Who Really Pays When a Supplier Payment Is Hijacked? Leveraging Your Procurement Software to Combat Fraud

The short answer is: both sides do. When a fraudster diverts a payment, the buyer loses money it can rarely recover. At the same time, the supplier loses cash it was owed, plus time, credibility and sometimes the relationship. Payment fraud is not a buyer problem or a supplier problem; it is a shared one, so prevention has to be shared too. That means educating both parties on the warning signs, and on two shifts that modern procurement software now makes possible: paying by single-use virtual card, and paying through verified networks where bank details are authenticated before any money moves.

Fraudsters Are Scaling Faster Than Defences

The scale of the problem is vast and growing. In the 2026 AFP Payments Fraud and Control Survey, over three-quarters of US organizations (76%) reported attempted or actual payments fraud in the preceding year. Business email compromise hit 74% of organizations, a significant increase year-on-year.

Today's attacks exploit any weakness in the relationship between buyer and supplier. A recent report found that about 61% of business email compromise involves impersonating an external third party. In that report, requests to update billing accounts showed a 26.5% compromise rate. AI is making fraud even harder to detect, with deepfake voice and video calls entering the mix, yet only 17% of organizations use AI in the fight against payments fraud. 

Why Do Buyers & Suppliers Both Need To Take Action?

Buyers need accounts payable teams to treat every bank-detail change as a red flag and never act on an emailed request alone. Every change should go through a mandatory, controlled workflow that authenticates the requester's identity independently of the request itself and requires internal approval before it is validated. That way no single email, call or person can redirect a payment. Suppliers, for their part, need to know: how their customers will and won't ask for information, why changing bank details by email alone is never accepted and that a compromised inbox on their side puts their customers at risk too.

But awareness alone has limits: it depends on people getting it right every time, under pressure, at month-end. How a payment is made matters as much as who checks it, and this is where procurement software can do much of the heavy lifting.

How do Virtual Cards Help Stop Fraud?

Most B2B fraud targets the same weak point: a bank account number that can be swapped. ACH payments rely on the supplier's account details sitting in the buyer's system, and a single convincing email can redirect them. Virtual cards remove that weak point. Each payment uses a unique, single-use card number tied to a specific amount, so there is no standing account number to hijack or change: just 3% of businesses report fraud attempts via virtual card, compared with 33% via ACH.

Moving suppliers from ACH to virtual card is an education exercise in itself. Buyers need to explain the benefits clearly: faster payment, detailed remittance with every transaction and far less exposure to fraud. They also need to be transparent about acceptance costs, so suppliers can weigh the trade-off for themselves. Suppliers who understand why the change protects both sides are far more likely to make it.

How Do Payment Networks Protect From Fraud?

The other shift worth explaining is the value of paying through an established, verified payment network rather than managing every supplier's banking details one by one. On the largest B2B payment networks, hundreds of thousands of businesses are already enrolled, each validated against hundreds of data points, with bank details authenticated before a single payment is made.

This means that when a supplier is already a verified member of the network, the buyer doesn't need to collect bank details by email at all, and any change goes through an authenticated channel rather than an inbox. Every new participant benefits from the verification that has taken place before, so the network gets stronger as it grows.

Why Education and Procure-to-Pay Software Help Fight Fraud

Fraud tactics change every few months. Onboarding training from two years ago won't help anyone spot a cloned voice on a call today. Security guidance increasingly recommends that firms educate teams regularly, with short examples and quick refreshers rather than annual lectures. The same applies to the supplier base: fraud prevention has become an ongoing discipline that both sides practice together, not a one-off fix. In practice, that means agreeing a single, secure and documented way to change bank details at onboarding; encouraging suppliers to move from ACH to virtual card, and explaining why this is beneficial as well as paying through a verified network wherever possible, so bank details are authenticated before money moves. The goal isn't to make buyers distrust suppliers, but to ensure payments are safer for both, because when a payment goes astray, both sides lose.