01 the business
Industrial components manufacturer
130 staff, 300 active suppliers
New suppliers are set up by email, with forms and certificates chased by hand. Register checks are skipped when someone is in a hurry. An email asking to change bank details is the most dangerous message the accounts team receives.
02 before
The problem
Setting up a new supplier means chasing forms, insurance certificates and bank details over email. Checks against company registers are skipped when someone is in a hurry. Changed bank details arriving by email are a common route for invoice fraud.
- Supplier setup takes days of chasing.
- Register checks are inconsistent.
- Bank detail changes are sometimes made from an email alone.
03 the build
What the AI does
- Step 1: Sends the new supplier a form that asks for company details, tax ID, insurance and bank details.
- Step 2: Checks the company and tax numbers against public registers such as Companies House or ABN Lookup.
- Step 3: Reads insurance and certification documents and records expiry dates.
- Step 4: Flags mismatches, such as a bank account name that does not match the company name.
- Step 5: Creates the supplier in Xero, QuickBooks or NetSuite once approved and stores the documents.
- Step 6: Treats any later bank detail change as a new check and asks for call-back confirmation.
paused: waiting for a person to approve
How it was put together
- Sent new suppliers a form for company, tax, insurance and bank details.
- Checked company and tax numbers against public registers.
- Recorded insurance and certificate expiry dates.
- Flagged mismatches such as an account name that differs from the company name, and treated every later bank change as a new check.
04 human in the loop
Where a person stays in charge
A finance team member approves each new supplier and every bank detail change, after a call-back on a known phone number.
- A finance team member approves each new supplier.
- Every bank detail change needs a call-back on a phone number already on file, never one from the email.
- Changes are logged with who checked and when.
05 rollout
From kickoff to live in 4 weeks
- Weeks 1–2Design the form and checks; agree the call-back procedure.
- Week 3Use for all new suppliers.
- Week 4Re-check existing suppliers' bank details and expiring certificates.
06 after
What changes
Supplier records are complete from day one and expiring documents are chased before they lapse. Bank detail changes always get a second look.
Assume one fraudulent bank change request succeeds against an invoice of $85,000.
The loss is the full $85,000, often unrecoverable. A call-back costs a few minutes per change.
What to measure
- Days to set up a new supplier.
- Bank changes verified by call-back.
- Expired insurance or certificates found.
- Suspicious change requests stopped.
07 evidence
What the research says
Business email compromise caused reported losses of about $2.77 billion across 21,442 complaints in 2024, out of $16.6 billion in total reported cybercrime losses.
FBI Internet Crime Complaint Center, 2024 Internet Crime Report (opens in a new tab) · 2025
Third-party involvement in breaches doubled to 30%.
Verizon, 2025 Data Breach Investigations Report (opens in a new tab) · 2025
In 1,921 fraud cases, expense reimbursement schemes made up 13% of cases with a median loss of $50,000, and frauds at organisations with under 100 staff had a median loss of $141,000.
08 lessons
Mistakes to avoid
- Calling the number in the email. Always use a known number.
- Checking once. Bank changes need the same scrutiny as new suppliers.
- Letting urgency override the process. Fraudsters create urgency on purpose.
09 questions
Common questions
- How big is this risk?
- The FBI's 2024 report recorded about $2.77 billion of losses from business email compromise across 21,442 complaints in the US alone.
- Which registers can it check?
- Companies House in the UK, ABN Lookup in Australia and other public registers with an online lookup.