Jason Kurtz, CEO, Basware.
It’s the moment every CFO lives for: the invoice matches the purchase order with a clean approval chain and complete audit trail and the team closes the ticket and moves on.
Then, three weeks later, the supplier asks why payment wasn’t received.
I’ve seen this happen at more companies than I can count, and here’s what I’ve learned: Getting the money to the right place is hard.
Most organizations today can tell you whether an invoice is legitimate. But most accounts payable teams still struggle to know whether payments are headed to the bank account of the supplier they think it belongs to.
The Blind Spot Nobody Budgeted For
According to October 2025 research from TransUnion, organizations globally lost an estimated 7.7% of annual revenue to fraud over the past year, costing the 1,200 business leaders surveyed an estimated $534 billion.
Generative AI is exacerbating the issue. The Association of Certified Fraud Examiners reports that three out of four anti-fraud professionals have seen a rise in AI-generated document fraud over the past two years. And only 7% say they’re more than moderately prepared to detect or prevent AI-fueled fraud.
Meanwhile, payments move faster than ever. Instant payments mean instant finality—there’s often no window to claw money back once it’s released.
Put these trends together and you arrive at an uncomfortable truth: Finance can do everything right on the invoice and still send the money to the wrong bank account.
Why “Correct” And “Safe” Are Two Different Problems
The reason this gap persists is that most organizations still treat invoice accuracy and payment security as the same problem that can be solved by the same controls. They aren’t, and they can’t be.
A fraudster doesn’t need to touch the invoice or the approval process at all. They only impersonate a supplier, change the bank details and let a perfectly legitimate, fully-approved invoice carry the money straight to the wrong account.
It’s the last mile on the invoice journey that determines whether all the careful work upstream actually delivers the intended outcome.
Closing the Last Mile Starts with Three Questions
I lead a company that operates in this space, helping organizations manage the invoice lifecycle and strengthen controls around supplier and payment data. That gives me a particular perspective on this problem and how it can be solved.
This isn’t about any one technology or provider. It’s about whether finance has the controls, data and accountability to validate where money is going before it leaves the organization.
Here are three questions finance leaders need to ask to figure this out:
• When was the last time we validated this supplier’s bank account details? According to the Association for Financial Professionals, business email compromise was the main vector of fraud, impacting 74% of businesses (download required) in 2025, with vendor impersonation as the most common tactic. A supplier’s banking details can be legitimate at onboarding and still be wrong—or altered—by the time a payment actually goes out. That’s why this can’t be a question with a one-time answer. It needs to be asked every time money is about to move.
• If a payment went to the wrong account tomorrow, could we show why we trusted it? Most organizations have a defensible record of who approved an invoice and why. Very few have an equally defensible record of why a payment was trusted to go where it went. A CFO should expect both records to exist, and to exist together.
• Where has automation been given a blank check, and where is a human still required to sign off? As AI takes on more of the invoice-to-payment process, finance leaders need to define which decisions can be automated based on established controls and evidence, and which require human review or an additional verification step. The goal isn’t to put a person in the middle of every payment. It’s to make sure automation has clear boundaries.
The answers to these questions will vary, as will the actions taken to address them.
One approach is to build stronger controls across the invoice lifecycle, using bank-account verification, approval workflows and segregation of duties to create additional checks before payment.
Another is to use specialized third-party services to independently validate supplier banking information or monitor changes.
A third combines these approaches, using automation for routine checks and routing higher-risk exceptions to a person.
Each approach comes with trade-offs. Internal controls can give finance teams greater ownership, but they can also be difficult to maintain as suppliers, payment methods and fraud patterns change. External verification services can add independent data and expertise, but they introduce another provider, integration and potentially another workflow for AP teams to manage.
The important question isn’t simply whether a control exists, but whether it has the right data, happens at the right point in the process and produces evidence that finance can stand behind.
The technology used to create these controls can vary. It might sit within accounts payable (AP), procurement platforms, ERPs and treasury management systems that finance uses to manage the invoice lifecycle. It might come from a specialized verification provider. And it might combine data and controls across multiple systems. What matters is that the check happens as part of the payment process rather than becoming another manual task for AP to remember.
Get this right, and you’re doing more than protecting against fraud. You’re closing the gap between an invoice being correct and a payment being correct so that finance can demonstrate not only that the invoice was approved, but that the money ultimately went where it was supposed to go.
The Real Finish Line
None of this requires reinventing how finance works, but it does demand a shift in mindset. Invoice approval can’t be seen as the finish line anymore. It’s the midpoint.
Organizations that view it this way will be better able to say, without hesitation, that both the invoice and payment were correct, and the money got where it was supposed to go.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
