Ghost vendor fraud is a billing scheme in which an insider sets up a supplier that does not exist, sends invoices in its name and pays them to an account they control. The signs sit in two places: a vendor file with an employee's address, phone or missing tax ID, and bank data showing the payments reaching a personal account.
How does ghost vendor fraud move money out of a business?
Ghost vendor fraud moves money in four steps: someone adds a fake supplier to the vendor list, creates invoices for goods or services nobody receives, gets those invoices approved, and has the payment sent to an account they control. Each step relies on access the person already has, which is why the scheme is usually run from inside accounts payable.
The person behind it is rarely a stranger. It tends to be someone who can do at least two of these jobs at once:
- Add or edit vendors in the accounting system.
- Enter invoices or code them to an expense account.
- Approve payments, or prepare them for an approver who signs without looking.
- Receive the bank statement or reconcile the account the payments leave from.
A fake supplier needs a believable name. Common choices echo a real vendor ("Acme Supply" next to "Acme Supplies Inc"), a generic service ("JM Consulting", "Facility Services LLC"), or initials that mean something only to the insider. The invoices go to an expense account where nobody expects to see a delivery: consulting, repairs, marketing or software. Those accounts are harder to test than inventory, because there is no stock count to contradict them.
The scheme is a cousin of payroll fraud. When the fake party is on the payroll instead of the vendor list, the trail runs through pay registers and direct deposit records, and ghost employee fraud covers how that version is found. Both rely on the same weakness: one person can create the payee and also get it paid.
Ghost vendor signs in the vendor master file
The vendor master file is the list of suppliers your system can pay, with their contact, tax and bank details. Ghost vendor signs in it are fields that a real business would fill in differently: a home address, a missing tax ID, a mobile number that belongs to staff, or a recent edit by the same person who enters invoices.
Pull the full vendor list with every field and the change history, then read it with these questions in mind:
- Address. Is it a residence, a post office box or a mailbox store rather than a business premises? Does it match an employee's home address?
- Tax ID. Is the tax ID field empty for a vendor you pay enough to need a Form 1099? Is the same tax ID used by two vendor records?
- Contact details. Is there no phone, or only a mobile number? Is the email address on a free mail service with a person's name?
- Bank details. Does the vendor's bank account match an employee's direct deposit account, or another vendor's account?
- History. Who created the vendor, and when? Was it created and first paid within a few days? Who last changed the bank details?
US payers that file information returns can check vendor names against tax IDs before filing. The IRS describes its TIN Matching service for payers of information returns, which validates name and TIN combinations and is open only to payers and their authorized agents. A vendor whose name and tax ID do not match is worth a second look, even if the cause turns out to be a typing error.
Collecting a signed tax form from every new supplier before the first payment is the cheap control here. A ghost vendor can still supply a stolen or invented number, but the request itself puts friction in front of the scheme.
Ghost vendor invoice patterns: round amounts and tidy numbering
Invoices from a supplier that does not exist are written by the person committing the fraud, and they tend to look too neat. Ghost vendor invoice patterns include round amounts, invoice numbers that rise one at a time, descriptions with no detail, and totals that sit just below the level that needs a second approval.
Look at all the invoices for one suspect vendor side by side. Each pattern below has an innocent explanation on its own. Several together point somewhere else:
- Round or repeated amounts. Many invoices for exactly 2,500.00 or 4,900.00, month after month.
- Sequential numbering. Invoice 1001, 1002, 1003 across a year, which suggests the business has no other customers.
- Vague descriptions. "Consulting services" or "maintenance" with no dates, hours, sites or names.
- Amounts just under the approval limit. If invoices above 5,000.00 need a manager, a run of invoices at 4,850.00 is a pattern to test.
- No delivery evidence. No purchase order, no receiving report and nobody in operations who remembers the work.
- Odd timing. Invoices entered on weekends, at month end, or when the approver is away.
Round amounts deserve a filter of their own across the whole ledger, not only one vendor. A method that strips out normal round payments such as rent and loan installments is in testing round dollar transactions in bank data.
Where do ghost vendor payments land in the bank data?
Ghost vendor payments land in an account the insider controls, and the bank data usually shows which one. For a check, the back of the cleared check image shows who deposited it and where. For an ACH or wire, the payee account number in the payment file or the bank's payment detail shows the receiving bank and account.
Most people reviewing payables stop at the vendor name printed on the check or in the ledger. The name is the easiest part to fake. The money has to land in a real account, so follow the money to that account.
Checks
Request the front and back images of checks paid to the suspect vendor. Look at the endorsement: a business supplier usually stamps a deposit endorsement for its own business account. A ghost vendor check is often endorsed by hand, deposited by mobile capture into a personal account, or deposited at the same bank branch the insider uses. What to look for on the image itself is covered in reviewing altered check images.
ACH and wire payments
For electronic payments, compare the receiving account in each payment with the bank details in the vendor master and with your payroll direct deposit file. A vendor paid to an account at a consumer bank, or to an account that changed shortly before the payments started, is a strong signal. A change of bank details is also how outside fraudsters redirect real vendor payments, which is why the verification process in checking vendor bank account changes by callback is worth having in place regardless.
The same follow-the-account logic applies when the money belongs to someone else. In property management, a ghost "maintenance contractor" paid out of owner or tenant funds produces a shortage that the property management trust account reconciliation should surface when owner ledgers are tied to the bank.
Matching the vendor file to employee records for ghost vendors
Matching the vendor file to employee records is the single most useful ghost vendor test. You compare each vendor's address, phone number, tax ID and bank account with the same fields in the payroll or HR file. A vendor that shares any of them with a staff member needs an explanation.
The match, step by step
- Export the vendor master with name, address, phone, email, tax ID and bank routing and account numbers.
- Export the employee file with home address, phone, personal email, tax ID and direct deposit account.
- Normalise the fields. Strip spaces and punctuation from phone numbers and account numbers. Standardise street abbreviations ("Street" and "St", "Suite" and "Ste") and remove apartment numbers for a second, looser pass.
- Match exact fields first. Join on bank account number, then tax ID, then phone, then email.
- Match addresses loosely. Join on postcode plus house number, which catches "12 Oak Ave" against "12 Oak Avenue, Apt 3".
- Add payment totals. For every match, total the payments to that vendor over the period you are testing.
- Sort by total paid and work down from the top.
An example result
The table below is an example of what the match can return. The names, amounts and matches are made up for illustration.
| Vendor | Matched field | Matched to | Paid in 12 months | Vendor created by |
|---|---|---|---|---|
| JM Facility Services | Bank account | Payables clerk's direct deposit | 41,600.00 | Payables clerk |
| Northside Consulting | Home address | Office manager | 18,000.00 | Office manager |
| R. Patel | Phone number | Warehouse lead | 1,250.00 | Purchasing |
| Coastline Print Co | None | (no match) | 9,870.00 | Purchasing |
The first row is the serious one: a shared bank account, a large total and a vendor created by the person it matches. The second needs a conversation and the supporting invoices. The third may be an employee reimbursed as a vendor, a common shortcut that is still worth correcting. The fourth matched nothing, which does not clear it: an insider can use a friend's address or an account opened in another name.
Run the match on former employees too. A person who left two years ago can still have a vendor record that someone else now pays. And remember that some insiders take money before it ever reaches the books rather than paying it out; skimming fraud explains that receipts-side scheme, which a vendor match will never find.
Ghost vendor false alarms: real suppliers that look fake
Many ghost vendor signs have innocent causes. Sole traders work from home, small suppliers use mobile phones and free email, and some employees really do run a side business the company buys from. A hit is a reason to check the work was done and the price was fair, not a finding of fraud.
These are the common false alarms, and what clears each one:
- Home-based sole traders. A bookkeeper, a cleaner or a web designer working from a residence. Clear it by confirming the work with the person who received it.
- Employees reimbursed as vendors. Some systems pay expense claims through accounts payable. Clear it by matching the payments to approved expense reports.
- Related-party suppliers. An owner's relative supplies goods at a fair price. This is a disclosure and approval question, not theft, but it should be on record.
- Shared addresses. Several vendors at one office building or business park. Clear it with the suite numbers.
- Data entry duplicates. The same real vendor entered twice under slightly different names, which duplicate payment testing also picks up.
Treat a false alarm as a finding about the vendor file, even when it is not fraud. A vendor record with no tax ID or a home address you cannot explain is a gap someone could use later.
What should you do when a ghost vendor test returns a hit?
When a ghost vendor test returns a hit, confirm quietly whether the goods or services were received, before anyone involved knows you are asking. Pull the invoices, approvals and payment records, find the receiving account, and talk to the people who would have used the supplier. Only then decide whether to escalate.
A sensible order of work:
- Freeze the record, not the person. Put a payment hold on the vendor in a way that looks routine, such as a vendor file review for all suppliers.
- Copy the evidence. Save the vendor history, invoice images, approvals and bank payment details somewhere the suspect cannot edit.
- Test the delivery. Ask operations staff, without naming the vendor as a suspect, what that supplier does for the business.
- Find the account holder. For checks, the endorsement and deposit bank. For electronic payments, the receiving account number, which your bank or counsel can help trace.
- Size the loss. Total every payment to the vendor since it was created, and check whether any other vendors share its details.
- Decide on next steps with the owner, counsel or a forensic accountant, depending on the amount and who is involved.
Bank data makes the sizing step faster. With the year's statements in hand, PreciseBankFlow checks that each one foots and lists the payment lines you can then filter by payee, so you can total a suspect vendor's payments against the bank's own record rather than the ledger the insider maintained.