Payments fraud is managed as an accounts payable discipline, and the annual statistics get read as a description of money leaving through the company's own disbursements. The seller-side version has a different victim. The Association for Financial Professionals surveyed 465 treasury practitioners in January 2026. Among organizations that suffered payments fraud in 2025, 17% reported an imposter posing as a representative of their company to one of their own clients. The money leaves the customer's bank, the seller never receives it, and the invoice stays open and is worked as a delinquency.

Vendor impersonation is the most common form the fraud takes

Business email compromise affected 74% of organizations in 2025, the most prevalent vector AFP recorded, and the fraudsters primarily impersonate vendors or executives to request changes to payment instructions. The FBI's Internet Crime Complaint Center logged 24,768 such complaints in 2025, carrying $3.05 billion in reported losses, up from $2.77 billion in 2024. Around 39% of AFP's respondents received genuine emails that fraudsters had intercepted, so the fraudulent document is often the seller's own invoice with the payment block replaced. One respondent: "A scammer took over the email box of one of our key vendors and started to send fake invoices to our operations; those bogus invoices were processed in the normal way with all approval steps."

Buyers have already built the verification controls, and every vendor pays for them

Ninety-six percent of AFP's respondents have policies to verify changes to invoices, bank deposits, and contact details. Ninety-four percent verify transfer requests by calling the payee on a number from official records rather than one supplied in the email, and 63% rate that control very effective. Those controls apply to every vendor, so invoices arriving as attachments from individual mailboxes, with bank details in the body, trigger a verification cycle on each change. The days that cycle consumes are logged in the seller's aging report as customer payment behavior.

A wire sent to the wrong account leaves the receivable open

Consider a connected-device company invoicing $186,000 for a 400-unit order plus the first year of the attached subscription. The controller emails the invoice as a PDF from her own mailbox. Two days later the customer receives a follow-up in the same thread, from a lookalike domain, noting a change of bank, and wires the funds. Forty-five days on, a collections reminder goes out, the customer produces a payment confirmation, and the account moves into a dispute nobody owns. Among organizations under $1 billion in revenue that suffered payments fraud in 2025, AFP found that 48% incurred a loss and 24% recovered none of it.

Three things a seller cannot demonstrate when invoices travel by email

• Which document was issued. A PDF sent from a personal mailbox leaves no record beyond a sent-items folder, so reconstructing what the customer received depends on the customer's copy.
• That the payment instructions never changed. Remittance details printed in a document are a claim, and the seller cannot show it held between issuance and payment.
• A verification route that avoids email. When the only contact the customer holds arrived through the same channel as the fraud, the call-back that 94% of buyers run has nowhere reliable to land.

Five changes to how invoices and payment instructions are issued

1. Issue every invoice from one system, not from individual mailboxes, so the record of what was sent exists.
2. Give customers a payment path that begins in the seller's system instead of instructions they re-enter into their bank.
3. Publish a verification contact and phone number at onboarding, so a call-back reaches the seller and not the sender.
4. Tell customers in writing that banking details are never changed by email, and route any genuine change through named contacts on both sides.
5. Treat a customer claim of payment against an open invoice as a fraud check the day it arrives.

The invoice is a payment instruction and belongs on a system that records what it sent

A seller controls how its invoices arrive and how the customer pays, if not how the customer verifies them. Turnstile issues invoices to a customer portal, a shareable link where the customer views, downloads, and pays the invoice, with payment handled through the connected Stripe account, so the payment path sits in the seller's system rather than in the body of an email.