13.3 Vendor Billing Schemes, Kickbacks, Procurement Controls & Con Schemes
Key Takeaways
- AIPB's vendor lesson covers how vendors cheat you, forms of bribery, telemarketing scams that target businesses, and how to check out a suspicious vendor before you buy; computer/internet cons ride the same payment desk.
- Shell vendors, duplicate invoices, overbilling, and short shipments are billing schemes. Three-way match—purchase order, receiving report, and invoice—plus W-9 collection and IRS TIN matching for 1099 payers are the bookkeeper counters.
- Kickbacks and bribery need a purchaser who can steer spend. The bookkeeper red flag is vendor setup by the same person who pays; Chapter 12's custody-recording-authorization triangle forbids that pairing.
- Change-of-bank-detail emails need the same independently verified callback as Section 13.2. Never use the phone number inside the changed invoice.
- Con schemes include fake-exec urgency, gift-card and payroll redirects, lottery or government impersonation, ransomware-style fake invoices, and office-supply telemarketing. The bookkeeper does not buy gift cards, change direct deposit from an email, or pay a 'CEO' demand without a live call to a known number.
Why vendor cheating and cons sit on the bookkeeper's desk
AIPB's vendor section is how vendors can cheat you: forms of bribery, telemarketing scams that target businesses, and how to check out a suspicious vendor before you buy. Workbook appendices on bribery red flags and operations that support frauds and scams belong to the same skill. Computer and internet fraud—already opened in Section 13.2—shows up here as con schemes that impersonate vendors, executives, governments, or ransomware notes. This independent OpenExamPrep section is that cluster. It does not rebuild Chapter 12's segregation of duties, imprest cash, screening, or fidelity bonds; it uses the triangle: the person who creates vendors must not be the only person who holds payment authority.
Maple Ridge buys compressors from Arctic Parts, buys odd lots from new suppliers when a job is on fire, and pays from a vendor list Jordan maintains in the accounting file. That vendor list is as dangerous as check stock.
Billing schemes: shells, duplicates, overbilling, short shipments
| Scheme | Mechanics | Maple Ridge numbers | Primary control |
|---|---|---|---|
| Shell vendor | Fake company, real payment, often to an employee or relative | "Ridge Mechanical Consulting LLC" invoices $6,400 for "commissioning" never performed | Owner authorizes new vendors; W-9; SOS search; person who pays cannot add vendors alone |
| Duplicate invoice | Same bill paid twice; thief intercepts the second payment or hopes AP never notices | Arctic Parts $1,150 paid on the original and again on a "past due copy" | Stamp PAID (Chapter 12); software duplicate-check on vendor + invoice number + amount |
| Overbilling | Price or quantity above the PO | PO says 12 compressors at $1,200 = $14,400; invoice says $16,800 | Three-way match to the PO unit price |
| Short shipment | Invoice for 100, dock receives 82; difference walked out or never shipped | 100 fittings invoiced, 82 received, 18 missing (Chapter 12 receiving fraud) | Receiving by someone other than purchasing; count vs PO before AP posts |
Shell vendor, worked. Jordan—if allowed to add vendors and print checks—adds Ridge Mechanical Consulting LLC, uses a home address, skips the W-9, and issues $6,400. Books show a professional-fee expense. Cash is gone. Pat never authorized a commissioning vendor. The exam point is not "Jordan is greedy." It is incompatible duties: vendor master + payment. Chapter 12 already said fake vendors in one sentence; here is the full scheme, including 1099 cover (a shell with no TIN, or a stolen TIN).
Duplicate invoice, worked. Arctic Parts invoice 778 for $1,150 is paid on September 10. On September 18 a PDF "copy" arrives with a new due date. If the file is not stamped PAID and the software does not block vendor + invoice number 778, Maple Ridge pays twice. A thief who intercepts check 4430 has a $1,150 second payment. Even without a thief, duplicates are vendor cheating when a supplier systematically resubmits.
Overbilling, worked. PO 778: 12 compressors × $1,200 = $14,400. Receiving report: 12 units. Invoice: 12 × $1,400 = $16,800. Without a match to the PO price, Jordan pays an extra $2,400. That extra is either a vendor test of AP or the cash that funds a kickback.
Short shipment, worked. PO 801: 100 fittings. Kim records 100 received but only 82 are on the dock (or records 82 and still asks AP to pay 100). Three-way match fails unless receiving is honest and independent of purchasing. This is why Chapter 12 would not let Kim both receive and authorize write-offs.
Kickbacks, bribery, and the bookkeeper's red flags
AIPB names forms of bribery. In a small HVAC wholesaler the usual form is a kickback: the vendor pays a purchaser (cash, gifts, travel, "spiffs," a relative's no-show job) to steer purchase orders or to accept inflated prices. The books may still balance. Gross margin sags. One vendor's share of spend jumps.
| Bribery pattern | What the bookkeeper can see without being the purchaser |
|---|---|
| Inflated unit prices vs prior POs or vs quotes | Same compressor $1,200 last quarter, $1,400 this quarter, no owner-approved increase |
| New vendor with no competitive bid on a large job | Ridge Mechanical Consulting appears at $6,400 with no W-9 |
| Purchaser refuses to rotate vendors or share the vendor file | "Only I know Arctic's real pricing" |
| Invoices always just under the dual-signature threshold | Many $2,490 invoices when Maple Ridge's second signature starts at $2,500 |
| Vendor setup and payment in one pair of hands | Jordan adds the vendor and releases ACH |
| Lavish vendor gifts to the purchaser, not to the company | Tools, tickets, or gift cards that never hit inventory |
The bookkeeper is not the police. The bookkeeper will not post a vendor with no W-9, will not pay without a match, and will escalate a pattern to Pat. A fidelity bond (Chapter 12) may cover employee kickback theft if you can name a suspect; it does not make a vendor honest, and bonding Jordan does not justify letting Jordan own the vendor master.
W-9, TIN matching, and checking out a vendor before you buy
AIPB's practical skill is how to check out a suspicious vendor before you buy. Do it before the first payment, not after the 1099 is rejected.
Form W-9 collects legal name, tax classification, and TIN. No W-9, no new vendor in Maple Ridge's file, except a documented owner override for a true emergency that is regularized within days. A W-9 that lists a name that does not match the invoice letterhead is a stop.
IRS TIN Matching is a payer service: validate TIN and name combinations before filing information returns. It is for payers in the IRS payer files (generally those who have been filing 1099 forms). It is not a credit report and not an AIPB form. Use it when Maple Ridge will 1099 a contractor. A mismatch is a reason not to pay as if the vendor were real.
Due-diligence checklist (bookkeeper version):
- W-9 complete and consistent with invoices.
- State secretary-of-state search: entity exists, status active, name close enough to the invoice.
- Physical address that is not only a private mailbox, plus a phone number you looked up, not one the email provided.
- Call that number and ask for accounts receivable before a first $6,400 payment.
- TIN match if the vendor will receive a 1099.
- Owner authorization to add the vendor; Jordan records, Pat authorizes.
- For telemarketing "you already ordered this," demand the PO number. No PO, no pay.
Telemarketing scams that target businesses (AIPB's named category): unordered toner and copy paper, fake directory listings and "Yellow Pages" invoices, "your postage meter is expired," and inspector or government calls demanding a fine by card today. The control is no PO, no payment, plus the callback rule.
Three-way match
Three-way match compares three documents before AP releases money:
- Purchase order — what Pat (or a delegated buyer who cannot also receive and pay) authorized to buy, at what price and quantity.
- Receiving report — what the dock actually counted, prepared by someone who does not own the vendor master.
- Vendor invoice — what the supplier claims is owed.
Pay the lowest of authorized / received / billed when they disagree, then investigate. Maple Ridge's $14,400 compressor PO versus a $16,800 invoice does not get the extra $2,400 "to keep the account current."
A two-way match (invoice to PO only) misses short shipments. Matching only the invoice to a packing list the vendor emailed misses a fake PO. The warehouse copy of receiving is the independent count.
Change-of-bank-detail is a fourth document problem. The invoice may three-way match and still steal the payment if the account number was swapped. Section 13.2's independently verified callback is mandatory on every bank-detail change, even for Arctic Parts, a trusted vendor. Attackers compromise real vendor mailboxes.
Con schemes the payment desk must refuse
These are the internet and impersonation cons AIPB-style computer-fraud teaching expects you to avoid, clustered with vendor cheating because they hit the same approval path.
| Con | How it arrives | Bookkeeper response |
|---|---|---|
| Fake-exec urgency | Email or text that looks like Pat: "I am in a meeting, pay this now, do not call" | Call Pat on a known mobile number. No known-number confirmation, no payment. Secrecy is a fraud feature. |
| Gift-card redirect | "Buy $2,000 of Apple cards and email the codes for a confidential vendor" | Never pay vendors, taxes, processors, or executives with gift-card codes. Hang up. |
| Payroll redirect | "HR/payroll: employees will miss payday unless you paste this new deposit file" | Payroll banking changes use the employee's known process (portal, paper form) with verification—not an email attachment. Chapter 7's payroll file is not editable from Outlook. |
| Lottery / government impersonation | "Treasury/IRS/state licensing: warrant unless you pay this card or crypto invoice" | IRS and state agencies do not demand gift cards or crypto by phone. Use published agency numbers. |
| Ransomware-style invoice scams | PDF or pop-up: "Your files are encrypted, pay this bitcoin invoice," or a fake copier/IT invoice with a malware link | Disconnect if a real encrypting event is in progress and call known IT; do not pay a random crypto invoice from AP. A fake "past-due software" PDF is a vendor-shell plus malware hybrid—callback, no click. |
| Business-email-compromise vendor variant | Real-looking Arctic Parts thread, new banking | Independently verified callback (Section 13.2). FBI IC3 is the U.S. reporting channel after you freeze what you can with the bank. |
Worked fake-exec: Jordan gets pat.maple.ridge@gmail.com at 4:50 p.m.: "Confidential acquisition. Buy $2,000 Apple gift cards and send photos of the codes. I cannot talk." Jordan's job is not speed. Jordan calls Pat's known number. Pat knows nothing. Jordan does not buy cards. That refusal is the control. AIPB's dos and don'ts live here: don't obey urgency and secrecy; do verify on a channel you already had.
Worked payroll redirect: an "ADP/pay-card" email says installers' deposits will fail unless Jordan uploads a CSV. Jordan does not. Jordan opens the known payroll site or calls the processor number on last period's invoice. Section 13.1's payroll-check fraud was paper; this is the electronic twin.
Practical bookkeeper dos and don'ts (vendors and cons)
| Do | Don't |
|---|---|
| Split vendor setup, receiving, and payment (Chapter 12 triangle) | Let the same person add Ridge Mechanical Consulting and issue the $6,400 |
| Collect W-9s; TIN-match 1099 vendors | Pay a first invoice with no legal name or TIN |
| Three-way match PO, receiving, invoice | Pay from a vendor PDF packing list alone |
| Stamp PAID; block duplicate invoice numbers | Pay "past due copies" without checking the register |
| Callback bank-detail changes on a file phone number | Call the number in the changed invoice |
| Demand a PO on telemarketing toner and directory bills | Pay unordered supplies because a caller is loud |
| Verify fake-exec, payroll, and gift-card asks live | Buy gift cards, crypto, or same-day wires under a secrecy order |
| Report BEC and successful redirects to the bank immediately, then IC3 | Wait a week hoping the wire "comes back on its own" |
| Keep Chapter 12 screening and bonding for insiders who could collude with vendors | Treat a bond as a substitute for the vendor master control |
Exam traps: (1) treating a balanced AP subledger as proof vendors are real; (2) matching only invoice to PO and missing the short shipment; (3) confirming a bank change by email; (4) paying gift cards because an "owner" email said confidential; (5) letting vendor setup and payment sit with one bookkeeper because the firm has fewer than 100 employees; (6) calling PCI DSS or COSO the CB exam sponsor; (7) claiming this independent OpenExamPrep chapter is an AIPB workbook or is approved by a card brand.
Which procedure is the three-way match Maple Ridge should complete before paying a compressor invoice?
Which pattern is the kickback / shell-vendor red flag a bookkeeper is expected to stop?
An email that looks like owner Pat's says payroll must be redirected today and Jordan should buy $2,000 of Apple gift cards for a confidential vendor. What should Jordan do?
You've completed this section
Continue exploring other exams