The Supplier Is Genuine. So How Can the Payment Still Be Fraudulent?
CA Meet Dhrangadhariya 
September 7, 2026
CA Meet Dhrangadhariya September 7, 2026
A supplier may be completely genuine.
The invoice may be genuine.
The goods or services may have actually been received.
The purchase may have been properly approved.
And the payment amount may exactly match the invoice.
Yet, the payment can still be fraudulent.
How?
Consider a simple situation.
A company regularly purchases goods from a genuine supplier. The supplier’s name, GST details, invoices and transactions all appear legitimate.
At some point, the supplier’s bank account details are changed in the company’s records.
The new bank account may have been inserted or changed by someone within the accounts or finance process.
The payment is then made to the new account.
From the accounting records, everything may appear normal:
But the money has gone to a different bank account.
In some cases, that account may belong to an employee, an employee’s relative, or another person connected with the fraud.
This is why verifying the supplier is not enough. The payment destination also needs to be verified.
Most accounting controls focus on whether the transaction itself is genuine.
For example:
Purchase Order → Goods Received → Invoice → Approval → Payment
If all these documents match, the transaction may appear completely legitimate.
But there is another question that is often overlooked:
Who actually owns the bank account to which the payment was made?
If the supplier’s bank details were changed without independent verification, a genuine transaction can become a fraudulent payment.
One practical review is to compare supplier bank-account information with employee-related bank-account information.
For example, take:
Suppose a supplier’s bank account happens to be the same as an employee’s salary account.
That does not automatically prove fraud.
There could be a legitimate explanation. For example, the employee may have a genuine business relationship with the supplier or may have been authorised to receive payments in a particular arrangement.
However, such a match is certainly a red flag that deserves investigation.
The same principle can be extended to other unusual relationships, such as supplier bank details matching accounts associated with employees or their related parties.
The most important control is not simply comparing account numbers.
It is having a proper process whenever supplier bank details are changed.
For example:
Supplier requests change in bank details
↓
Change request is documented
↓
Supporting bank details are obtained
↓
Independent verification is performed using previously known contact details
↓
Change is approved by an authorised person
↓
Bank details are updated in the accounting system
↓
Payment is released
The key word here is independent.
If the same person who receives the bank-change request can also update the master data and release the payment, the control is considerably weaker.
A few simple controls can significantly reduce this risk:
The person who changes supplier bank details should not be the same person who approves the change.
Do not rely solely on the email or message requesting the change.
Verify the change through an independent communication channel, such as a previously registered supplier contact number.
Every change to supplier master data should leave a record showing:
Periodically compare supplier bank details with employee and other relevant master data to identify unusual overlaps.
Payments made shortly after a supplier’s bank details have been changed can receive additional scrutiny, particularly where the transaction is large or unusual.
This distinction is important.
The existence of a genuine supplier and genuine invoice does not, by itself, establish that the payment was made to the correct beneficiary.
At the same time, an auditor cannot be expected to detect every fraud simply because a fraud has occurred.
The nature and extent of audit procedures depend on the applicable auditing standards, the circumstances, the assessed risks and the controls in place.
For businesses, the practical lesson is therefore not to rely on the audit alone.
Fraud prevention starts with the company’s internal controls.
When a supplier’s bank details are changed, ask:
Does someone independent verify that the new bank account actually belongs to the genuine supplier before the payment is released?
If the answer is no, there may be a control gap worth addressing.
Because sometimes the supplier is genuine.
The invoice is genuine.
The purchase is genuine.
The approval is genuine.
And yet the money still goes to the wrong person.
That is why supplier verification and payment verification should be treated as two separate controls.
A genuine supplier does not automatically mean a genuine payment.
The risk can sit between the invoice and the bank transfer, particularly when supplier master data can be changed without adequate verification.
A simple, well-designed process for supplier bank-account changes, independent verification, maker-checker approval and periodic data analysis can help businesses identify and prevent potentially costly payment fraud.
The real question is not only, “Is this supplier genuine?”
It is also:
“Are we certain that the money is going to the genuine supplier?”
Disclaimer:
This article is for general informational purposes only and should not be considered professional advice. Please consult a qualified expert for advice tailored to your specific situation. The author and website owner are not liable for any errors or actions based on this content.
Hatim Bharmal February 17, 2025
CA Meet Dhrangadhariya February 25, 2025
CA Meet Dhrangadhariya March 1, 2025
CA Meet Dhrangadhariya March 1, 2025