Large companies may be exposing themselves to payment fraud because supplier records are not being checked and updated consistently after initial approval, according to new research into enterprise procurement and financial controls.
Supplier management technology company HICX estimates that approximately half of enterprise supplier information is out of date at any given time, creating potential weaknesses in the processes used to authorise payments and manage commercial relationships.
The findings are based on research involving 50 procurement, finance, master data, and information technology leaders at large organisations.
The research identifies particular concerns around requests to change supplier bank details, which may receive less scrutiny than the checks performed when a new supplier is first approved.
Businesses commonly collect and validate information during onboarding, including company registration details, payment instructions, addresses, and relevant compliance documentation.
However, suppliers can change their banking arrangements, legal structures, and contact information throughout a commercial relationship.
Where subsequent changes are processed through email correspondence or manual approvals, businesses risk accepting fraudulent instructions that appear to originate from established trading partners.
The risk is especially acute when a criminal impersonates a legitimate supplier and asks the finance department to redirect payments to a different account.
HICX’s estimate is based on a limited group of enterprise professionals rather than a published independent audit of supplier records across the wider economy. The findings should therefore be treated as an indication of potential governance weaknesses, not a definitive measurement for every large business.
Payment changes create a control gap —
Dafydd Llewellyn, chief executive of HICX, said companies frequently concentrate their verification efforts on the beginning of a supplier relationship while paying less attention to subsequent changes.
“A supplier record is only as trustworthy as its most recent change,” he said.
He argued that requests to alter payment destinations were particularly vulnerable because employees could be persuaded to accept apparently legitimate instructions without sufficiently independent checks.
The development of more convincing impersonation techniques has increased the difficulty of distinguishing genuine supplier communications from attempted fraud.
Criminals can use compromised email accounts, fabricated correspondence, and AI-generated audio or video to impersonate executives or supplier representatives.
In such circumstances, the apparent familiarity of an email address or the urgency of a payment request is not reliable evidence that a change has been authorised by the supplier.
The problem becomes more complicated when large businesses operate multiple procurement and financial systems.
Different departments may maintain separate supplier records, particularly where companies have expanded through acquisitions or operate across several countries.
As businesses combine operations, they may inherit different enterprise resource planning systems, payment procedures, and supplier databases.
Information held by one team can consequently differ from records maintained elsewhere in the organisation, making it harder to establish which details are authoritative.
Sanctions, changing trade arrangements, and new supplier relationships also increase the importance of maintaining accurate records beyond the initial onboarding process.
Data governance extends beyond procurement —
Responsibility for supplier information frequently spans several functions, including procurement, finance, compliance, and information technology.
Procurement teams may establish the original relationship, while finance employees maintain payment details and compliance specialists conduct regulatory checks.
Without consistent responsibilities and validation procedures, changes can be accepted in one system without being reconciled across the others.
The consequences are not limited to fraudulent payments. Inaccurate records can also contribute to invoice delays, duplicate entries, compliance problems, and difficulties identifying the correct legal entity within a corporate group.
Greater use of automation introduces another consideration. Companies deploying AI in procurement and financial processes depend on the quality of the information used by those systems.
Automating a process does not, by itself, establish whether an existing supplier record or a subsequent change is genuine.
HICX has enhanced its Supplier Registration software to apply validation checks to subsequent changes as well as initial supplier submissions.
The company says the system can verify address, tax, bank, and sanctions information and prevent records from being updated when mandatory checks fail.
Those capabilities are described by the supplier and do not establish independently measured reductions in fraud across customer organisations.
The research identifies a continuing control requirement: businesses need to verify the accuracy of supplier information throughout commercial relationships, particularly when changes affect where payments are made.
