Vendor Bank Account Changes Are Where AP Fraud Gets Through, and AI Can Watch the Master File All Night

Of the roughly 2,340 accounts payable postings in the Audit Friendly job database right now, about 456 mention vendor setup or onboarding, 133 mention fraud, and only about 115 mention anything like bank account verification or callbacks, which is around 5%, and the FBI's 2025 Internet Crime Complaint Center report put business email compromise at $3.046 billion in reported losses across 24,768 complaints. So the control that stops the single most common way an AP team gets robbed shows up in about one posting in twenty, and if you run a payables function you should find that gap a little uncomfortable, because I sure do. Everything below comes from our posting data as of November 2026 (we pull accounting and finance jobs daily, strip duplicates and recruiter noise, and link to the employer's own career page), and the fraud figures come from the FBI report as summarized by McDonald Hopkins.

How does vendor bank account change fraud actually work?

Someone emails your AP inbox pretending to be a vendor you really do pay, says the bank details changed, and attaches a clean-looking form or a letter on borrowed letterhead, and the next remittance goes to an account that belongs to a stranger. The FBI report counted 24,768 BEC complaints in 2025, up from 21,442 in 2024, and it noted more than $30 million in BEC losses with a confirmed AI connection, which tells you the emails are getting better and the typos that used to give them away are disappearing. Nobody in AP did anything dumb in most of these cases, they followed a request that looked exactly like a hundred legitimate ones, and that's the part that stings.

Where does AI help with vendor master file fraud?

AI is very good at the boring, relentless comparison work that a person does badly at 4pm on the day before a payment run. Point it at a daily export of your vendor master and it can flag any bank account that changed in the last 30 days, any bank account number that now appears on two different vendors, any vendor whose remit-to address moved to a new state, any new vendor whose name is a near match to an existing one, and any change that was made outside normal hours or by a user who rarely touches the master file. It can also read the incoming change request, pull out the claimed new bank details, the sender domain and the reply-to address, and tell you the domain was registered last week and differs from the vendor's real domain by one letter. That is a lot of pattern matching, and I'd rather a machine do it every night than have a senior accountant do it once a quarter.

If this sounds like the duplicate payment problem in a different outfit, it is, and the duplicate payment detection walkthrough uses a lot of the same plumbing. The vendor statement reconciliation piece is the other half, since a vendor who never got paid is often how you find out the money went somewhere else.

What can't AI do in this process?

It can't make the call. The control that actually works is a callback to a phone number you already had on file before the change request arrived, made by someone other than the person who processed the change, and no model sitting on a spreadsheet can do that for you. AI can queue the callback, draft the script, log the result and block the payment until the log is complete, and I'd happily let it do all of that, but the human on the phone is the control. I'd also be careful about letting any AI tool approve a bank change by itself, because a confident summary of a forged letter is still a summary of a forged letter, and I've seen enough demos where the model was damn sure about something that turned out to be bullshit.

What would a simple version look like?

Start with something you can build in an afternoon. Export your vendor master and your payment history to a spreadsheet, hand both to an AI assistant, and ask it for four lists: vendors whose bank details changed in the last 90 days, bank accounts shared by more than one vendor or by a vendor and an employee, payments sent within 10 days of a bank change, and new vendors added in the last 60 days whose names closely resemble an existing vendor. Review every line by hand the first week, because you'll learn how noisy it is and you'll find a few real problems, which is usually how these projects get funded.

Once the lists make sense, schedule the export and have the output land in a shared inbox or a ticket queue every morning, and add a payment hold rule so any first payment after a bank change waits for a logged callback. Our guide on where to start with AI in accounts payable covers the order I'd tackle things in, and the software directory lists the AP and spend platforms that already ship vendor-change controls so you can see what you'd get without building anything.

What are AP teams actually asked to do today?

The postings tell a useful story. Among accounts payable roles in our data, about 19% mention vendor setup or onboarding, about 27% mention internal controls or segregation of duties, about 10% mention W-9s, and about 20% mention automation or AI, so employers clearly want people who can run the vendor file and the controls around it. What they rarely write down is verification of bank changes, which says to me that plenty of teams do it by habit and without a written step, and a habit that isn't written down is gone the day that person leaves. If you work in AP, being the person who can write that control down and wire it to an automated check is a decent career move, and the AP software postings analysis shows which tools employers expect you to know.

What I'd do Monday morning

I'd pull the vendor master, run the four lists, and see how many bank changes in the past quarter had a documented callback, because I suspect the answer is lower than anyone wants it to be. Then I'd write the callback rule on a single page, get the controller to sign it, and let the AI handle the flagging and the paperwork while a person owns the phone call. Build the ugly spreadsheet version first, since a rough control running this week beats a perfect one in next quarter's roadmap, and if you want to see who's hiring people to run this kind of work, the remote accounting jobs page is a good place to start.

Frequently asked questions

What is vendor bank account change fraud?

It is a form of business email compromise where a criminal impersonates a real vendor and asks you to update payment details, so your next payment lands in their account. The FBI's 2025 report counted 24,768 BEC complaints and $3.046 billion in reported losses.

Can AI detect vendor fraud in accounts payable?

It can flag the warning signs, such as recent bank changes, shared account numbers, look-alike vendor names and suspicious sender domains, far faster than manual review. It should feed a human callback and a payment hold and should not approve changes on its own.

What is the best control for vendor bank detail changes?

A callback to a phone number already on file before the request arrived, performed by someone separate from the person who processes the change, with the result logged before any payment goes out. Automation can enforce the hold and keep the log.

How many accounts payable jobs mention fraud or verification?

In our current data, about 6% of accounts payable postings mention fraud and about 5% mention bank account verification or callbacks, out of roughly 2,340 postings. Far more mention internal controls in general.

Do I need new software to start?

No. A vendor master export, a payment history export and an AI assistant will get you the first four reports this week. Dedicated AP platforms add built-in change tracking and approval workflows once you know what you need.

Run the four lists on your own vendor file this week and see what turns up, because the first pass almost always finds something worth a phone call.