Vendor Verification Checklist: How to Safely Check a Vendor Before Payment (2026)

Wire transfers are irreversible. Once the money leaves your account, recovering it is rare and slow. This guide gives AP clerks and office managers a step-by-step process to verify any vendor before payment — so you catch fraud before it costs you.

Why Wire Transfers Are the Highest-Risk Payment

Unlike checks, ACH, or credit cards — wire transfers cannot be reversed. Once confirmed, funds move immediately and are typically forwarded internationally within hours in fraud cases, making recovery nearly impossible.

This is exactly why fraudsters specifically target wire transfers. The three most common schemes hitting small businesses right now:

• Business Email Compromise (BEC) — Attacker impersonates an executive or vendor via a spoofed email, requesting an urgent wire to a new account.
• Invoice redirect fraud — A legitimate vendor's invoice is intercepted and altered with new bank routing details before it reaches you.
• Phantom vendor schemes — A fake company solicits business, collects payment, and disappears. Often targets new vendor onboarding processes.

What These Scams Actually Look Like

These aren't abstract threats. Here are examples of what each scam looks like in practice — and the red flags that give them away.

Example 1 — CEO Impersonation (BEC)

Example 2 — Invoice Redirect Fraud

6 Steps to Verify Any Vendor Before Payment

Use this process for any first payment, or any payment to a vendor you haven't paid in more than 90 days.

Manual Checks vs. Using PaySentinel

Here's what each step looks like doing it manually versus running it through PaySentinel:

Curious how a structured tool compares to doing these checks manually? See exactly what each approach catches and what each misses →

Red Flags That Should Stop Any Payment

Each of these signals requires verification before proceeding. Multiple flags together warrant escalation to a manager before anything is sent.

• Urgency language — "Must be done today," "before end of business," "time-sensitive." Urgency bypasses your normal controls. Legitimate vendors understand payment timelines.
• Routing number changed from previous invoices — The #1 indicator of invoice redirect fraud. Always requires a phone call to a number you looked up independently, plus a signed bank authorization letter.
• Request to keep the payment confidential — No legitimate business transaction requires secrecy from your own colleagues or management.
• Free email address for business invoices — Gmail, Yahoo, Hotmail, or any consumer email for invoices over $1,000 is a serious red flag. Real companies have company domain emails.
• Invoice number is suspiciously low — INV-003 or INV-007 from a company claiming years in business. Established businesses have high invoice numbers.
• Amount is just under $10,000 — Amounts like $9,800, $9,750, or $9,900 may be deliberately structured to avoid Currency Transaction Report (CTR) thresholds. This is called structuring and is a federal crime — and a clear signal of fraudulent intent.
• Remittance address differs from company address — If the "pay to" address on an invoice is in a different state from the company's listed address, verify before paying.
• Executive bypasses normal process — Real executives don't typically circumvent AP workflows. A CEO requesting an urgent wire directly to you, bypassing normal channels, is the hallmark of impersonation fraud.
• Single point of contact via email only — Vendor has only one contact, reachable only by email, who discourages phone calls.
• Very new website or recently registered domain — A company website registered in the last 60 days combined with an invoice for a large amount is a phantom vendor signal.
• "Do not call" instruction — Any payment request that instructs you not to call, not to discuss, or to confirm only by email is attempting to prevent verification. Stop immediately.

Handling Routing Number Changes

Routing number changes are the most common vector for payment redirect fraud — and also something that legitimately happens when vendors switch banks. The right process:

• Never update banking details based on email or invoice alone — regardless of how official it looks.
• Call the vendor's AR department using a number from your existing records — not from the email requesting the change.
• Request a signed bank authorization letter on company letterhead — creates an audit trail most fraudsters won't produce.
• Document who you spoke with, when, and what they confirmed — name, title, callback number, and date.
• Consider a small test payment first — for large ongoing vendors, some businesses send a nominal amount to verify the account before the full payment.

New Vendor Onboarding Checklist

Before processing any first payment, collect and file the following. Keep this on record for every new vendor relationship.

• Legal business name — confirmed matches invoice and any contracts.
• Business registration — verified via Secretary of State database, in good standing.
• Physical address — confirmed real, not P.O. box only. Checked via Google Maps.
• Named contact — person with company email and direct phone you've called and confirmed.
• W-9 form — required for any vendor paid over $600/year. EIN must match business registration.
• Signed bank authorization letter — on company letterhead, documenting their banking details for ACH or wire payments.
• Contract or statement of work — clear documentation of what you're paying for before the first invoice arrives.
• Fraud check completed — vendor details run through PaySentinel or equivalent tool, result documented.

When to Stop a Payment and Escalate

Escalate immediately to your manager or owner if:

• An executive is requesting an urgent, confidential wire outside your normal process
• A vendor's banking details changed and you cannot reach anyone by phone at an independently verified number
• You believe an invoice may have been altered in transit
• You've already sent a payment and something now doesn't add up — contact your bank immediately, within the first hour

If you've sent a fraudulent payment: call your bank immediately, then file a report with the FBI's Internet Crime Complaint Center at ic3.gov.