Paying Vendors and Contractors: The Payables Side Nobody Optimizes

Businesses spend enormous effort on getting paid — processing rates, dunning sequences, collections. The money going out gets a checkbook and whoever has time. Which is backwards in one important respect: payables is where the fraud is. A fraudster who compromises your receivables steals from a customer; one who compromises your payables gets you to send money yourself, willingly, to an account you believed was your supplier's. Those payments are authorized, which makes them extremely hard to recover. This guide covers rail selection, the controls that actually stop invoice fraud, collecting tax information before it becomes a January emergency, and using payment timing without damaging the supplier relationships you depend on.

Choosing the rail

Rail	Cost	Speed	Reversibility	Best for
ACH credit	Low flat fee	1–2 business days	Limited	Most recurring domestic payments — see our bank payments guide
Wire	High	Same day	Effectively none	Large, urgent, verified counterparties
Instant payment rails	Moderate	Seconds, final	None	Urgent payouts where finality is acceptable — per our real-time analysis
Virtual card	Vendor bears acceptance cost; may earn rebate	Immediate authorization	Dispute rights available	Vendors who accept cards, one-off purchases
Check	Materially higher than it appears	Days to weeks	Stop payment possible before presentment	Vendors who accept nothing else

Two decision rules worth internalizing.

Reversibility should track verification confidence. A wire or instant payment to a counterparty whose details you've verified out of band is fine. The same payment to a new vendor whose banking details arrived by email is the highest-risk transaction your business can execute, because speed and finality are exactly wrong when the recipient may be wrong.

Virtual cards are underused. A single-use card number issued per payment or per vendor, with a fixed limit and expiry, is both a control and a rebate opportunity — the vendor bears acceptance cost, which some will decline, but for those who accept it's among the safest instruments available since a compromised number is useless beyond its limit.

Why checks persist and what they cost

Checks remain common in business payables despite being the most exposed instrument, and understanding why explains the persistence.

Why they persist: some vendors accept nothing else, there's no per-payment fee visible on a statement, the float is familiar, and the process is entrenched — nobody has to be onboarded to anything.

What they actually cost:

• Materials and postage, which are small per check and real in aggregate.
• Labor — printing, signing, stuffing, mailing, and reconciling, which is the dominant cost and is invisible because it's someone's salary.
• Reconciliation burden, since checks clear unpredictably and outstanding items accumulate.
• Fraud exposure, which is the substantial one.

The fraud problem is structural: a check displays your account and routing numbers to everyone who handles it. It passes through mail, a vendor's office, and a bank. Check fraud including alteration, counterfeiting, and mail theft remains a persistent and growing problem — the dynamics our check fraud analysis documents.

If you must issue checks: use positive pay, which lets your bank match presented checks against a file you supply and flag mismatches. It's the single most effective check control available and it's frequently offered without anyone mentioning it. Also consider a dedicated disbursement account holding only what's needed, so a compromised check number doesn't reach your operating balance.

The payables fraud problem

The dominant attack against business payables works by manipulating where a legitimate payment goes rather than by creating an illegitimate one.

The typical pattern:

1. An attacker compromises or spoofs an email account — a vendor's, or someone inside your business.
2. A message arrives referencing a real relationship and frequently a real invoice.
3. It requests that banking details be updated, or that an urgent payment be made.
4. Time pressure is applied — a deadline, an executive traveling, a supply consequence.
5. Your business pays, correctly following its own process, to an account the attacker controls.

Why this is so hard to recover from: you authorized it. The payment wasn't fraudulent in execution — it was fraudulent in inducement, which is the distinction our authorized push payment analysis examines. Recovery depends on speed and on the receiving institution, and frequently fails.

The variants to know:

• Vendor impersonation, as above — the most common.
• Executive impersonation, where a message appearing to come from an owner or officer directs an urgent payment and discourages verification.
• Fictitious vendors, created internally, receiving payments for nothing.
• Duplicate invoices, submitted twice and paid twice, which is frequently error rather than fraud and equally costly.
• Inflated invoices from a real vendor, with the excess shared internally.
• Compromised vendor portals, where the details are changed at the source.

Controls that work

These are inexpensive, and each one defeats a specific attack:

1. Out-of-band verification of any banking change. The single most important control. Call a number you already had on file — not one in the request — and speak to a person you can identify. Treat every change request as suspect regardless of how legitimate it looks, because looking legitimate is the entire technique.
2. Separation of approval and payment. The person who approves an invoice should not be the person who releases funds. This defeats fictitious vendors and internal manipulation, and it applies at any size — in a small business the owner should be one of the two.
3. Dual authorization above a threshold, set low enough to matter.
4. Three-way matching — purchase order, receipt of goods or services, and invoice must agree before payment. This defeats duplicate and fictitious invoices, and it's the discipline our vendor onboarding guide describes from the supplier's perspective.
5. Vendor master file controls. Adding or changing a vendor should require approval separate from whoever requested it, with a record of who changed what and when.
6. Duplicate detection on invoice numbers and amounts.
7. Positive pay for checks and ACH debit filters on your account.
8. Periodic vendor file review, looking for vendors with no recent activity, addresses matching employee addresses, or missing tax information.
9. An explicit policy that urgency never bypasses verification, communicated to staff — because the attack works by making the person who follows procedure feel obstructive.

That last point is worth dwelling on. Every one of these attacks includes pressure designed to make verification feel like an insult or an obstruction. Staff need explicit authority to verify regardless of who is asking and how urgent it sounds, and that authority has to come from the top or it won't be used.

Vendor onboarding and tax information

The rule that prevents the most administrative pain: collect everything before the first payment.

Why timing matters so much: a vendor waiting to be paid supplies information immediately. The same vendor, already paid, has no incentive to respond — and chasing tax identification numbers in January from contractors you paid in March is a well-known and entirely avoidable operational failure.

What to collect and verify upfront:

• Legal name and taxpayer identification, on the appropriate form, matching exactly.
• Validate the identification number at collection rather than discovering a mismatch at filing.
• Banking details, verified independently and ideally through an account verification method rather than a document.
• Remittance contact and address.
• Business entity type, which affects reporting.
• Insurance certificates where relevant to the work.
• Agreed terms — payment timing, any early payment discount, and what the invoice must reference.
• Whether they accept cards, which determines virtual card eligibility.

On backup withholding: where required tax information is missing or fails validation, you may be obligated to withhold a portion of the payment. That's a genuinely unpleasant conversation with a vendor and an administrative burden for you — and it's entirely prevented by collecting properly upfront.

Paying contractors specifically

Contractor payments carry obligations beyond ordinary vendor payments, and the classification question sits underneath all of them.

Before the relationship starts: confirm the classification is defensible. Paying someone as a contractor who should be an employee creates the stacked exposure our classification analysis describes — retroactive employment taxes, back wages, workers compensation exposure, and state penalties, applied regardless of intent or the worker's agreement.

Operationally:

• Collect tax information before the first payment, as above.
• Track payments by calendar year against reporting thresholds, cumulatively — a contractor paid across several small engagements can cross a threshold nobody was watching.
• Pay from the business account, never personally, so the record is clean.
• Keep the paperwork — the agreement, invoices, and deliverable records, which matter both for tax purposes and for defending the classification.
• Pay on agreed terms. Contractors are frequently small operations for whom your payment timing is their cash flow, and a business that pays reliably gets better people.
• Use a rail that suits them. ACH is generally best; a check to an individual contractor is slow and creates the same fraud exposure as any other check.
• Never pay in unrecorded cash, which creates the exposure our cash business guide covers.

International payments

Cross-border vendor payments carry costs that are frequently invisible because they're embedded rather than charged.

What to understand:

• The exchange rate margin is usually the largest cost, and it doesn't appear as a fee. A wire quoted with a modest fee can carry a much larger spread built into the rate — the transparency problem our cross-border guide describes.
• Ask for the rate and the fee separately, and compare the total cost against alternatives rather than comparing fees.
• Intermediary bank fees can be deducted in transit, meaning your vendor receives less than you sent — which produces a short payment they'll chase you about.
• Specify who bears charges, since the convention determines whether deductions come out of the vendor's amount.
• Sanctions screening applies, and your provider will do it, but you should know your counterparties.
• Withholding obligations may apply to payments to foreign persons, with documentation requirements that differ from domestic reporting. This is a genuine compliance area worth advice rather than assumption.
• Local rails are frequently cheaper than wires for recurring payments to the same country.

Payment timing as working capital

Payables timing is a legitimate working capital lever and a relationship risk, and the distinction between using it well and badly is whether it was agreed.

Legitimate:

• Negotiating longer terms in advance, which extends your cycle at no cost — the approach in our supplier terms guide.
• Paying on the due date rather than early, where no discount applies.
• Consolidating payment runs to reduce processing cost.
• Taking early payment discounts, which are worth far more than the float — a 2% discount for paying twenty days early annualizes to roughly 36%, which almost nothing beats.

Costly:

• Paying past agreed terms, which triggers late fees and interest you contractually accepted, damages the relationship, and gets reported by suppliers who furnish to commercial bureaus.
• Stretching without communicating, which converts a manageable conversation into a collections matter.
• Prioritizing by who complains loudest, which is how businesses end up paying trade creditors ahead of tax obligations — the priority error our wind-down guide identifies as the one that creates personal liability.

The point that connects both lists: your payment behavior is data about you. Suppliers report it, and it shapes what terms you're offered next — by them and by others checking your commercial file. A business that pays reliably accumulates an asset; one that stretches quietly accumulates a record.

What to measure

• Days payable outstanding, and whether it reflects negotiated terms or silent stretching.
• On-time payment rate against agreed terms, which is the number your suppliers experience.
• Early payment discounts captured versus available — money left on the table here is usually substantial and entirely visible.
• Cost per payment by rail, including the labor that checks consume.
• Payment mix, tracking migration away from checks.
• Duplicate payments detected and recovered.
• Vendor master changes, reviewed periodically as a control rather than as a report.
• Attempted fraud incidents, including ones caught — which is the metric that tells you whether the controls are being exercised.

The one most businesses don't have and should: discounts available but not taken. It's a direct measure of margin being forgone for float that's worth a fraction of it.

Frequently asked questions

---

This guide is educational and does not constitute legal, tax, or compliance advice. Information reporting thresholds, backup withholding rules, and obligations relating to payments to foreign persons are governed by tax law and change; consult a qualified tax professional about your obligations.