Vendor Fraud Red Flags: How to Spot Suspicious New or Dormant Vendors

Red flags in the vendor list

Suspicious vendors tend to show up as new records paid quickly, old records that suddenly come back to life, or records that overlap with employees or other vendors.

Red flag	Why it matters	How to check
New vendor paid soon after set-up	Fictitious vendors are created to be paid, so the first invoice comes fast	New vendors in the period, with days from creation to first payment
Dormant vendor reactivated	An unused record can be taken over without new-vendor checks	Vendors paid this period after a long gap with no activity
Bank details changed shortly before a payment	The classic route for diverting a genuine supplier’s payments	Change log for bank details, compared with payment dates
Address, bank account or phone matches an employee	Points to an employee paying themselves	Compare vendor master with payroll and HR records
Two vendor records with the same tax ID or bank account	Duplicate records enable duplicate payments, deliberate or not	Group vendors by tax ID, bank account and address
Missing or invalid tax ID	Legitimate businesses can provide one; a fake vendor often cannot	W-9 status and TIN Matching results
P.O. box or residential address only	Harder to verify a real place of business	Address type in the vendor master
Round-number invoices	Real invoices for goods and services rarely total exactly $5,000	Payments that are exact multiples of $1,000 or $500
Amounts just under approval limits	Splitting to stay under a threshold avoids a second approver	Payments within a few percent below each limit
One approver for all of a vendor’s spend	No independent review of whether goods or services were received	Approver history per vendor

Step-by-step: reviewing your vendor list

Start with what changed: vendors added, reactivated or edited in the period, then test their payments.

1
Step 1
Export the vendor master with creation date, created by, address, bank details, tax ID and date of last payment.
2
Step 2
List vendors created in the review period and check each one was requested, approved and verified by someone other than the person who set it up.
3
Step 3
List vendors with no activity for six months or more that have been paid again, or had bank or address details changed, in the period.
4
Step 4
Compare vendor addresses, bank accounts, phone numbers and tax IDs with each other and with employee records.
5
Step 5
Scan payments for round amounts, amounts just under approval limits, and amounts far outside the vendor’s usual range.
6
Step 6
Investigate each hit against invoices, contracts and receipts, and deactivate vendors that are no longer used.

US payers that file information returns can also validate vendor names and tax IDs with the IRS's TIN Matching service. A name and TIN that do not match is worth a phone call before the next payment.

Worked example: a quarterly vendor review

In this example, a quarterly review of 640 active vendors produces five items to investigate, and four turn out to be legitimate.

Example: Q3 vendor review findings
Finding	Detail	Outcome
New vendor	“Apex Facility Services” created Aug 4, paid $9,800 on Aug 11	Legitimate: emergency HVAC repair, PO and receipt on file
Dormant vendor reactivated	Printer supplier unused for 14 months, paid $4,000 in September	Legitimate: annual maintenance contract renewed
Round amounts	Three payments of exactly $5,000 to a marketing consultant	Legitimate: fixed monthly retainer under contract
Duplicate records	“ABC Supply” and “ABC Supply Inc” share a tax ID	Merged; no duplicate payments found
Address match	New vendor’s address matches an AP clerk’s home address	Escalated: payments stopped and investigation opened

Illustrative vendors and amounts. Most findings in a review are legitimate. The point is that each one is explained and documented.

Controls that keep fake vendors out

Vendor fraud depends on one person being able to create a vendor, change its details and get it paid, so the core control is splitting those duties.

Separate vendor set-up from payment. The people who create or edit vendors should not approve invoices or release payments. See segregation of duties.
Verify at onboarding. Require a W-9 or equivalent, check the business exists, and confirm bank details through a channel you already trust. See W-9 and 1099 compliance.
Call back on bank changes. Confirm any change of bank details by phoning the supplier on a number from your existing records, never one in the request.
Deactivate dormant vendors. Unused records cannot be hijacked if they cannot be paid.
Match to purchase orders. A vendor that can only be paid against an approved PO and a receipt is much harder to fake. See three-way matching.

How Aequo helps

Aequo AP checks each incoming invoice for duplicates and unusual amounts for that vendor, and Aequo Audit, now in early access, scans for new vendors, reactivated dormant vendors and round-number amounts.

Aequo AP, on every invoice: compares each new invoice with earlier invoices by vendor, amount, date and invoice number, flags amounts that are unusual for that vendor, and gives the invoice a duplicate risk level before approval. Flagged invoices go to the exception queue.
Aequo AP, at approval: warns the approver when a 1099-eligible vendor has no W-9 on file. Vendor tax IDs are encrypted and masked.
Aequo Audit (early access): scans QuickBooks Online companies and lists findings with a severity: vendors added in the last 30 days, vendors with new activity after a long gap (180 days by default), round-number amounts (from $1,000 by default), amounts unusual for the vendor, duplicate payments and likely miscategorised transactions.

Neither product verifies bank details or confirms that a vendor is a real business; those checks stay with your team. Join the Aequo Audit waitlist or see how Aequo AP checks for duplicates.

Frequently asked questions

What are the red flags of a fake vendor?

Common signs are a vendor created recently and paid quickly, a P.O. box or residential address, an address or bank account that matches an employee, a missing or invalid tax ID, no phone number or website, invoices with round amounts or sequential invoice numbers, and spend that is only ever approved by one person.

Why are dormant vendors a fraud risk?

A vendor that has not been used for months is a convenient record to take over: someone changes the bank details or address and submits an invoice, and because the vendor already exists it skips new-vendor checks. Deactivating unused vendors removes the opportunity.

How long before a vendor counts as dormant?

There is no standard. Many teams treat 12 to 18 months with no payments as dormant and deactivate those records, and flag any vendor reactivated after six months or more for review. Pick a period that fits how often you buy from occasional suppliers.

How often should I review the vendor master?

Review new vendors and changes to bank details every month, and do a full clean-up of dormant and duplicate vendors at least once a year, ideally before year-end and 1099 season.

What should I do if I find a suspicious vendor?

Stop pending payments to it, preserve the records, and investigate quietly: who created it, who approved its invoices, and where the money went. Do not contact the vendor using details from the vendor record itself. Involve management, internal audit or legal counsel as your policy requires.

Can software detect suspicious vendors automatically?

Software can flag new vendors, dormant vendors that start receiving payments, duplicate vendor records, round-number and unusual amounts, and invoices that look like duplicates. It produces leads; a person still has to confirm whether each one is legitimate.

Automate matching, approvals and exception handling

Aequo AP captures invoices, matches them to purchase orders and receipts, routes approvals and flags duplicates and exceptions, then syncs with QuickBooks Online, Xero, FreshBooks or Zoho Books.

Start a free trial Book a demo

Sources

Checked on October 23, 2026. Vendor capabilities and prices change; confirm current details with each vendor.

IRS, Taxpayer Identification Number (TIN) Matching — validating vendor name and TIN combinations