CTP (AFP): Ridgeline Foods: A $480,000 Bank-Detail Change and a Check-Heavy Payables File

Arithmetic: checks = 62% x 6,200 = 3,844/month. Savings = 3,844 x ($3.50 - $0.35) = $12,109/month, or ~$145k/year if every check converts. A realistic 80% conversion of eligible payees yields ~$116k/year - still enough to justify a program, but not enough to justify a bad conversion.

Prerequisites, in order:

1. Vendor bank-account validation (bank-provided or third-party) before any new ACH setup - this is the control that the fraud attempt exposed.
2. Vendor master change control: dual approval, segregation between master-data maintenance and payment release, and a change log.
3. Positive pay / payee match with the disbursement bank, including ACH positive pay (filter and authorization rules).
4. Remittance delivery: email remittance advice or a supplier portal, since 18% of suppliers cite this as the blocker. Build it before the campaign, not after.
5. Return handling: processes for NOCs, R-codes, and reinitiation, plus ownership of the ACH return rate as a KPI.
6. Cutoff and settlement timing documented so suppliers do not perceive a value-date loss.

Judgement calls: do not force ACH on suppliers who genuinely need a check (some small vendors bank at institutions with poor ACH remittance handling) - pay those by virtual card where they accept it and capture the rebate. Segment the 1,400 suppliers by payment volume and dollars: 80% of dollars likely sit in 100 suppliers, and converting those captures most of the value with least effort. Also set an explicit date after which new suppliers must be onboarded electronically.

What stops it: a callback to a telephone number already on file in the vendor master - never a number from the request - performed by someone independent of the AP clerk and independent of vendor master maintenance. That single control would have prevented the $480k loss at a cost of a few minutes per change.

Supporting controls that add real defense in depth:

• Bank-account validation/name matching (e.g., account-name verification service) before activation.
• Dual approval on all bank-detail changes, with a mandatory hold period (e.g., 24-48 hours) before the first payment to a new account.
• Segregation: the person who can change the vendor master cannot release payments.
• Positive pay with payee match, so a fraudulent payee is rejected at the bank rather than found in reconciliation.
• Email authentication (DMARC/SPF/DKIM) and a rule that bank-detail changes are never actioned from email alone.
• Exception reporting on new payees, changed payees, and payments above a threshold.

What is theatre: emailing the same address to "confirm," relying on caller ID, training slides with no enforced process, and a policy document nobody tests. Also theatre: assuming the ERP's segregation-of-duties settings are correct without testing them.

Incident handling: notify the bank immediately for a recall or indemnity request, preserve email headers, file a police/IC3 report, and notify other suppliers who might be targeted. Then test the callback control by running a live sample of 20 recent changes and reporting the failure rate to the audit committee.

What is wrong:

• Cost: 5% of 6,200 = 310 payments/month at $22 plus correspondent bank charges and lift fees; more importantly, the beneficiary's bank deducts charges, so the supplier receives less than invoiced and raises a short-payment dispute.
• FX spread: converting USD to five currencies through wires embeds a retail spread that is typically wider than a negotiated FX rate.
• Value dating: wires cut off early, may settle T+1 or T+2, and create uncertainty about the exact debit date for forecasting.
• Compliance: sanctions and screening obligations differ by corridor; wires to some jurisdictions need additional screening and can be returned.
• Reconciliation: no structured remittance standard means the supplier cannot match the payment.

What to do instead, by corridor:

• Use local payment rails (SEPA credit transfer, UK Faster Payments, local ACH equivalents) for the Eurozone and UK, paying from local currency accounts - cheaper, faster, and with structured remittance.
• Consider FX netting among entities to reduce gross conversions, and a bulk FX order to get interbank pricing instead of per-payment retail rates.
• Use ISO 20022 structured remittance data so suppliers can auto-reconcile.
• For low-value, high-frequency international payments, evaluate virtual cards where the supplier accepts them.
• Keep wires for high-value, time-critical, or one-off payments where finality matters.

Judgement: the decision is corridor-by-corridor, not a single global rule. Build a payment-routing matrix (currency x corridor x amount x urgency x counterparty type) and revisit it when the bank's local capabilities change.