Request access
Invoice & vendor fraudACH fraudAccounts payable fraudCEO & wire fraudAuthorized push payment fraudDeepfake payment fraudTransaction fraud preventionPayee verification, before it settlesBusiness transaction verificationVerifiable attestationVerifiable transaction securityQuantum-safe paymentsAgentic payment securityHow it worksAll payment railsRTP fraud preventionFedNow fraud preventionStablecoin securityTokenized depositsOn-chain settlementBanks & credit unionsFintechs & PSPsStablecoin issuersCrypto custodiansCorporate treasuryMarketplaces & platformsEnterprise transaction integrityWhy RankShield FinancialRankShield vs AccertifyAI-agent payment risksHarvest now, decrypt laterData protectionComplianceSecurityAboutRequest access
RankShield Financial · Accounts payable

Invoice fraud preventionfor the payment that goes to the wrong account.Invoice fraud, also called vendor payment fraud, reroutes a real payment to a fraudster who changed the banking details by email. RankShield verifies the payee and the approval before the money moves, so a change that arrived in an inbox does not clear on its own.

Request accessHow it works
payee-verifiedapproval-boundchecked before it settles
The scale, from the FBI
$2.77B
reported U.S. business email compromise losses in 2024, across 21,442 complaints (FBI IC3)
74%
of organizations hit by BEC in 2025; 48% of firms under $1B in revenue took a payments-fraud loss (AFP 2026)
01 // the attack
What invoice fraud actually is

A real payment, sent to the wrong bank account

Nobody breaks into your bank. The attacker changes where a legitimate payment goes, and your own team sends it.

Invoice fraud, vendor payment fraud and vendor email compromise all describe the same attack. A fraudster either spoofs a supplier’s email or takes over the supplier’s real mailbox, sends a message that the vendor’s banking details have changed, and adds a note of urgency. Your accounts payable team updates the vendor record and pays the next invoice, on time, to an account that belongs to the fraudster. The FBI’s Internet Crime Complaint Center classifies this under business email compromise, which it has called the 55 billion dollar scam based on global exposed losses from 2013 through 2023.

The reason it works is that the payment is authorized. Every fraud control your bank runs is built to catch a payment that you did not mean to make: a stolen card, a hijacked login, an unusual device. This payment is one you did mean to make, to a vendor you really owe, in an amount that matches a real invoice. The only thing wrong is the destination account, and that detail was changed through a channel your controls never inspect. That is why detection built for account takeover does not see it.

02 // how it lands
How it lands at an SMB

The change that no one verifies

A supplier you pay every month emails new banking details

The email looks right, the invoice is real, the deadline is Friday

The message comes from the supplier's address, or close to it. It references a genuine open invoice. It asks you to update the account before the next run. Your AP clerk updates the vendor master and schedules the payment. Two days later the real supplier asks where their money is. On a wire, RTP or FedNow, it has already settled and left the country.

RankShield: RankShield holds on the detail that changed. A banking-detail change does not take effect because an email requested it. The payee is verified against the record you already trusted, and the specific payment needs proof that an authorized person approved it, before it moves.
03 // the money is faster
Why you cannot just recover it

Recovery is a backstop, not a control

The FBI can freeze funds when fraud is reported fast enough. Most of the money is already gone.

66%
Success rate of the FBI's Financial Fraud Kill Chain in 2024, on the cases it could act on. It froze $561.6M (IC3, 2024).
The catch
That rate only covers victims who reported in time and were still inside the freeze window. It says nothing about losses that never get frozen.
Same day
In the FBI's own 2024 examples, money wired onward to overseas accounts the same day could not be recovered at all.

Source: FBI IC3 2024 Annual Report. We deliberately do not repeat the “72-hour window” figure that circulates online; it does not appear in the FBI’s report.

04 // the fix
What actually works

The control the FBI recommends, made automatic

Every authority names the same defense. The problem is that it depends on a person doing it every time.

The FBI and Nacha both name the same primary defenses against this fraud: verify any change to banking details through a second, out-of-band channel, using a phone number you already hold rather than one from the request, and require a second person to approve the release. That advice is correct. It is also manual, and manual controls fail under exactly the conditions this attack creates: urgency, a real deadline, and an understaffed accounts payable desk where one person can update a vendor and send a wire.

Verify the payee

not the email

A banking-detail change is checked against the vendor record you already trusted, not accepted because a message asked for it. The out-of-band step the FBI recommends, applied automatically.

Bind the approval

this payment only

The specific payment needs proof that an authorized person approved it. Dual control that cannot be skipped when the clerk is under deadline.

Check before it moves

pre-settlement

The verification happens before the payment settles on the rail, which is the only point where stopping it still saves the money on an irreversible rail.

Leave a receipt

what was approved

Every decision produces a record of who approved what, so the AP team can show the control ran. See verifiable attestation.

Shared across the network

flagged once, known to all

A payee or account flagged at one member of the RankShield Network is shared across it, so a fraudster burned at another business is known before it reaches you. Unlike a scoring consortium, every shared verdict is independently verifiable, and the signal compounds as members join.

05 // why SMBs
Built for the AP desk that has one

Small and mid-sized businesses are more exposed, not less

The recommended controls assume a fraud team you do not have. This is built for the team you do.

Enterprises the size of an Accertify client have layered fraud operations. A small or mid-sized business usually has an accounts payable clerk, a manual approval chain, and a founder who can send a wire from a phone. That is not a moral failing; it is how a lean business runs. It is also why the 2026 AFP Payments Fraud survey found that 48 percent of organizations under a billion dollars in revenue took a fraud loss, and why only 17 percent of organizations overall use any automation to fight it. The manual callback the FBI recommends is the right control and the first one to get skipped when the person doing it is also doing four other jobs. Automating it is the point.

See how it maps to your AP process
What we claim, and what we do not

A verification vendor should be precise about its own evidence

We do not claim a large fraud-detection network, because that value comes from many participants and we are early. We do not show you customer names or loss-prevention statistics we cannot substantiate. And we do not tell you a build is cryptographically sealed to our transparency log unless it is, which our transparency page reports honestly, build by build. What we offer a small or mid-sized business today is the verification control the FBI and Nacha already recommend, automated and made unskippable, applied before the money moves.

FAQ

Invoice and vendor fraud, answered

What is invoice fraud, and how is it different from a hacked account?
Invoice fraud, also called vendor payment fraud or vendor email compromise, is the scam where an attacker gets your accounts payable team to send a real payment to the wrong bank account. Nobody breaks into your bank. The attacker either spoofs or takes over a supplier’s email, sends a message that the vendor’s banking details have changed, and your team updates the vendor record and pays the next invoice to the fraudster. It is a subset of business email compromise, which the FBI’s IC3 reports caused 2.77 billion dollars in reported U.S. losses in 2024 across 21,442 complaints, making it the second largest internet-crime loss category that year. The payment itself is authorized and looks completely normal, which is why bank fraud controls built to spot account takeover do not catch it.
Why can’t we just recover the money afterward?
Because the rails these payments travel on are effectively irreversible, and the money moves faster than recovery does. When a fraud is reported quickly the FBI’s Recovery Asset Team can try to freeze funds through its Financial Fraud Kill Chain, and in 2024 it succeeded on 66 percent of the cases it was able to act on, freezing 561.6 million dollars. That sounds reassuring until you read the denominator: it only covers victims who reported in time and were still inside the freeze window, a fraction of total losses. In the FBI’s own 2024 examples, money wired onward to overseas accounts the same day could not be recovered at all. Recovery is a backstop that works sometimes. It is not a control.
How does RankShield actually stop it?
By verifying the payment before it settles rather than scoring it afterward. Every payment carries an intent: who is paying, who is being paid, how much, and why. RankShield checks that intent against the vendor record you already trust and requires proof that a real, authorized person approved this specific payment, before the money moves on the rail. A banking-detail change that arrived by email does not clear on its own. The FBI and Nacha both name out-of-band verification of account changes and dual control as the primary defenses against this fraud. RankShield automates exactly those steps and makes them unskippable, which matters most at a small or mid-sized business where the manual version breaks under urgency and volume.
Isn’t this just a problem for big companies?
The opposite. The 2026 AFP Payments Fraud survey found that 48 percent of organizations under one billion dollars in revenue took a fraud loss, and that 74 percent of organizations overall were hit by business email compromise specifically. Smaller businesses are more exposed per dollar, not less, because they rarely have a dedicated fraud or treasury team, their accounts payable process is manual, and one person can often originate a wire. The controls the FBI recommends assume someone has the time to call a verified number and get a second approval on every banking change. At an understaffed AP desk under deadline, that is exactly the step that gets skipped, which is the gap this is built to close.
Does this work for ACH and checks, or only wires?
The core wedge is strongest on the fast, hard-to-reverse rails such as wires, RTP and FedNow, where the money is gone the moment it settles. It is worth being precise, though: the AFP survey found checks were still the most-attacked payment method in 2025 at 58 percent, ahead of ACH debits at 30 percent and wires at 25 percent, so no single-rail claim tells the whole story. The principle is the same across rails. Verifying the payee and the approval before the payment leaves is a better position than trying to claw it back after. Where a rail has a return window, that verification simply gives you more time and more certainty; where it does not, it is the only real chance you get.
What can you prove, and what are you still building?
We are precise about this because a payment-security vendor that overstates its own evidence has no business asking you to trust it. The mechanism is real and you can inspect how it works. What we do not claim: a large fraud-detection network, since that value comes from many participants and we are early; named customers or loss-prevention statistics we cannot show you; or that any specific build is cryptographically sealed to our transparency log, which our own transparency page reports honestly build by build. What we offer a small or mid-sized business today is the verification control the authorities recommend, automated and made unskippable, applied before the money moves. Request access and we will show you exactly how it maps to your accounts payable process.
Verify, then settle

See your payments verified before they settle.

Invoice fraud sends a real payment to the wrong account. The defense is to verify the change before it settles, automatically, on every payment. Request access and we will map it to your accounts payable process.

Request accessHow it works