Invoice Fraud vs. Payment Fraud: Why a Matched Invoice Gets Paid Wrong

Invoice fraud is a fake or inflated bill designed to get an invoice approved. Payment fraud is a redirect of real money to an account the vendor never controlled. The two can happen in the same incident, and a three-way match - the standard check against the purchase order (PO), the goods receipt, and the invoice - catches neither the inflated bill on its own nor, critically, a bank account that was quietly swapped out before the payment ran.

That gap is not theoretical. New survey data from procurement platform Ivalua found that 41% of organizations name a fraudulent change to a supplier's bank details as their single biggest invoice-fraud worry - ahead of duplicate invoicing and compromised supplier email, which tied at 39%. Forty percent of organizations said they had experienced invoice fraud in the past 12 months, with an average loss of $367,000 per incident. The same research found fraud takes an average of nine days to detect, and only 27% of teams catch it the same day it happens.

What is the difference between invoice fraud and payment fraud?

Invoice fraud targets the document: a vendor is billed for work that wasn't done, a rate is quietly inflated above the contract, or a fake vendor is set up to submit bills nobody checks. Payment fraud targets the transaction: the invoice itself can be completely real, but the money is sent to an account the actual vendor never owns, because someone changed the bank details on file before the payment batch ran.

The distinction matters because they're caught by different controls. Invoice fraud is caught by reading the agreement - comparing the bill against the contract, the SOW, and the rate card to see if the work and the price are real. Payment fraud is caught by verifying the payee - confirming that the bank account receiving the money actually belongs to the vendor named on the invoice. A company can run a flawless match on the document and still wire the money to a criminal.

Why does three-way matching never check the bank account on file?

Three-way matching was built to answer one question: did we order this, receive it, and get billed the agreed price? It compares the PO quantity and price, the receiving record, and the invoice line items. None of those three documents carries the vendor's bank routing or account number - that detail lives in the vendor master file or the payment run, a separate system the match never touches. A previous breakdown of how three-way matching works, and where it falls short, walks through the mechanics in more depth; the short version is that a perfectly matched invoice tells you the paperwork lines up, not who is about to receive the wire.

This is exactly how vendor email compromise (VEC) scams work. The fraudster doesn't forge a new invoice - they take over, or closely mimic, a real vendor's email thread and send a bank-detail change request mid-conversation. Because the domain is authentic and the thread is a genuine reply to a real invoice, the usual red flags - a spoofed sender, a strange format - don't fire. Everything about the invoice matches. The only thing that changed is where the money goes next.

What do the 2026 numbers show about how AP teams get hit?

The Ivalua research gives a useful shape to where the risk actually sits right now, not just in theory:

What AP teams worry about	Share of respondents	What catches it
Fraudulent bank-detail change	41%	Payee verification, not matching
Duplicate invoicing	39%	Matching plus payment-history checks
Compromised supplier email	39%	Payee verification, out-of-band confirmation
Ghost vendors (fake supplier records)	32%	Vendor master controls, matching

Only one of these four - duplicate invoicing - is something a matching engine catches on its own. The other three live in the vendor master file and the payment process, outside what a PO-to-invoice match ever looks at. That's also reflected in how slowly these incidents get found: nine days on average, with one in five organizations taking two weeks or more, by which point the money has usually left the business.

What red flags separate a payment-fraud attempt from a bad invoice?

A bad invoice - an inflated rate, hours that don't match the SOW, a duplicate bill - looks wrong on the page. A payment-fraud attempt usually looks fine on the page and wrong somewhere else:

• A bank-detail change request arrives attached to an otherwise normal invoice or email thread, often urgent or tied to a deadline.
• The request to update payment details comes through email or a PDF rather than a verified channel the vendor has used before.
• The new account is at a different bank, in a different country, or under a slightly different company name than the vendor's usual details.
• The invoice cites a PO number, amount, or format that matches prior invoices almost too exactly, because it was copied from a real thread.
• The change request arrives mid-conversation on a real, ongoing email thread rather than as a new, separate message.

None of these show up as a line-item mismatch. They show up as a change in who gets paid, which is why a team can run invoice review perfectly and still move money to the wrong place. Quittance has covered the mechanics of one version of this problem in detail: AI-generated fake invoices that are now passing AP review, where the document itself is convincing enough that visual review stops being a reliable control at all.

What should you verify before you approve a vendor's bank-detail change?

Treat every bank-detail change request as its own approval step, separate from invoice approval:

1. Call the vendor back on a number you already have on file - not a number provided in the request itself. A phone number in the email asking for the change is part of the scam, not a way to verify it.
2. Confirm the request through a second channel, such as a known contact at the vendor, before the new account is used for a payment.
3. Check whether the new account name matches the legal entity name on the contract. A mismatch - even a close one, like a similarly named shell company - is a stop-payment signal on its own.
4. Hold the first payment to a changed account for a short review window rather than processing it in the normal run, especially above your approval threshold.
5. Log the change and who verified it, so there's a record if the same vendor's details move again later.

This matters more than it might seem, because most AP teams aren't doing it consistently today. Quittance has found that only 18% of firms continuously revalidate vendor bank details rather than checking once at onboarding and never again - which leaves most vendor master files stale the moment a real bank-detail change, legitimate or not, comes through.

Where do agreement-level matching and payee verification meet?

Agreement-level matching - checking an invoice against the full contract, SOW, and rate card rather than just the PO - closes the invoice-fraud gap: it catches the rate-card violation, the scope creep, the line item that doesn't belong in the agreement at all. Payee verification closes a separate gap: confirming the bank account on the payment actually belongs to the vendor the agreement was signed with. Running one without the other leaves half the fraud surface open. A company can verify every clause of a contract and still send the payment to a criminal who changed one bank field, or verify a payee perfectly and still overpay against a rate card nobody checked.

That's the logic behind catching both failure modes before a payment posts: confirm what the agreement says is being billed, and confirm who is actually about to get paid. Quittance checks both before anything reaches Xero - it matches each invoice line against the agreement and flags the fraud signals above, including a changed bank account or a payee mismatch, before a bill is ever drafted for approval. Nothing posts automatically; a person still approves every payment, with the document check and the payee check already done. For a broader look at what invoice fraud covers and how to spot it early, see what invoice fraud is, its types, and how to prevent it.

FAQ: invoice fraud vs payment fraud

Is payment fraud the same as invoice fraud? No. Invoice fraud is a fake or inflated bill; payment fraud is money sent to the wrong account, often attached to an otherwise genuine invoice. A single incident can involve both.

Does three-way matching catch bank-detail fraud? No. Three-way matching compares the PO, the receipt, and the invoice - none of which contains the vendor's bank account details, which live in the vendor master file and are changed through a separate process.

What's the biggest invoice-fraud concern for finance teams right now? Fraudulent changes to supplier bank details, named by 41% of respondents in Ivalua's 2026 research, ahead of duplicate invoicing and compromised supplier email.

How long does it typically take to detect invoice fraud? An average of nine days, with only 27% of organizations catching it the same day, according to the same Ivalua research.

What should I verify before approving a bank-detail change? Call the vendor back on a number you already have on file, confirm through a second contact, check the new account name against the contract's legal entity, and hold the first payment for a short review window.

Can an invoice be perfectly matched and still be fraudulent? Yes. A matched invoice confirms the paperwork lines up with the PO and receipt. It says nothing about whether the bank account receiving the payment belongs to the real vendor.