A company check does not authenticate an email
An invoice can contain the name and registration number of a real Irish company while directing payment to a fraudster. Company verification and payment-instruction verification are therefore two separate controls. Complete both before releasing funds.
Search the registration number and match the legal name, status and address with the supplier approved during onboarding. Then compare the invoice against the purchase order, contract, delivery evidence and existing supplier master data.
- Exact legal company name and registration number
- Purchase order, contract and delivery reference
- Approved beneficiary and account details
- Known contact who can confirm the instruction
Verify every bank-detail change out of band
Invoice-redirection fraud often relies on a convincing message that changes legitimate payment details. Do not reply to the same email chain as your only check. Contact the supplier using details already held in your system or obtained independently, and ask a known person to confirm the full instruction.
Use a consistent script and record the result. If the caller, domain or beneficiary differs from previous dealings, escalate rather than allowing urgency to lower the control. A short delay is usually less costly than attempting to recover a misdirected transfer.
Build an accounts-payable gate that people can follow
The best process is clear enough to use under time pressure. Mark first payments and bank changes automatically, define approval thresholds, separate supplier-master changes from payment release, and require evidence before the exception can move forward.
A company report strengthens the supplier identity file when the payment is material or the supplier is new. It can show available directors and filing history, but it will not confirm that the bank account belongs to the company. That confirmation must come through your payment controls.
- Never let one person create a beneficiary and release the payment alone.
- Do not use contact details supplied only in the change request.
- Make urgent exceptions visible to a named senior approver.
- Review supplier details periodically, not only after an alert.
What to do when the checks do not agree
Pause the payment. Contact the supplier through a previously trusted route, notify your internal fraud or finance lead and preserve the message, invoice and verification evidence. Do not alert a suspected fraudster to internal detection methods.
If money has already moved, contact your bank immediately because recovery can be time-sensitive. Follow current Garda and bank guidance for reporting. The company report remains useful evidence of the entity being impersonated, but the bank and authorities handle the payment incident.