Accounts Payable Controls for Small Businesses: Stop Payment Fraud

Accounts payable is where money leaves your business, which makes it the favorite target of fraudsters. Small businesses are particularly exposed because one person often handles everything. Good controls aren't expensive — they're mostly about who can do what. Here's a practical set, designed for businesses working with an outsourced or remote bookkeeper.

The core principle: separation of duties

No single person should be able to create a vendor, enter a bill and release payment. Split the steps:

Tools such as Bill.com and the AP features in QuickBooks Online and Xero support approval workflows so these steps are enforced rather than assumed.

Control 1: Approval workflows

Set up approval rules in your bill-pay tool:

• All bills require at least one approver other than the person who entered them.
• Bills above a threshold require a second approver.
• New vendors can't be paid until approved.

Control 2: Verify vendor bank-detail changes

The most common payment fraud pattern is a convincing email asking to update a vendor's bank details. This is a form of business email compromise, which the FBI's IC3 tracks as a major category of reported cybercrime.

Rule: any request to change vendor payment details is verified by phone using a number already on file — never a number from the request. Log the verification.

Control 3: No stored bank credentials

Your bookkeeper doesn't need your online banking login to keep your books. They can work from:

• Bank feeds inside your accounting software
• Statements you download or share
• Their own user-level access, if your bank supports it, with limited permissions

ExecWing bookkeepers never store client bank credentials. See security for financial data.

Control 4: MFA everywhere

Turn on multi-factor authentication for accounting, bill-pay, payroll, banking and email systems. Email matters because it's the reset path for everything else. CISA explains why MFA is so effective.

Control 5: Least privilege in finance tools

Give your bookkeeper a named user with the permissions they need — usually entering and coding bills and preparing payments, not releasing them. Review permissions quarterly.

Control 6: Positive pay and bank alerts

Many banks offer positive pay (matching issued checks against presented checks) and alerts for outgoing payments over a threshold. Ask your bank what's available.

Control 7: Monthly review

During the month-end close, a reviewer checks:

• New vendors added this month
• Vendor detail changes
• Payments to vendors without bills
• Duplicate invoice numbers or amounts
• Unusual payment amounts or timing

Control 8: Document the process

Write a one-page AP policy: who approves what, thresholds, how vendor changes are verified and how exceptions are handled. Make sure everyone involved has read it.

Red flags

• Urgent payment requests from an executive by email only
• Vendor bank details changing shortly after an email thread
• Invoices from unfamiliar vendors with round amounts
• Requests to bypass the normal approval process
• New payment methods for existing vendors

Escalate any of these immediately, and verify through a known channel.

A worked example: a vendor-change fraud attempt, stopped

Business email compromise is one of the costliest forms of cybercrime the FBI tracks. Its Internet Crime Complaint Center reported about $2.9 billion in adjusted BEC losses in 2023. Here is how a typical attempt plays out against a small business with good controls.

1. Tuesday: The bookkeeper receives an email that appears to be from a regular supplier: "We've changed banks. Please update our ACH details before Friday's payment." The sender's domain differs from the real supplier's by a single letter.
2. Control applied: Under the vendor-change policy, the bookkeeper doesn't reply to the email or use any phone number in it. Instead, they call the supplier's accounts-receivable contact on the number already saved in the vendor file.
3. Result: The supplier confirms they haven't changed banks. The bookkeeper reports the email to the owner, blocks the domain and adds a note to the vendor file.
4. Without the control: Friday's payment would have gone to the fraudster's account. Recovery depends on how fast the bank is contacted, and funds are often moved within hours.

The control costs one phone call.

A sample AP approval matrix

Adjust the thresholds to your size. The point is that every payment has a named approver.

The monthly AP review checklist

• Review the vendor master-file change log: any new vendors or changed bank details?
• Compare paid bills against approvals: anything paid without the required approval?
• Look for duplicate payments: same vendor, same amount, close dates
• Scan for vendors with PO boxes only, no tax ID, or names similar to existing vendors
• Check the AP aging for old unpaid items and disputes
• Reconcile the bill-pay tool's payment log to the bank statement
• Confirm W-9s are on file for vendors who may need a 1099

Tools that help a small team enforce controls

• Bill-pay platforms such as Bill.com, Ramp or Melio support multi-step approvals and audit trails.
• Your bank's ACH and positive-pay services let you approve exceptions before checks or ACH debits clear. Ask your bank which options are available to small-business accounts.
• Accounting-software audit logs in QuickBooks Online or Xero show who changed what and when. Review them monthly.
• Email security: DMARC on your own domain makes it harder for criminals to spoof your address to your customers and vendors.

Finally, write the whole process on one page and have every person who touches AP read and acknowledge it once a year. A control nobody knows about is not a control.

The bottom line

AP fraud prevention comes down to separation of duties, enforced approvals, verified vendor changes, no shared bank credentials and MFA. These controls work just as well with a remote bookkeeper as with an in-house one — arguably better, because they force clarity about who does what.

ExecWing bookkeepers prepare payment runs; you approve and release them. See Bookkeeping and the remote assistant security checklist.

Sources

• FBI, Internet Crime Complaint Center (IC3).
• CISA, Multifactor Authentication.
• FBI Internet Crime Complaint Center, 2023 Internet Crime Report.
• FBI, Business Email Compromise.
• CISA, Implementing Phishing-Resistant MFA. ---SOURCES---