Before You Pay That Supplier: How Nigerian SMEs Can Avoid Vendor Payment Scams

Short answer: Fake invoices, changed bank details and cloned emails put SMEs at risk. Learn seven practical checks to prevent vendor payment scams in Nigeria.

Important: This article is for general educational purposes only and does not constitute legal, financial or cybersecurity advice. Verification tools and payment controls reduce risk but cannot eliminate fraud or guarantee recovery of funds. Confirm suspicious transactions with your bank and report suspected fraud through official channels.

It usually starts with a message that looks completely normal.

Your diesel supplier sends the monthly invoice, just as they always do. A day later, a follow-up email arrives.

"Kindly note that we have changed our bank account. Please use the new details below for this and all future payments."

The message sounds professional. The signature looks familiar. The invoice amount matches what you owe.

Someone on your team makes the transfer.

A week later, your actual supplier calls to ask when you intend to settle the invoice.

The money has gone to someone else.

This kind of scam does not require a business owner to be careless or a finance team to be inexperienced. Sometimes, the person sending the message has gained access to a genuine supplier's email account. In other cases, the scammer has created an address that looks almost identical to the real one.

All it takes is one payment made without an independent check.

The good news is that a few straightforward habits can make these scams much harder to pull off. You do not need a large finance department or an expensive security system to start protecting your business.

Here are the payment scams Nigerian SMEs should know about, seven checks to introduce before your next supplier payment, and the steps to take if money has already gone out.

The Vendor Payment Scams Every Business Owner Should Know

1. The "We Have Changed Our Bank Account" Scam

This is one of the most important warnings for any business that regularly pays suppliers.

You have an established relationship with a supplier. You know their name, their invoice format and roughly how much you pay them each month.

Then you receive a message with new bank details.

The explanation may sound reasonable. Perhaps the supplier has changed banks, opened a new account or experienced a problem with the old one.

The danger is that the message may come from a compromised email account belonging to the real supplier. Alternatively, it may come from a lookalike address with one or two characters changed.

If your team updates the supplier's bank details and makes the payment without checking independently, the money could end up in the scammer's account.

The FBI's Internet Crime Complaint Center describes this type of fraud as business email compromise, or BEC. Its guidance explains how criminals use compromised or impersonated business email accounts to trick organisations into sending money to unauthorised recipients.

The rule: Never change a supplier's bank details based on an email or WhatsApp message alone.

2. Fake, Duplicated or Inflated Invoices

Not every fraudulent invoice involves a sophisticated cyberattack.

Sometimes, the invoice itself is the problem.

A business might receive an invoice for goods that were never delivered, a duplicate invoice for work already paid for, or a bill with quantities and prices that do not match the original agreement.

Another possibility is a supplier that appears legitimate on paper but cannot demonstrate that it can actually deliver what it promises.

These problems can occur inside established business relationships as well as during purchases from unfamiliar suppliers.

For example, a Lagos fraud case reported by Independent Newspaper Nigeria involved allegations concerning company funds and documents that an EFCC witness said included fake invoices and corporate filings associated with non-existent companies.

The details of any individual case must be treated according to its legal status. The practical lesson for business owners is straightforward: an invoice is a request for payment, not proof that the goods or services were supplied.

The rule: Match every invoice to what was ordered and what was actually delivered.

3. The Impersonated or Too-Good-to-Be-True Supplier

Imagine that your shop urgently needs stock, or your construction project cannot continue without another diesel delivery.

A supplier contacts you through WhatsApp or social media with an attractive price. They promise fast delivery and ask for full payment upfront.

The offer looks like an opportunity to save money.

But you have never dealt with this supplier before, and you have not independently confirmed their identity, stock or ability to deliver.

In October 2025, the EFCC announced that a man and two companies had been arraigned in Lagos over an alleged ₦1.07 billion fraud connected to claims that they could supply large quantities of diesel. The defendants pleaded not guilty, and the case was before the court at the time of the announcement.

That case is not proof that every upfront payment is fraudulent. It illustrates why large supply promises should be checked before substantial sums are transferred.

The rule: Verify an unfamiliar supplier before making a significant payment, especially when the offer is unusually attractive or the seller demands full payment before delivery.

4. The Hijacked Email Conversation

This can be the hardest scam to detect.

You are already discussing an order with a genuine supplier. The emails are real, the people involved are familiar, and the invoice matches your expectations.

Then a message arrives with updated payment instructions.

Because it appears inside the existing conversation, nobody suspects anything.

In some cases, criminals gain access to business email accounts, monitor genuine conversations and interfere with invoices or payment instructions. The FBI has warned about these methods, and Trend Micro has documented related tactics in reporting on Operation Killer Bee, involving Interpol and the EFCC.

This is why checking only the sender's display name or the appearance of an email is not enough.

The rule: Verify payment changes through a separate, trusted communication channel, even when the request arrives inside a familiar email thread.

Warning Signs to Watch For

Across these scams, certain warning signs appear repeatedly:

• A supplier suddenly changes bank details, especially just before a payment is due.
• Someone insists that a payment must be made urgently or kept secret.
• The beneficiary account name does not match the supplier named on the invoice.
• The sender's email address, phone number or invoice format differs slightly from what you normally receive.
• A new supplier demands full payment before you can inspect the goods or verify delivery.
• An invoice cannot be matched to an order, contract or delivery record.
• Someone claiming to be the MD asks the finance team to skip the usual approval process.

One warning sign does not automatically prove fraud. A legitimate supplier may change banks or have a genuine emergency.

The point is to pause and verify before releasing money.

Seven Checks to Run Before Paying Any Supplier

1. Verify Bank Detail Changes Through a Second Channel

Never accept new bank details through the same channel that delivered the request.

If the change arrives by email, call the supplier. If it arrives on WhatsApp, use a phone number you already have on file.

Use a number from a previous verified invoice, an existing contract or your saved business contacts. Do not rely on the number included in the message requesting the change.

Ask the supplier to confirm the new account details. Ideally, have them read the details to you rather than simply agreeing with numbers you read out.

For a high-value payment, require a second person to review and approve the change before updating your records.

This is particularly important when the supplier says the change must happen immediately.

A few minutes spent confirming the details can save you from a much larger problem.

2. Read the Account Name Before Sending Money

Nigerian banking apps typically display a beneficiary name during the transfer process. This name enquiry helps you check who you are about to pay before completing the transaction.

For example, your invoice might identify the supplier as "Bright Oil and Gas Ltd", but the name displayed by your banking app is an unrelated personal name.

Stop and ask questions before proceeding.

A personal account is not automatically evidence of fraud. Some legitimate businesses may have specific arrangements for receiving payments. However, the discrepancy should be explained and independently verified before you transfer money.

Do not simply assume the account is correct because the account number was sent by someone you know.

For more information, see NIBSS Name Enquiry.

3. Confirm That a New Vendor Is a Real Business

Before paying a new supplier for the first time, check the business details they provide.

Where applicable, search the supplier's business name or registration number through the Corporate Affairs Commission's public search.

Compare the information you find with the details on the quotation, invoice, contract and other business documents.

Look for discrepancies in the registered name, registration details or status.

Remember that company registration does not guarantee that a business is trustworthy. A genuine registered company can still behave dishonestly, and scammers can impersonate legitimate companies.

Treat registration as one verification step, not the final decision.

For additional checks, consider whether you can inspect the supplier's premises, confirm references from existing customers or verify their ability to deliver the goods or services.

The larger the payment, the more verification you should complete before proceeding.

4. Match the Invoice to the Order and Delivery

Before approving an invoice, your team should be able to connect three things:

• The order: What did you agree to buy? This could be a purchase order, quotation, contract or written approval.
• The delivery: Did the goods arrive or was the service completed? Look for a delivery note, waybill, inspection record or confirmation from the person who received the goods.
• The invoice: Does the amount match the agreed price, quantities and terms?

If one of these is missing, pause the payment until the discrepancy is explained.

This simple process can catch duplicate invoices, inflated quantities, incorrect charges and invoices for goods that never arrived.

For recurring services, such as rent, maintenance or subscriptions, use the relevant contract, service records and approval process instead of a delivery note.

The goal is to make sure the business is paying for something it actually ordered and received.

5. Separate Who Adds a Vendor From Who Approves Payment

Even a five-person business can introduce basic payment controls.

The person who adds a new supplier or changes their bank details should not be the only person who approves and releases the payment.

For example, your operations manager might submit a supplier's information. Your accountant checks the invoice and account details. You, as the business owner, approve payments above a limit you have chosen.

You do not need a complicated corporate approval structure to begin.

Write down a simple rule:

• One person submits the supplier details.
• Another person verifies the information.
• An authorised person approves the payment.
• The business keeps a record of the approval.

For very small businesses where only one person handles finance, the owner can introduce an independent check before high-value payments are released.

The objective is to avoid a situation where one person can create a new beneficiary, change their bank details and send money without anyone else reviewing the transaction.

6. Treat Urgency as a Reason to Slow Down

Scammers often try to prevent you from thinking clearly.

They may claim that a supplier will cancel an order, a delivery truck is waiting, a discount expires in an hour or the MD has instructed everyone to pay immediately.

Sometimes the urgency is genuine. Businesses do face deadlines.

But urgency should not automatically remove your normal checks.

Agree on a rule that no payment details can be changed solely on the strength of an email, WhatsApp message or voice note.

If someone claiming to be the MD asks the finance team to bypass the usual process, verify the request directly with the MD.

A legitimate request can survive a short verification call. A fraudulent one may not.

7. Secure the Email Accounts Used for Payments

If your team uses email to receive invoices, approve transactions or communicate with suppliers, protect those accounts.

Start with these measures:

• Enable two-factor authentication on business email accounts.
• Use unique, strong passwords.
• Limit access to business email accounts to the people who need them.
• Check the full sender address when a payment instruction looks unusual.
• Be cautious with unexpected attachments and login links.
• Review email forwarding rules periodically for changes nobody authorised.
• Remove access when employees leave the business or no longer need it.

If a supplier's mailbox has been compromised, even a genuine-looking message can be dangerous. Securing your own accounts reduces your exposure to related attacks.

These steps do not eliminate every risk, but they make it harder for attackers to exploit your team's communications.

What to Do If You Think You Have Paid a Scammer

If money has already left your account, act immediately.

Do not spend the first few hours arguing with the person who sent the payment instructions or waiting for the supplier to respond.

Contact your bank and explain that the transfer may be fraudulent.

Ask whether the bank can initiate a recall, contact the receiving institution or take other available steps to help recover the funds. Recovery is not guaranteed, but a prompt report gives the banks a better opportunity to respond.

Then work through the following steps.

1. Contact your bank immediately. Use your bank's official customer service number or verified support channel. Provide the transfer details and ask for the appropriate fraud response.
2. Contact the real supplier. Use a known phone number, not the contact details in the suspicious message. Explain what happened so they can secure their email account and investigate whether other customers may be affected.
3. Preserve the evidence. Keep the original emails, WhatsApp messages, invoices, beneficiary details, transfer receipts, account numbers and call logs. Do not delete the conversation, even if you are embarrassed about what happened.
4. Report the incident. Report the matter to the EFCC and the police through their official channels. Keep any reference numbers or acknowledgements you receive.
5. Secure any affected accounts. If you suspect that a business email account has been compromised, change its password, sign out of unauthorised sessions, remove suspicious forwarding rules and review account access.
6. Review other pending payments. Check whether the same supplier details appear in other invoices or payment instructions. Pause suspicious payments until they have been verified.

The sooner you respond, the better your chances of limiting further losses. However, never assume that a transfer can definitely be reversed.

Why Traceable, Approved Payments Matter

Many payment problems begin with informal processes.

A supplier sends an account number on WhatsApp. Someone copies it into a banking app. The business owner approves the payment verbally. Finance only reviews the transaction when reconciling the accounts at the end of the month.

This approach makes it difficult to see who added a beneficiary, who checked the details, who approved the payment and why the money was sent.

A more organised payment process gives your business a clearer record of what happened.

Keep a central record of approved suppliers and beneficiaries. Document bank detail changes. Require approval for payments above a chosen limit. Maintain transaction records that can be reviewed during reconciliation.

Payment software can help organise these steps, but it does not replace independent verification. A fraudulent beneficiary can still be added to a system if the business approves the wrong details.

The protection comes from combining reliable records with a clear approval process.

How Staff Pay Helps Businesses Verify Vendors and Manage Payments

At Staff Pay, we believe businesses should not have to manage every payment through scattered messages, spreadsheets and individual banking sessions.

Staff Pay is a payment automation platform for Nigerian businesses. Alongside payroll, it helps businesses organise beneficiaries, verify identities, manage payment approvals and keep transaction records.

Depending on your workflow, Staff Pay can help you:

• Check vendors before paying them: Identity Book supports company and vendor checks using CAC information, alongside available identity and bank account verification checks.
• Keep beneficiary information organised: Maintain records for the people and businesses you pay instead of repeatedly copying details from old messages.
• Separate preparation from approval: Use team roles to delegate payment preparation and approval responsibilities.
• Review changes: Keep control over beneficiary information and review changes before they take effect.
• Maintain transaction records: Review payment history and export records for reconciliation and accounting.

These features support a more controlled payment process. They do not guarantee that every vendor is legitimate or that every transfer can be recovered. Your team still needs to verify information, investigate discrepancies and approve payments carefully.

You can learn more about Staff Pay's verification and Identity Book features or explore the full Staff Pay feature list.

What if you also send invoices to your customers?

Vendor payments are only one side of running a business. You also need to invoice customers accurately and make it easy for them to pay you.

Staff Pay's Free Invoice Generator helps you create professional invoices with your business details, customer information, line items and payment instructions.

It is a document-generation tool. It does not collect or hold your customer's money, and generating an invoice does not mean that the invoice has been paid.

Whether you use Staff Pay or another system, the principle remains the same: verify the recipient, confirm the payment details and keep a clear record.

A Simple Vendor Payment Safety Checklist

Before your next supplier payment, use this checklist with your team.

Before adding a vendor

• Confirm the supplier's identity and business details.
• Check the business registration information where applicable.
• Verify bank account details and investigate name mismatches.
• Keep a record of the checks completed.

Before approving an invoice

• Match the invoice to the purchase order, quotation or contract.
• Confirm that the goods or services were delivered.
• Check for duplicate invoices, unexpected charges or changed payment details.
• Independently verify any new bank account information.

Before releasing the payment

• Confirm that the beneficiary name is correct.
• Ensure the required approval has been obtained.
• Check that the person adding or changing the vendor is not the sole payment approver.
• Keep the approval and transaction records.

If something looks suspicious

• Pause the payment.
• Contact the supplier using a trusted number.
• Report suspicious account activity.
• If money has already been sent, contact your bank immediately.

Frequently Asked Questions

What is vendor payment fraud?

Vendor payment fraud occurs when someone tricks a business into sending money to an unauthorised recipient or paying a fraudulent invoice. Common methods include impersonating suppliers, changing bank details, sending fake invoices and compromising business email accounts.

A supplier says they have changed their bank account. What should I do?

Pause the payment. Call the supplier using a phone number you already trust, not a number supplied in the change request. Ask them to confirm the new details and have another authorised person review the change before updating your records.

Is checking the bank account name enough?

No. Checking the displayed account name is an important first step, but it does not prove that the recipient is trustworthy. Combine it with independent supplier verification, invoice checks and the appropriate approval process.

How can a small business introduce payment approvals?

Start with a simple written policy. Require one person to submit or update vendor details, another person to verify them, and an authorised person to approve significant payments. Set an approval threshold that suits your business and apply the rule consistently.

Can my bank reverse a transfer sent to a scammer?

Sometimes, but recovery is not guaranteed. Contact your bank immediately, report the suspected fraud and ask whether a recall or other recovery action is possible. Preserve your evidence and report the incident through the appropriate official channels.

How can I check whether a Nigerian company is legitimate?

Start by searching its registration details through the Corporate Affairs Commission's public search. Compare the result with the company's documents and verify its contact details independently. Registration alone does not prove that the company is trustworthy or able to deliver what it promises.

How does Staff Pay help with vendor payments?

Staff Pay provides beneficiary management, Identity Book verification checks, team roles, reviewable changes and transaction history. These features help businesses organise their payment processes and maintain records. They should be used alongside independent checks and appropriate approval controls.

Protect Your Business Before the Next Payment

You do not need a large finance team to introduce better payment controls.

Start with four habits:

1. Verify bank detail changes through a second channel.
2. Read the account name before sending money.
3. Match every invoice to the order and delivery.
4. Never let one person control the entire payment process without an independent check.

These steps take a little time, but they can make a meaningful difference to how your business handles supplier payments.

If you want to organise vendor verification, beneficiary records and payment approvals in one place, explore Staff Pay.

If you need to invoice your own customers, you can also start with the Free Invoice Generator.

Staff Pay helps Nigerian businesses organise payroll and business payments, so every payment has a clearer process behind it.

Disclaimer: This article is for general educational purposes only and does not constitute legal, financial or cybersecurity advice. Verification tools and payment controls reduce risk but cannot eliminate fraud or guarantee recovery of funds. Confirm suspicious transactions with your bank and report suspected fraud through official channels.