controls into the system of record, so the workflow enforces the policy automatically.
What does a layered vendor fraud control framework look like in NetSuite?
No single control stops every fraud attempt. The goal is stacked layers, so the gaps in one are covered by the next. Here’s how six layers work together inside NetSuite Next with Charted:
Layer 1: One system of record
Charted is a native NetSuite SuiteApp, so vendor onboarding and bank changes happen inside NetSuite. There’s no separate vendor portal, no extra logins, and no data syncing between systems. That means fewer places to attack and one set of roles, permissions, and audit history governing the entire process.
Layer 2: You reach out, you don’t react
When a vendor needs onboarding or a banking update, AP sends a single-use, secure form to the vendor contact already on file. So when an inbound “please update our banking” email arrives, the answer is always the same: “Happy to help. We’ll send our secure form.” A fraudster using a lookalike domain never receives that form.
Layer 3: Automatic bank validation
Automatic bank detail validation answers two questions: Is the account real, open, and active? And does the name on the account match the vendor’s legal name? Because the check runs on every submission, the busiest day of the quarter gets the same scrutiny as the slowest. (This feature is coming soon from Charted!)
Layer 4: Human review before anything writes
A reviewer sees a side-by-side comparison of exactly what’s changing, with bank fields highlighted and validation results alongside. The review also confirms any manual steps the policy requires, such as a call to a trusted contact. Nothing changes in the NetSuite vendor record until a person approves it.
Layer 5: Controls on the vendor master itself
Sooner or later, someone will try to go around the process, whether innocently or not. Any direct change to the vendor master triggers re-approval through internal controls. This layer catches shortcuts and insider fraud.
Layer 6: Ongoing monitoring
As invoices arrive, Charted watches for bank details that differ from what’s on file and flags them. AP can then start re-verification before a payment goes out, which also helps prevent late payments to legitimate vendors whose details really have changed.
How would these layers stop a real fraud attempt?
Go back to Jane’s email: the right thread, the right tone, and new bank details.
With layered controls in place, the attempt fails at layer two. Nobody acts on an inbound email. Instead, the real vendor receives a secure form at the address on file and replies, “What bank change?”
If the attempt somehow got further, it would fail again at layer three, when the name on the fraudster’s account doesn’t match the vendor’s legal name. And it would fail a third time at layer four, when a reviewer sees the failed validation sitting right next to the requested change.
That’s the point of stacking controls. A fraudster doesn’t have to beat one check. They have to beat all of them, every time.
Turning vendor onboarding into your strongest control
Vendor onboarding and bank changes are where most AP fraud gets in, which makes them the best place to stop it. When verification, validation, approval, and monitoring all run inside NetSuite, the process that used to be your biggest exposure becomes your strongest control. Trusted vendors are onboarded faster, and fraudsters are stopped at the door.
See how Charted Advanced Vendor Onboarding works inside NetSuite. Get started.
