Before you pay a batch: duplicates, changed bank details and why the builder should not be the only checker

The size of the problem

Business email compromise accounted for USD 2.77 billion of losses on 21,442 complaints to the FBI in 2024. APQC data cited by CFO.com puts duplicate or erroneous payments at about 0.8% to 2% of disbursements. Neither figure says how likely a loss is to your business, but both say the control is worth having.

Why exact matching misses duplicates

A duplicate is not always the same invoice number. It can be a reformatted number, a part payment, a reissued invoice or the same amount from the same supplier a few days later. Look for near matches, and list each with the evidence so a person can hold or release it.

• Same supplier, near-same number.
• Same supplier and amount within a few days.
• A part payment against an invoice already paid.

A changed bank detail is a prompt to call back

Compare bank details with the supplier record or last payment, not with the message that announced the change. Call the supplier on a number you already hold. Confirmation of Payee checks the account name for UK payments but does not tell you the request was genuine.

Separate the builder from the checker

NIST's access-control family includes separation of duties, so that harm needs more than one person. The person who builds the payment batch should not be the only one who checks it. A list of things noticed is for that second person, and it must never say the batch is cleared.