Vendor onboarding fraud: five checks before you pay a new supplier

VerifyExact · 2026-11-15

The moment a new supplier is added, or an existing supplier changes its bank account, is when payments most often go to the wrong place. The methods vary, from a convincing email that says "our bank details have changed" to a made-up company with real-looking documents. Five simple checks, done in the same order every time, deal with most of it. None of them needs special software.

1. The bank account holder name must match the legal company name

Ask for the bank account details in writing, on the supplier's letterhead or in its onboarding form, and compare the account holder name with the legal name of the company on its registration documents. They should match exactly. If the account is in a personal name, a trading name or a different company, stop and get a written explanation before you pay. Many banks can confirm the account holder name on a small test transfer or through their own verification service. Ask your bank what it offers.

2. Call back on a number from an independent source

If the request to add or change details came by email or message, do not reply to that message and do not call a number written in it. Email accounts get hacked and email addresses can be spoofed. Instead, call the supplier on a number you got elsewhere: from the contract you signed, from the company's official registration documents, or from someone you already know there. Be careful with business listings and map entries as well, because anyone can sometimes edit them. A listing is not an independent source unless you can trust who controls it.

On the call, confirm the details out loud: the account number, the bank and the name on the account.

3. Confirm the person's authority

The person who asks you to change bank details should be someone entitled to do so. Ask who in the supplier's company approves banking changes. For a new supplier, ask for a signed authorisation or the director's confirmation. Compare the name of the signer with the officers listed in the company registration. In Indonesia, the registration records are in the AHU system of the Ministry of Law; check the current official portal for how to search. A signature from someone who is not a listed officer and holds no written authorisation is a question to resolve.

4. Verify the registration

Confirm that the company exists and matches the documents it gave you: the AHU registration for the legal entity, the business identification number (NIB) in the OSS system, and the tax number (NPWP). Check that the name and address match across them and that the registered business activities make sense for what the supplier sells. Our guide on checking an Indonesian company walks through each system. A company that exists on paper is not necessarily one that will deliver, but a company that does not match its own documents should not be paid.

5. One person approves, a second person checks

Set a rule that new or changed bank details are entered or approved by one person, and checked by a second person before the first payment. The second person re-does the call-back in step 2 and compares the entered account number with the written details. This is your main protection against both outside fraud and honest typing mistakes.

Some practical additions:

• Pay a small first amount, if the supplier agrees, and have the supplier confirm receipt before the full payment.
• Hold the first payment to a new account for a short time before release.
• Keep a record: who requested the change, who called back, who approved, and the dates.
• Treat urgency as a signal to slow down. A request that must be handled today, quietly, or without the usual process is the pattern to watch for.

If you have already paid the wrong account

Contact your bank at once and ask whether a recall is possible. Then keep the evidence, including the messages and details you were sent, and take advice from your own legal advisers about next steps. Speed matters.

What this does not replace

These five checks reduce payment risk. They do not tell you whether a supplier is financially strong or how it behaves in disputes. For larger or ongoing deals, add court and insolvency searches and involve your own legal and financial advisers. VerifyExact provides information, not legal or financial advice.

VerifyExact provides information, not legal or financial advice. For larger transactions, involve your own legal and financial advisers.