What is vendor email compromise?

Vendor email compromise is fraud where a supplier's real email account is hijacked and used to send fake bank-detail changes or invoices. Payments then go to the criminal's account. The FBI reported over $3 billion in business email compromise losses in 2025.

What should a firm do when a vendor changes bank details?

Never act on the request alone. Call the vendor back on a phone number already on file — not one from the email — confirm the change, require a second approver, and keep a record of the verification.

Why do accounting and CFO firms need payment verification?

Firms that pay vendors for many clients are high-value targets: one compromised inbox exposes every client's payment stream. Firms have been sued for wiring client money on fraudulent instructions even when their own systems were never breached.

Does cyber insurance require payment verification procedures?

Many cyber and E&O applications now ask firms to describe controls for verifying vendor payment changes, including out-of-band callback procedures. Documented verification with evidence supports both coverage and claims.

Payment verification for firms that move client money

A fake email or a cloned voice can send your client's money to a criminal. And your firm approved the payment.

PayBeacon confirms every payment change with the real person before money moves — automatically, with proof of every check. AI made these scams cheap. Firms your size are now targets.

Get early access

The threat, 2026

Every channel your staff trusts can now be forged.

Email

AI writes replies inside hijacked email threads — real address, real context, perfect tone.

Voice

A few seconds of audio is enough to clone a client's voice — one that talks back and answers your questions.

Video

Deepfake meetings put the "CFO" on screen. $25M has already been wired to one.

Documents

Perfect fake invoices, W-9s, and bank letters — even entire fake vendors.

If anything can be faked, you can't trust how a request looks or sounds. So PayBeacon checks something a fraudster can't fake: where the request came from. Every change is confirmed through contact details saved before the request ever arrived.

Four ways firms get robbed. Where each one dies.

The patient vendor swap.

Your client's supplier emails new bank details. It's pixel-perfect — because the supplier's real mailbox was hijacked months ago. One callback to the number on file, and their bookkeeper answers: "We didn't change banks."

Fraud caught. Payment goes to the old details. Two companies saved.

The silent switch.

Nobody announces anything. Invoice #47 just shows up with different account details in the footer. PayBeacon compares every invoice against the record on file and flags the mismatch no human would spot.

Fraud caught before anyone suspected a thing.

The vendor that never existed.

A clean invoice from a plausible contractor, W-9 attached. Step one isn't checking whether they exist. It's asking your client, on their verified contact: "Did you hire these people?"

"Never heard of them." The invoice never becomes a payee.

The voice on the phone.

Friday, 4:40pm. Your AP associate hears the client CEO's exact voice: "Wire $180k tonight. Keep it quiet." She doesn't argue with the voice. She follows the protocol: "Logging it now — you'll get our standard confirmation." The real CEO, at the gym, gets a text: what wire?

No wire. Your junior staffer is the hero, not the victim.

The FBI's average loss per incident: about $123,000. PayBeacon prevents these types of fraud.

Wondering which of these would get through your firm? Take the 60-second self-check →

Patterns from documented fraud cases; details illustrative.

What we're building

Before money moves, we confirm the request is real — and keep the proof.

Call back the number on file

Every change is confirmed using contact details already on file — never a number or email supplied by the request itself. PayBeacon keeps those records and does the follow-up for you.

The vendor confirms it themselves

The vendor or client approves the change from their own verified email or phone, with a one-time code no cloned voice can answer.

Two people approve every change

No one moves a payment change alone — no matter how senior the requester or how urgent the request. Your staff get a policy to point to instead of a boss's voice to defy.

Proof, kept

Every check creates a record that can't be quietly edited later, filed per client. Ready for your insurance renewal, your clients' insurers, and auditors.

In build now. PayBeacon works alongside whatever your clients pay from — Bill.com, Melio, Ramp, or bank portals — because the check happens before any payment is sent. 2–3 early-access slots open: free for 90 days in exchange for weekly feedback.

Console preview

All your clients' payment changes, in one queue.

A preview of the console we're building. Requests come in by email or manual entry. Nothing is marked safe to pay until every check is done.

Verification queue — all clientsPreview

Riverside Property Group → vendor: Coastal HVAC

Bank-detail change received by email · callback to number on file scheduled

Pending callback

Marlowe Logistics → new vendor: Summit Freight Services

New-vendor setup · confirmation link sent to verified email · awaiting code

Awaiting confirmation

Hearthstone Dental → vendor: Lakeland Supplies

Bank-detail change verified · both approvals logged · evidence record #4471 sealed

Verified ✓

Three questions someone will eventually ask your firm.

"Where did the request come from?"

Bank-detail changes, new vendors, and urgent payment requests arrive by email, phone, and portals — the exact channels AI can now fake perfectly.

"Who verified it, and how?"

Who called whom, using which number — the one in the email, or the one on file? And what happened the day the client said it was urgent?

"Can you prove it?"

When your E&O renewal, a client's insurer, or a lawsuit asks for evidence that a change was verified — what can your firm actually show?

PayBeacon exists so the answers are: the request was confirmed at its source, by two people, and here's the record.

Who's behind this

Built by someone who's spent 20 years moving money safely — not a sales team.

Founder

Deepak Krishnamurthy has spent 20 years building financial systems, including leading engineering teams in regulated finance. PayBeacon started with a simple question: when a firm moves money for thirty clients, what actually stands between a convincing fake email and a six-figure wire?

The answer is being built now — carefully, because a product that verifies payments has to be trustworthy itself.