Inside the AP Fraud Bootcamp: Four Cases Worth Learning From

In this episode, AP expert Debra Richardson joins host Grace Berube to review real, anonymous fraud cases submitted by attendees of the AP Fraud Bootcamp session and the lessons AP teams can take from them. Debra shares what the submissions revealed about the industries, systems, and vendor volumes involved, then walks through four cases: a bank change request where the confirmation call reached the wrong person, an attempted scheme built on a fake CEO message sent through WhatsApp, a $100,000 fraud avoided thanks to a successful confirmation call, and a $600,000 loss tied to a vendor self-registration portal. Along the way, Debra offers practical fixes, from scripted confirmation calls to treating portals as just another document delivery method, and reflects on what the session taught her about trust in the vendor process.

WHAT YOU’LL LEARN IN THIS EPISODE

• What a crowd-sourced look at real fraud cases reveals about the industries, ERP systems, and company sizes being targeted, from 400 vendors to 70,000.
• Why a confirmation call is only as strong as the person you reach, and how a scripted call that asks for the last five digits of the existing bank account can authenticate the right contact.
• How a fraudster impersonating the CEO over WhatsApp tried to work through an internal team member, and why a request from the CEO is itself a red flag.
• Why the confirmation call is still worth the effort, illustrated by the case where it helped one team avoid a $100,000 fraud.
• How a vendor self-registration portal became the entry point for a $600,000 loss, and why portals should be treated as one more delivery method with the same controls in place.

Debra Richardson
Accounts Payable Consultant | Speaker | Trainer – Debra R. Richardson, LLC

Debra is an Accounts Payable speaker, consultant, and trainer with over 20 years of experience in AP, AR, general ledger, and financial reporting for Fortune 500 companies including Verizon, General Motors, and Aramark.

For over a decade, Debra has focused on Global Vendor Maintenance.  As an Senior AP Manager at a Global 15 company she lead a team of 17 that over 2,000 vendor requests per month and maintained 140k+ global vendors across seven ERPs. In her consultancy, she focuses on working with vendor teams to add authentication techniques, internal controls best practices and vendor validations to reduce the potential for fraud, compliance fines and bad vendor data in the vendor master file.  She is the President of the Central Atlantic Region IOFM Chapter and the IOFM Ask the Expert for the Vendor Master File Category.  

A Certified Fraud Examiner (CFE), Debra works with vendor management teams to clean their vendor data and update their vendor processes so they pay the right vendor.

She has a YouTube channel where she posts vendor master file tips every Tuesday and hosts a weekly podcast: “Putting the AP in hAPpy”. 

Grace Berube
Senior Content Manager, IOFM

Grace is the Senior Content Manager at the Institute of Finance & Management (IOFM), where she has led content strategy and development since 2022. In this role, she oversees all aspects of IOFM’s digital and event-based content, ensuring it remains timely, relevant, and actionable for all financial operations professionals.

Grace manages IOFM’s robust library of site content, leads the organization’s editorial and member webinar programming, and hosts IOFM’s podcast series. She also oversees a team of subject matter experts who contribute thought leadership and educational articles. In additional, Grace curates and manages all speaker content for IOFM’s in-person and virtual events, ensuring consistency and quality across every touchpoint. With nearly three years in the role, Grace brings a deep understanding of the financial operations landscape and a passion for delivering content that empowers professionals to excel in their roles.

Transcription

Grace Berube: Welcome to the IOFM podcast, the go-to show for accounts payable professionals who want to stay ahead of the curve. Whether it's automation, artificial intelligence, career growth, compliance, leadership, or the trends shaping the future of AP, we're bringing you the real conversations with the professionals driving this industry forward.

Hey Debra, how’s it going?

Debra Richardson: Hi, Grace. It is going well. I'm in Michigan and the sun is actually shining. So, that’s always a good thing.

Grace Berube: I know. It has been very sunny and hot in New England, but we can't complain. It's very nice.

Debra Richardson: Yeah, it's very nice because Michigan is like the second from the lowest of the sunshine states or something. I don't know.

Grace Berube: Yeah, that's true.

Debra Richardson: So, I'm having a good day.

Grace Berube: So good, you have some sunshine, it's bright and early, we're recording, it's great. Awesome. So, we're going to talk today about—so, we had a podcast at the beginning of the year, we talked about a new fraud prevention session that we're going to have at the Spring Conference.

00:01:01

We're recording this now in August, so we're a few months out from the Fall Conference, and the Spring Conference happened in May. So, I want to talk to you a little bit about one of the sessions that you did at IOFM Spring that you've really resonated with and you learned a lot from, I feel like, the audience and got some new ideas, and that's the AP fraud bootcamp session. So, we're going to talk about that today, how that went, and what we can all learn from that session that took place at IOFM Spring.

Debra Richardson: Yeah, and I am so excited about that. So, you know how they say you love all your kids the same, but we know that's not exactly true.

Grace Berube: Yeah.

Debra Richardson: So, I had five sessions, but this was my favorite.

Grace Berube: Good. Okay, cool. So, talk to me a little bit about how this came to be. And we had to lay a little bit of groundwork ahead of time in order to get it up and running.

00:01:53

Debra Richardson: Yeah. And so, what we wanted to do is we wanted to get some real fraud cases from the attendees that were going to come there. And so, we wanted to get those cases, I would review them. I would provide some expert solutions, but we would also have the other attendees that were in the session talk to it as well. And so, I thought that that was a great thing to do.

 And then we launched, I think it was like a survey or something, asking seven questions ahead of time so that we would have those cases that we could review.

Grace Berube: Right. And we can make them as anonymous as possible. Obviously, when you're talking about fraud cases, people sometimes don't want to reveal everything about them, especially in a public setting. So, talk to me a little bit about what we asked and how that helped guide your choices for the session.

00:02:56 

Debra Richardson: Yes, it was anonymous. And that was great because at that point, then we could get relevant information that we could all learn from. And so, we ended up with, I think, seven questions. So, we asked for the industry because sometimes that can be important because fraudsters may target certain industries. And so, we got education, retail, manufacturing, healthcare, because healthcare is always included in some type of fraud, wholesale trade, and public relations. So, it ran the gamut. But again, healthcare, education, and actually manufacturing is starting to be targeted too. So, it was great. We had a great representation of trending fraud as far as industry went.

Grace Berube: That's awesome.

Debra Richardson: And then, a second question we asked was the accounting system or their ERP system. And, you know, Workday is starting to pop up everywhere. So, I think that's becoming a main accounting system.

00:04:06

Grace Berube: It is. Yep.

Debra Richardson: So, we had that. We had a couple Oracles. We had a couple of SAPs too, which was good. And then, we had PeopleSoft and D 365, that Microsoft Dynamics. And then, we had Tyler Munis. And I know that Tyler Munis is something that at least is in the education realm, like higher education. It might be K-12, too, but I know it's in the education realm. It may be in other industries as well. But I know it's in higher education, so.

Grace Berube: Okay, yeah. I hadn't heard of that one.

Debra Richardson: Yeah. You know, there are so many industry-specific accounting systems, the ERPs. I used to think yeah, these are all the big, you know? But it's just a gamut out there.

00:04:59

Grace Berube: Totally. It really is.

Debra Richardson: And some still have the homemade ones. So, I don't even know how that's working out.

Grace Berube: Oh my gosh. I can’t imagine.

Debra Richardson: But it's just a lot. So, that was the second question. And then, the third question was the number of vendors. And there really was a wide range of vendors, which I really like because it means that we were serving attendees from small companies to larger companies. So, the range of vendors went from 400 active vendors to 70,000.

Grace Berube: Wow. Yeah, that's a big range.

Debra Richardson: Yes. But you know what? We were all in the same room. And so, that really worked out because the smaller companies could hear what the bigger companies were doing and vice versa. So, I thought that was great.

Grace Berube: Yeah. Absolutely. And the amount of the fraud was pretty varied as well.

Debra Richardson: Yeah, it went down to $10,000 as the lowest to $600,000 as the highest.

00:06:01

Now, one thing I think we might want to do in the future, when we do it for the Fall conference, is to ask to enter a fraud amount for the attempted fraud too. Because if we had an attempted fraud, we didn't ask for that amount. And so, that would be nice to know how big of a loss they averted, so.

Grace Berube: Right. Absolutely.

Debra Richardson: Yeah. And then the next one, always my favorite one, was who owns the vendor process? And so, that one was a write-in. We might want to just define it going forward because everyone's department names can be different. But five of them were accounts payable, so no surprise there. Two was a separate team, like a master data governance team.

00:06:57 

And that might have been with the SAP ones. I don't know if that was it for sure, but it could have been with the SAPs because you can combine the customer master file and the vendor master file. And typically when you do that, they'll set it up in a separate master data group. So that makes sense, if that's what it was. And then, we had one that was procurement. 

And then, the next question was the recent fraud attempts, what were they? And so, no surprise here. So, fake invoicing, check washing. So, we know check fraud is increasing. EFT payment fraud. And we know about business email compromise, where most of the requests are to change banking. Although some of the requests now, because check fraud is increasing, is to change remittance addresses too so that they can redirect the vendor's check payment too. But in this case, it was bank account updates.

00:08:02

Grace Berube: Okay, gotcha.

Debra Richardson: Yeah. And then for the fraud attempts, though, some of them entered how many they had, while others entered what type. So, we might want to clarify that for the conference survey. So, it's good that we learned from this and can make it a little bit better for the next one.

Grace Berube: Yeah, absolutely. Because I think we are going to be hosting this as well at Fall. So, this podcast should also come out ahead of that session. So, it's exciting. So, there were eight cases submitted, right?

Debra Richardson: Yeah, there were eight cases submitted. And the last question was on the actual fraud story. How did it start? What the fraudster tried to get you to do. Was the payment fraud successful? What internal control was supposed to catch it and why didn't it? And then, what changed after the incident?

00:08:55 

And so, there were a total of eight fraud cases submitted, but two of them left out that last question, the fraud story. And so, I put them up on the screen. I made a slide for them so that if the folks that submitted it were attending the session, they could speak to it. But yeah, they left the fraud story out. So, we did put it up there. 

But of the cases that were submitted, there were some—I mean, they were all really good, but there were three of them that stood out that we can talk about today. But I do want to start with how I started the session out.

Grace Berube: Yeah, please.

Debra Richardson: So, what I wanted to do is I wanted to set the stage. And so, what I did is I had some slides up there that talked about how fraudsters are evolving.

00:09:56 

And vendors too are evolving with the confirmation call because the fraudsters know we're doing a confirmation call. And so, they're evolving, getting their tactics around that. But not only with the confirmation call, but also with the bank account ownership validation because fraudsters know we're doing that. And so, they're coming up with tactics to get around that. 

So, I started off with that. I said fraudsters and vendors, because the vendors are trying to protect their payments. And so, they're evolving as well with how they submit their banking. I don't know if we did a podcast on it, but we might want to because sometimes vendors are taking it into their hands not to give their clients their banking information via email, if that is the only way the client has to collect the banking information.

00:11:03 

So, they'll just give them partial of it, and then have another way for them to get the rest of it. So, I put all of that up, along with some typical fraud prevention techniques, and then some that would apply directly to the cases that we received. And so, the whole point was set the stage for fraud prevention, that mindset, and just get everybody thinking.

Grace Berube: Yeah, absolutely.

Debra Richardson: Yeah. And so then, we looked at each fraud case submitted. And each one, like I said before, was a different slide, with all the information submitted so that we could discuss it as a group. Now, I did have on there expert advice. I added that, but I had it as a automation.

00:11:55

I didn't put that up first because I did want to make sure that we had a discussion beforehand, and then I put what I thought. And in some cases, I didn't amend the expert advice I had after reviewing it, but I did expand it because we had some great ideas, so.

Grace Berube: Yeah, that's awesome. So yeah, let's go through a couple of them.

Debra Richardson: Yeah. So, I think I have three. And the first one is a typical one. The supplier bank account was compromised or a request was received to change bank account information. But the key here is, one, bank account ownership validation was done, but they couldn't find the account. And that happens a lot. Listeners may say yes, that's happened to me too because depending on if you're in the U.S. and depending on what provider you're using, they may just be relying on the voluntary submission of deposit or information right from banks nationally.

00:13:07

And so, not all banks have the ability to voluntarily send that information. And so, you may not be able to find that bank account. Or some vendors don't use a bank account that has their name on it or their tax ID. They may be a subsidiary and they may be using their parent company’s bank account. And so, you might not always find it. And so, that's what happened in this case. 

Grace Berube: Okay, gotcha.

Debra Richardson: The second problem was that they did do the confirmation call, but the confirmation call was not valid either. And so, they don't know.

00:13:57

They don't say, and I don't remember if they clarified this, but I don't know where they got the phone number that they used to do the confirmation call. It sounds like, based on what they wrote, that it was a valid phone number to use. So, maybe they had it in their vendor master file. But hopefully, they didn't use the phone number that was on the request because that request was fraudulent. And then hopefully, they didn't grab it from the internet because the fraudsters may have spoofed their site and provided a different number. That happens a lot too. 

Grace Berube: Right. Totally.

Debra Richardson: Yeah. And so, they did the confirmation call. It wasn't valid. They actually said they assumed that the person that answered just said yes without knowing.

00:14:54 

So, if they did actually reach a point of contact at the vendor's place of business then yes, that's exactly what happened. They ended up sending the payment. 

And this one, I don't think they had an amount on here. They just put attempted. And that's where I was saying we probably need to shore that up, so we can get the actual amount. But it really ended up being attempted, but it really was a successful fraud at first because they did send the actual vendor's payment to the fraudsters. They just found out the next day and was able to get that money back. The bank was able to recover the funds because they found out the next day. So, that was great.

Grace Berube: That's thankful. So, what would you do in this specific case? What would be your expert advice? It did say what changed after the incident. They did say that they had more stringent verifications. But what would be your advice for something like this to stop this from happening?

00:15:57

Debra Richardson: So, my advice is that confirmation call, you need to put a process around that. Especially those folks that, if you're not doing that confirmation call yourself and you are relying on different team members to do that confirmation call, make sure that they have a script available to perform that confirmation call. And so, within that script—and everybody’s going, a script?—yes. Within that script, have ways to authenticate who they are talking to.

So, this example was a bank account change. So, when you contact the vendor's point of contact, when you get them on the phone, ask them for the existing banking information, last four digits of the bank account number, the existing bank account number on file. Last five digits.

00:16:56 

And I said four, but it should be five because if someone gets a hold of a bank statement, they'll truncate it to the last four. So, ask them for the last five. And that confirms if they don't know that, then that means that they are not the right person. And so, they can't just say yes. You have to make sure that you are speaking with the person, the point of contact at the vendor's business that can validate that bank change. And so, that would have saved it. 

It also makes it so that if someone else is doing that confirmation call and they happen to use the information that is on the email, then that still would not be a valid confirmation because we hope that the fraudsters would not have that existing banking information. And so, it's just another thing to put in place to try to identify whether you are contacting the right person and making a valid confirmation call.

00:18:08

Grace Berube: Right. No, that's really great advice. I feel like a script is a really, it's a good place to start for sure. So, talk to me a little bit about the second one here.

Debra Richardson: All right. So, the second one, now this was one that was manufacturing, it’s SAP, and they had 16,000 vendors. And this one truly was an attempted one because they did not end up sending it; they found it. Yes. But this one was one that it's something that I think is a good lesson about internal team members.

00:18:54

Because we always think getting the information, a vendor’s documents, the vendor’s inquiries, requests, whatever, from the internal team member means that they are dealing with the vendor because they have a relationship with the vendor. So, the assumption is if it comes from the internal team member, then it should be valid. But that's not the case here.

So, what happened is the fraudster initiated a conversation with their internal team member on WhatsApp and they pretended to be the CEO. And so, what's that? Cognitive behavior or cognitive bias that the fraudsters use by impersonating the CEO, and everybody wants to please the CEO. And so, the internal team member immediately forwarded that request over to the accounts payable team.

00:19:54

And when the accounts payable team or the vendor team found it, they looked at it and they immediately understood that it was a red flag anyway because you shouldn't have a process in place where the CEO can just require something and it go through. All your requests should go through your normal processes. It should not come from the CEO. That way, if you do get a request from the CEO, that in itself is the red flag. And that's what happened here.

Grace Berube: Okay, that makes sense.

Debra Richardson: Yeah, that's what happened here. And what I like about this is that right after this happened—I mean, everybody gets cybersecurity awareness training, but this team had additional training to avoid fraud, which is great. And after this event, then everybody got that additional training so that they know that that in itself, at least in this instance, that that would have been the fraud, the red flag.

00:21:03

And even if they forwarded it to the AP team or the vendor team, then they would have had that caution because it was the CEO requesting payment. So, that's the red flag. 

Grace Berube: Oh yeah, that is definitely a big red flag.

Debra Richardson: Yeah. So, I did like that. I don't know if their internal employees liked that because they all got assigned additional training, but it's good for the organization.

Grace Berube: Absolutely. Yeah. Always, definitely need additional training there.

Debra Richardson: So, we talked about the confirmation call not being done, but not being valid. I have run into teams that have said, you know what? We just stopped doing the confirmation call altogether. And this one is a great example of why you should still do the confirmation call.

00:21:58

I get why they say that, Grace, because it could be hard to reach these vendors. Sometimes you don't have information. Sometimes you have the information, the telephone number, and you just have to keep calling and calling. They don't pick up the first time. They don't pick up the second time. So, I get that. But this one is a great example of why it should be done. 

And so this one, there was a fraud amount of $100,000. They had almost 3,000 vendors. And what happened was the vendor sent an email requesting, again, typical EFT banking information or their banking information to be updated. And this team did have a valid number on the vendor record. And so when they called, the vendor confirmed that no, we did not send a request to change banking.

00:22:59 

And so, I know that the confirmation calls, they’re manual. They can be a little frustrating because you have to keep calling back sometimes. But this is a great example of why it should still be a part of your fraud prevention steps. It shouldn't be the only part because we saw what happened in the last one. But it should definitely still be a step in your process because that is how they were able to avoid a $100,000 fraud.

Grace Berube: Wow. And I feel like yeah, like you said, some people just might think to skip that step because there could be additional issues with it. But that's very—$100,000 is a lot.

Debra Richardson: All right, Grace. So, I think I said we had three, but you know what? I actually have four. And I do want to talk about this fourth one because I think that it's good to hear for anyone that has a vendor self-registration portal or are thinking about getting a vendor self-registration portal.

00:23:59

Grace Berube: Okay, gotcha. Let's talk about it.

Debra Richardson: One more. And let me just say that vendor self-registration portals, they can be great. They can consolidate your vendor onboarding process. When I was a practitioner, we had multiple ERPs and we have multiple ways of collecting data because of that. That vendor self-registration portal, when we implemented it, it unified how we collected it. So, it was great. They can also automate your validations. And so, they can be great. But this one, I think, is a great example of why you still need to treat them as just one more delivery method for your vendor documentation.

00:24:53  

And so, this one was higher ed. They had about 6,000 vendors and the fraud amount was $600,000. And so, what happened was they received an email from a construction company telling them that the prior person with access left the organization and they needed access. And let me just say that can totally happen with the vendor self-registration portal because typically, you'll get an invite or a invite will be sent to a specific person at the vendor's place of business. And then, that person will come in and register. 

Now, while ideally there'll be multiple people that are registered and that can maintain the vendor master file or their registration in that portal, that's not always the case. People leave; they may leave the company or go to a different department. And so, you really need to have a process around that.

00:26:01 

And so, that's what happened with this company. And so, the team that manages granting access noted that, you know what? No one from their organization, the vendor’s organization, had access. And so, they just sent them a link and granted them access. 

And so, that can happen. And so, they probably needed some controls around how they give access to vendors, especially established registrations. And so, that didn’t happen. But it could also happen if, like I said before, the vendor's information is compromised, their credentials are compromised. That can be from a phishing attempt or it could be, in this day and age, after all the breaches that are out there, they could just go buy them on the dark web.

00:27:02   

And unfortunately, a lot of vendors, a lot of people in general will reuse their username and passwords. And so, it could happen that way as well. 

And so, what ended up happening is that the fraudster then got access. They updated the banking information. And in this case, they did use a validation to validate the banking information and it gave them a warning that it couldn't match the name to the bank account. But they had taken a stance that if the supplier updated their profile, the registration themselves in the supplier portal, that even though the name couldn't be validated, that they would allow it.

00:27:55  

And so, they didn't allow for the fact that a fraudster could get access to either the vendor's credentials or be sent a link, convince the team members to send a link so that they could get access. They didn't allow for the fact that fraudsters can get access to supplier portals or vendor portals. And that was the mistake.

Grace Berube: Okay. Okay, that makes sense.

Debra Richardson: Yeah. And so, my thought process on that is to treat vendor self-registration portals as just one more delivery method or your vendor documentation, whatever controls you have in place. Let's say if you're getting it from risky emails, keep those same controls in place. And as you can see, had that been done, because they did get a red flag from the bank account ownership validation and had they heeded that, they would have avoided that $600,000 loss.

00:29:03

Grace Berube: Right. No, absolutely.

Debra Richardson: Yeah. And so, they ended up sending that. And so, the fraudsters were successful.

And so again, I don't think I talk about it enough. I haven't seen it out there enough. The vendor self-registration portals, they can be great. They're all different. So, make sure you know what type of security they have in place, especially at the sign-in or log-in, during that process. Do they ask for multi-factor authentication all the time? Or maybe even if they notice they are trying to log in for a different location, look at those types of things. But then also, even once the record or registration is updated, keep your same controls in place.

00:30:00

Now, whether the vendor self-registration port or supplier portal will do some of those validations you have in place as internal controls, that would be fine too. Just make sure you keep those in place. And don't just assume that because the information was updated in the portal by who you thought was the vendor, that it was valid.

Grace Berube: Got it. Yeah, that's great advice for all of these really. So, talk to me a little bit now about what you learned. And as we go forward with hosting this session and talking more about fraud cases, what you learned from the audience and what we can all learn from cases when we crowd-share like this.

Debra Richardson: The first thing that I think I learned is to make sure that when we ask the questions and the [unintelligible], we get a little more specific so that we can get the answers that will help to build the fraud cases, maybe make that fraud story required. Because like I said, two of them left the fraud story out.

00:31:07  

Grace Berube: Yeah, that's important.

Debra Richardson: Yeah, they left the fraud story out. But one thing, too, that I learned that was actually surprising to me, Grace, is that many of the folks still really trusted who they thought was the vendor. So, we just talked about the vendor, or really the fraudster pretended to be the vendor, coming in through the vendor portal. And so, the first instinct was to trust the vendor. And I think that's just gone because you don't know who the vendor is. Are they the vendor or are they the fraudster?

00:31:53 

And so, I was actually surprised that—and we as humans, our first instinct is to trust everyone. And so, give them the benefit of—I won't say everyone—but give most people the benefit of the doubt. And I think this function is just at least one area where you just cannot do that.

Grace Berube: Totally.

Debra Richardson: Yeah, you just cannot do that. The other thing I learned about this one, it was really great, is that when it comes to reviewing real incidents from the folks that are attending the session, they will stay. Because I think this one was the last session on the last day, and it was a long one. It was like 90 minutes. They came and they stayed. I think this was really interesting. And I do hope that we do it again in the fall because the attendees were very engaged.

00:33:01

Like I said, they stayed and it was the last session on the last day. And so, I think it really went over well. And I do hope we do it for the Fall conference. And we'll make some tweaks to the survey and we'll hopefully do it again.

Grace Berube: Yeah, we will. I love sessions like this. It just gets people talking. And also, obviously, is a great learning example. But also helps people feel less alone when maybe they haven't had the same type of fraud, but they might be doing the same sorts of things. So, lets people check their processes, make sure that these things hopefully don't happen to them in the future. And I just think it's really great and interactive. So, I'm happy we did it. And yeah, we'll make some tweaks and we'll have it ready for Fall, and November for Austin, for sure.

Debra Richardson: Yeah. Oh, and one other thing. So, there was one share that I think everybody took away.

00:33:58 

So, remember the case where I said that they did send a fraudulent payment, but then they got it back the next day? That was because they made another confirmation call. But because the vendor's payment remittance details had recently changed the first payment after that, they had a policy that they would make a call when the vendor should have received the payment, they would make a call to make sure they received it. And they did that and the vendor had not received it. And so, that was how they were able to find out before waiting for the vendor to discover, which could have been days or weeks or months later. They made the call the next day to verify they received it. They don't do it with all of them, but just the ones that have had a recent remittance change. 

00:34:57  

And I think that is a great process that everyone should do. Definitely everyone else in the room was like oh, okay. And I know I've said it before, but you don't always get it until it happens to someone else and they are able to benefit from it. So, that was great. 

Grace Berube: Yeah. No, that's really great. Great to know.. Amazing. Well, any last thoughts before we close out for today?

Debra Richardson: So, I think we can all learn from at least the four we shared here, and make sure that you create scripts for your confirmation calls to make sure you're talking to the right person, that they are valid. Make sure that you do do that confirmation call. I know it can be hard. I know it's very manual, but make sure it's at least one step in your fraud prevention program.

00:35:51 

And then also, trust but verify. So, whatever delivery method you have for collecting vendor documents, whether it's risky email or a vendor self-registration portal, make sure that you keep your controls in place so that you can avoid fraud. 

Grace Berube: Absolutely. Well, always so great to have you on the podcast, Debra. Thank you so much. And we'll be chatting, I'm sure, very soon. So, thank you so much for sharing today.

Debra Richardson:   All right, Grace. Happy to be here.

[music playing]

Grace Berube: That's a wrap for this episode of the IOFM podcast. Thank you so much for tuning in. If you enjoyed today's conversation, do us a favor and subscribe, or follow the show so you never miss an episode. And to stay up to date on everything happening in our world, including upcoming events, head on over to IOFM.com.

Continuing Education Credits available:

Receive 1 CEU per hour of listening time towards IOFM programs:

Receive 1 CEU per hour of listening time towards maintaining any AP and P2P related program through IOFM! These programs are designed to establish standards for the profession and recognize accounts payable and procure-to-pay professionals who, by possessing related work experience and passing a comprehensive exam, have met stringent requirements for mastering the financial operations body of knowledge.

Continuing Education Credits available:

Receive 1 CEU per hour of listening time towards IOFM programs:

Receive 1 CEU per hour of listening time towards maintaining any AP and P2P related program through IOFM! These programs are designed to establish standards for the profession and recognize accounts payable and procure-to-pay professionals who, by possessing related work experience and passing a comprehensive exam, have met stringent requirements for mastering the financial operations body of knowledge.