This article is written by Bound
TL;DR: FX exposure is the total amount your business stands to gain or lose from movements in foreign exchange rates. It is the combination of money you need to pay in foreign currencies, money you expect to receive in foreign currencies, and future payments or receipts you are forecasting. To quantify it, you need to identify these exposures by currency, amount and timing using your invoices, accounting records and forecasts. You do not need a treasury specialist to do this. Bound can calculate your exposure automatically from connected accounting data, but the same framework can also be applied manually.
FX exposure can build up without being obvious. It sits across supplier invoices, customer receivables and forecast payments or receipts, often in different currencies and at different points in time. If those exposures are not identified and tracked, an adverse exchange-rate movement can turn into an unexpected P&L impact by quarter close, when there is little left to do except explain the variance.
Many finance teams find their exposure the same way: after it has already cost them. This article gives you a repeatable method for finding and sizing every source of currency exposure before it moves, using invoices, ledgers and forecasts you already hold. It covers how to calculate FX exposure in both directions, how to net positions, and how to build a monthly process you can document and defend.
Your FX exposure starts before any money changes hands. As soon as you commit to paying or receiving an amount in a foreign currency, the value of that transaction in your reporting currency can change with the exchange rate.
Transaction exposure is the risk that exchange rate movements change the value of a specific, identified future payment or receipt. It exists from the moment a contract is agreed or an invoice is issued, not from the payment date. That future cash flow keeps changing in value between the time you record it and the time it settles, which is why the exposure exists well before the payment date.
Say you agree to pay a supplier $125,000 when GBP/USD is 1.25. At that rate, you expect the invoice to cost £100,000. If the rate moves to 1.20 by the time you pay 60 days later, the same $125,000 invoice costs £104,167.
That £4,167 difference comes entirely from the exchange rate moving. If it was not accounted for in your original budget, it directly increases the cost of the transaction. Rates can, of course, move in your favour too.
The impact becomes more significant when margins are tight. Take a £500,000 order expected to generate a 10% gross margin, or £50,000. If £500,000 of the cost is exposed to a foreign currency and the exchange rate moves 2% against you, an unhedged position would cost an additional £10,000. That is a fifth of the expected margin on the deal, even though nothing about the underlying order has changed.
The scale of the problem depends on your margins and your volumes, not on whether you consider yourself an “international” business. An agency paying overseas contractors, a SaaS company invoicing in dollars, and a wholesaler buying from European suppliers all carry the same structural risk.
Transaction exposure is the most relevant type of FX exposure for the purposes of this article, but it is not the only one. Translation exposure arises when foreign-currency assets, liabilities or financial statements are converted into a company’s reporting currency.
Exchange rate movements can therefore change their reported value, even when no underlying transaction has taken place. Economic exposure is broader and longer term. It describes how sustained currency movements can affect a company’s future cash flows, competitiveness and ultimately its value.
| Exposure type | What it affects | Timeframe |
|---|---|---|
| Transaction | Specific payments and receipts | Typically days to months |
| Translation | Consolidated balance sheet | Reporting periods |
| Economic | Competitive position, long-term cash flow | Years |
For most Finance Directors, transaction exposure is the most immediate concern. That is what the rest of this article focuses on.
Before you can quantify your FX exposure, you need to know where it comes from. Exposure runs in both directions: money out (supplier invoices, overseas payroll, contractors) and money in (customer invoices, international revenue), plus one-off events like a funding round in a non-base currency.
Your accounts payable and receivable ledgers are the most reliable starting point because they reflect actual commitments, not estimates. For every open foreign currency item, extract five fields:
Accounting systems handle multi-currency data differently, so make sure you are pulling the right fields when calculating your exposure. In Xero, for example, an exchange rate is applied to each foreign-currency invoice, so the currency needs to be recorded correctly from the start. NetSuite imports also need the currency and due date mapped explicitly, as DocuClipper’s NetSuite import guide shows.
Your ledger only captures transactions that have already been invoiced. But purchase orders and approved supplier contracts can create FX exposure before an invoice arrives.
For example, if you issue a PO in USD that you expect to pay in 60 days, your cost in your reporting currency can change as the exchange rate moves over that period. Include open POs in your exposure by currency, amount and expected settlement date.
Recurring payments can be easy to overlook because each individual payment may seem small. Build a simple register covering:
For each one, record the currency, amount and frequency. A $4,000 monthly software subscription, for example, adds up to $48,000 of annual USD exposure, even though no single payment looks particularly significant.
Finally, map your forecast foreign-currency payments and receipts by currency and month. Unlike invoices or committed payments, forecasts come with uncertainty, so your exposure should reflect that rather than assume a level of precision you do not have.
For example, if your sales pipeline suggests between $800,000 and $1 million of USD revenue next quarter, record that range. This gives you a more realistic view of your expected exposure and a better basis for deciding how much of it to hedge.
Once you have identified your exposures, you can quantify them in four steps. This gives you a process you can repeat each month as invoices, commitments and forecasts change.
FX exposure is time-bound. A $200,000 payable due in 30 days may need to be managed differently from the same amount due in 180 days. Group each payment and receipt by currency and expected settlement date to build a timeline of your exposure.
Netting means offsetting payments and receipts in the same currency over the same period. For example, if you expect to receive $200,000 from customers and pay $150,000 to suppliers in the same period, your net USD exposure is $50,000.
These offsets act as natural hedges (see glossary), reducing the amount of FX exposure you may need to manage with hedging products.
| USD position | Amount |
|---|---|
| Receivables | $200,000 |
| Payables | ($150,000) |
| Net exposure | $50,000 |
Convert each net foreign-currency exposure into your reporting currency using the current exchange rate. For example, if GBP/USD is 1.25, a $50,000 net USD exposure is equivalent to £40,000.
Converting each exposure into the same reporting currency gives you a consistent view of your total FX exposure across currencies.
The output is a monthly schedule of net exposure by currency.
| Month | Currency | Net amount | Rate used | GBP equivalent |
|---|---|---|---|---|
| Example month | USD | $50,000 | 1.25 | £40,000 |
| Example month | EUR | €80,000 | 1.16 | £68,966 |
| Following month | USD | $120,000 | 1.25 | £96,000 |
Sizing positions tells you what you hold. The next step is quantifying what a rate move would do to each one.
Take a $750,000 customer invoice due in 90 days. At a GBP/USD rate of 1.25, it is worth £600,000.
If GBP/USD moves 2% higher to 1.275, each dollar converts into fewer pounds and the invoice is worth £588,235, £11,765 less than at the original rate.
If GBP/USD moves 2% lower to 1.225, each dollar converts into more pounds and the invoice is worth £612,245, £12,245 more than at the original rate.
The same calculation runs in reverse for money going out. A €400,000 supplier payment due in 60 days costs £344,828 at 1.16.
If EUR/GBP moves 2% against you to 1.1368, the payment costs £351,866, £7,038 more than budgeted.
If it moves 2% in your favour to 1.1832, the payment costs £338,066, £6,762 less. The exposure exists whether you measure it or not.
A simple way to estimate the potential impact of FX movements is to run a sensitivity analysis. Start with your current exposure and calculate what it would be worth in your reporting currency if the exchange rate moved by a set percentage in either direction.
For example, you might test the impact of a 2% adverse and 2% favourable move. This gives you a range of potential outcomes rather than assuming a single exchange rate. This type of percentage-based scenario analysis is described in this treasury lecture on exposure.
| Position | Amount | Rate | GBP value | 2% adverse | 2% favourable |
|---|---|---|---|---|---|
| USD receivable | $750,000 | 1.25 | £600,000 | -£11,765 | +£12,245 |
| EUR payable | €400,000 | 1.16 | £344,828 | +£7,038 cost | -£6,762 cost |
| USD net exposure | $50,000 | 1.25 | £40,000 | -£784 | +£816 |
Figures rounded for illustration. The impacts are not perfectly symmetric because the sterling value changes relative to a shifting rate, and rates can move in either direction, which is why the table shows both scenarios rather than assuming the worst.
Calculating your FX exposure once gives you a snapshot. A repeatable process helps you keep that view up to date as invoices, commitments and forecasts change.
Your FX exposure view depends on up-to-date inputs from your accounting software, bank feeds, purchase orders, sales pipeline, payroll schedules and recurring contracts. As these inputs change, your exposure changes too, so they need to be refreshed regularly to keep your view accurate.
The challenge with manual tracking is keeping your exposure data up to date. A spreadsheet may be accurate when it is created but already out of date by the time someone uses it.
Spreadsheet risk is well documented by groups such as the European Spreadsheet Risks Interest Group, with common issues including data entry, copy-and-paste and formula errors.
Manual tracking can work well when FX volumes are low. But as you add more currencies, entities and transactions, the amount of data that needs to be collected, checked and updated grows too. That makes it harder to maintain an accurate view of your exposure over time.
Even a well-run monthly process can miss FX exposure that does not appear in your payables and receivables.
Check beyond payables and receivables for:
Common errors include incorrect currency codes, missing due dates, duplicate entries and outdated forecasts. Check your exposure data against the source systems each month. Otherwise, your net exposure can give you false precision: the number looks exact, but the data behind it may be wrong.
Connecting your source data directly can also reduce manual work, removing one opportunity for errors to enter the process.
Where subsidiaries transact in currencies other than their functional currency, looking at exposure across the group can reveal where foreign-currency inflows and outflows offset each other. The same netting principle used for a single entity can be applied across entities where those exposures can be managed together.
Metabase’s FX exposure metric guide describes the calculation as foreign-currency assets and inflows minus liabilities and outflows, translated at the relevant valuation rate.
How often should I measure FX exposure?
Monthly at minimum, aligned to the month-end close. Businesses with high transaction volumes or volatile pairs may need weekly or daily views, which connected data makes practical.
What level of exposure is material enough to manage?
There is no universal threshold. A 2% adverse move on a six-figure exposure can exceed the margin on the underlying deal, so the materiality test is the impact on margin and cash flow, not the absolute amount.
Should I include forecast revenue in my exposure calculation?
Yes. Forecast revenue in a foreign currency can create FX exposure before invoices are issued, so it should be included in your exposure view. But keep it separate from committed exposure and reflect the level of uncertainty in your forecast. If you forecast revenue as a range, use that range rather than treating the exposure as a fixed amount.
How do I account for uncertain payment dates?
If you do not know the exact payment date, record an expected settlement window rather than a single date. This keeps the uncertainty visible in your exposure view instead of creating false precision. With Bound, you can adjust the amount and settlement date of your hedge if the underlying payment changes, giving you flexibility when the exact timing or amount is uncertain, for a transparent fee.
What is the difference between transaction exposure and translation exposure?
Transaction exposure affects specific future payments and receipts in foreign currency. Translation exposure affects the reported value of foreign currency assets and liabilities when consolidated into your base currency.
Transaction exposure: The risk that exchange rate movements change the value of a specific, identified future payment or receipt in a foreign currency.
Translation exposure: The risk that exchange rate movements change the reported value of foreign currency assets and liabilities when consolidated into the base currency. Translation exposure is also known as accounting exposure.
Economic exposure: The longer-term risk that exchange rate movements change the competitive position or cash flows of the business beyond individual transactions.
Net exposure: The remaining currency position after offsetting payables and receivables in the same currency.
Natural hedge: A situation where money in and money out in the same currency offset each other, reducing the amount that needs active management.
Settlement date: The day the currencies are exchanged and a trade completes.
No opinion given in the material constitutes a recommendation by Bound Rates Limited that any particular transaction or investment strategy is suitable for any specific company or person. Results may and will vary. The information in this publication does not constitute legal, tax or other professional advice from Bound Rates Limited or its affiliates.
Treasury Masterminds is a community of professionals working in treasury management or those interested in learning more about various topics related to treasury management, including cash management, foreign exchange management, and payments. To register and connect with Treasury professionals, click the button below.
This article is written by our partner, Nilus
Cash flow forecasting in treasury fails structurally, not occasionally. Here are the 5 root causes, what driver-based AI forecasting actually does, and what a 30% accuracy improvement is worth in dollar terms.
Cash flow forecasting is the process of predicting a company’s cash inflows and outflows over a defined horizon – typically 13 weeks (short-term operational) or 12 months (strategic planning). Accurate forecasting requires integrating data from A/R, A/P, payroll, FX, and banking sources – and knowing which inputs are most likely to shift.
Here’s an uncomfortable truth most treasury professionals already know: the forecast is wrong. Not occasionally. Structurally, predictably, every single week. The question isn’t whether it’s wrong – it’s whether you can explain why it’s wrong before someone else points it out.
In 2026, that question has become significantly more consequential. Rising interest rates mean idle cash carries a real opportunity cost. PE sponsors and senior lenders require covenant-compliant forecasts as a contractual obligation, not a best-practice exercise. And boards – having watched CFOs get blindsided by cash crunches in 2022 and 2023 – are holding finance leaders accountable not just for forecast direction, but for forecast variance. “We were directionally right” doesn’t land the same way it used to.
This piece is an honest attempt to explain why forecasting fails, what driver-based AI forecasting actually does (as opposed to the breathless marketing claims you’ve already dismissed), and what a 30% improvement in accuracy is actually worth in dollar terms. No crystal balls. No transformation promises. Just the math.
The 13-week cash flow forecast is the workhorse of treasury operations – and one of the most misunderstood documents in finance. Let’s be precise about what it actually is, because the details matter for everything that follows.
The 13-week horizon isn’t arbitrary. It spans exactly one fiscal quarter – short enough that the inputs are grounded in real transaction data (not budget assumptions), and long enough to support covenant monitoring, revolver management, and operational liquidity planning. If you’re running tighter, you can’t see around corners. If you’re running longer, you’re kidding yourself about the precision.
A complete 13-week forecast includes:
One thing that trips people up: the 13-week forecast uses the direct method – it models actual cash transactions, not accounting income. FP&A typically builds their forecasts using the indirect method, starting from net income and adjusting for non-cash items.
These two methods answer different questions. Treasury needs to know when cash actually moves; FP&A needs to know what the P&L looks like. Translating between them is one of the most friction-generating handoffs in corporate finance – and a root cause of forecast error we’ll return to shortly.
When is a 13-week forecast required?
Always, ideally. But contractually, it’s typically required in three scenarios: PE portfolio company covenant packages (weekly submission is standard), revolving credit facility compliance monitoring, and IPO readiness (SOX preparation requires demonstrable financial controls, and a documented weekly cash forecasting process is part of that).
The 13-week forecast connects to the 12-month rolling forecast – the strategic layer used for board reporting, M&A planning, and long-range liquidity modeling. Best practice is to run both, integrated, so actual weekly cash signals continuously inform the strategic model. Most mid-market companies only have one or the other. That’s a gap worth closing.
Here’s the thing: your forecaster is probably quite good at their job. The forecast is wrong because of architecture, not ability. Here are the five structural reasons it keeps happening:
The bottom line
The problem isn’t the forecaster. It’s the architecture. A skilled treasury analyst running a manually-collected, weekly-batch forecasting process is operating at a structural disadvantage – not because of skill gaps, but because the data pipeline they’re working with was designed for a world that no longer exists.
Let’s put the comparison on paper, because the differences aren’t cosmetic.
| Dimension | Excel / Manual | AI-Native (Nilus) |
|---|---|---|
| Data freshness | Weekly batch | Real-time, continuous |
| A/R input source | Manual submission from A/R team | Automated from ERP + bank data |
| FX rate updates | Weekly manual refresh | Live market rates |
| Forecast horizon | 13-week only (usually) | 13-week rolling + 12-month integrated |
| Variance explanation | Manual post-mortem (if it happens) | Automated driver attribution |
| Accuracy vs. baseline | Baseline | 30%+ average improvement |
| Build time per week | 4-8 hours | <30 minutes (exceptions-based review) |
| Board-readiness | Manually formatted and summarized | Auto-generated board summary |
| Audit trail | None – spreadsheet history is not an audit trail | Full input lineage and approval timestamps |
| Multi-entity / multi-currency | Painful consolidation | Native support |
The column that matters most to most CFOs: variance explanation. Not because they can’t do a post-mortem manually – they can – but because the post-mortem happens after the board meeting, not before it. Driver attribution turns that sequence around. You walk into the room already knowing why the forecast changed. That’s a different conversation.
If you’ve made it this far and you’re still skeptical about AI forecasting claims, good. That skepticism is well-earned – the space has been oversold relentlessly. So let’s be very specific about what driver-based forecasting does and doesn’t do.
It does not predict the future. No system does. Your customers’ payment behavior is influenced by factors no model will ever fully capture.
What it does do is systematically identify which inputs changed and quantify their impact on the forecast. That’s the entirety of the value proposition – and it turns out that’s worth a great deal.
Traditional forecasting tells you: “The week 6 cash position forecast is down $2.1M versus last week.”
Driver-based forecasting tells you: “The week 6 position is down $2.1M. Here’s why: three enterprise A/R invoices totaling $1.4M have shifted 10 days right based on updated payment timing from your ERP. GBP depreciated 1.8% against your hedged position, generating a $390K FX variance. One new A/P outflow of $310K was approved and added to the schedule this morning.”
The number is the same. But the second version tells you which levers to pull – call the three enterprise accounts, review your GBP hedge ratio, confirm the A/P approval is correct. You’re managing drivers, not outcomes.
A well-designed AI forecasting system doesn’t just output a number – it outputs a range and a confidence level for each input driver, based on the historical accuracy of that driver across comparable periods.
A customer that has paid within 3 days of terms for 24 consecutive months gets a different confidence weight than a customer with erratic payment history. The aggregate forecast inherits those confidence levels, which means you know where the uncertainty lives before it becomes variance.
You can walk into the board meeting and explain variance before you’re asked. The forecast is defensible, not just directional. When a board member asks “why was cash $3M lower than forecast last month,” you have a prepared, data-backed answer – not a post-hoc rationalization constructed at midnight before the meeting.
The core framing
This is not a black box. The AI surfaces the math. The CFO makes the call. A forecast that shows its reasoning isn’t just more accurate – it’s categorically more useful than one that only tells you what it predicts.
This is where we put the numbers on the table. Across Nilus customers, the average improvement in cash flow forecast accuracy is 30%+. That’s not a projected improvement from a vendor model – it’s measured against each customer’s pre-implementation baseline.
At StackAdapt, 95% of transaction auto-tagging now feeds directly into forecast inputs, eliminating the manual categorization step and saving more than 30 hours of treasury analyst time per month.
At Optibus, automated real-time cash visibility surfaced $5.5M in stagnant cash that had been sitting in suboptimal positions – undetected by the prior manual process – and enabled its redeployment.
Time saved is meaningful. But the bigger return is the variance reduction. A 30% improvement in forecast accuracy doesn’t sound like much until you do the math on what a cash forecast miss actually costs.
What changed in your last forecast? See the drivers – not just the delta. Ask Nilus →
These two forecasting tools answer different questions and serve different audiences. Conflating them is a common source of organizational friction – and running only one when you need both is a gap that creates blind spots in both directions.
| 13-Week Cash Forecast | 12-Month Rolling Forecast | |
|---|---|---|
| Purpose | Operational liquidity management | Strategic planning, covenant monitoring |
| Frequency | Weekly refresh | Monthly refresh |
| Input basis | Direct cash transactions | Actuals + budget assumptions |
| Primary user | Treasurer, Cash Manager | CFO, FP&A |
| When critical | Covenant compliance, tight liquidity, revolver management | Board reporting, M&A planning, IPO prep |
| AI advantage | Real-time transaction data, automated driver attribution, instant refresh | Scenario modeling, sensitivity analysis, variance attribution across longer horizon |
The integration gap
Most mid-market finance teams run only one of these – typically the 13-week, because it’s required. What they’re missing is the feedback loop: weekly actuals that continuously re-anchor the 12-month model, so the strategic forecast doesn’t drift from operational reality. Nilus supports both, integrated – the 13-week feeds the 12-month automatically.
If you’re a CFO at a PE-backed company, you already know that “best practice” is not the right frame for cash forecasting. It’s a contractual obligation with financial penalties attached.
PE sponsors typically require weekly 13-week cash forecasts as a condition of the credit agreement – submitted to the sponsor, and sometimes to the senior lender, by end of business Monday. The forecast is covenant evidence. It’s not a management tool; it’s a legal document.
Debt covenants – leverage ratio, interest coverage, minimum liquidity threshold – are triggered by actual cash positions.
But the point of the forecast is to see trouble coming 4 to 8 weeks ahead, not the week it hits. That’s the early warning system that keeps treasury out of a technical default conversation.
The consequences of getting it wrong aren’t academic. A covenant breach triggers fee clauses, accelerated lender scrutiny, potential cross-default provisions, and in some structures, acceleration of the debt. Even a near-miss – where treasury identified the risk late and had to scramble – damages the CFO’s credibility with the sponsor in ways that are hard to recover.
Nilus builds a covenant tracking layer directly on top of the cash forecast – automatically flagging when projected cash positions approach threshold levels, so treasury has 4-6 weeks of runway to take corrective action before a breach becomes visible.
That’s not a nice-to-have for PE-backed companies. That’s table stakes. Learn more about how this fits into a broader treasury management system.
The market for cash forecasting software is crowded, and the demos are polished. Here’s how to cut through the noise and ask the questions that actually differentiate systems. (Spoiler: competitors like Kyriba and Trovata have very different answers to some of these)
Treasury Masterminds is a community of professionals working in treasury management or those interested in learning more about various topics related to treasury management, including cash management, foreign exchange management, and payments. To register and connect with Treasury professionals, click the button below.
This article is written by Palm
Categorisation is one of the oldest jobs in treasury. Tag every transaction so the data downstream actually means something: forecasts, Variance Analysis, Cash Positioning, board reporting. For years, treasurers have done it one of two ways: by hand, or with rules. AI is replacing both.
The interesting argument isn’t AI vs manual. Most teams gave up on tagging thousands of transactions a week by hand long ago. The real argument is AI vs rules, because rules are what most TMSs and Excel-based processes still run on. That’s the layer AI is taking out.
Rules look elegant on paper. If the counterparty contains “HSBC” and the amount is negative, tag it as a bank charge. If the description starts with “PAYROLL”, tag it as payroll. Easy.
Reality is messier. Counterparty names change when a vendor rebrands. Payment descriptions get truncated by the bank. A new entity is acquired and starts paying into the same account with a different reference format. A subsidiary in another country sends a tax payment no rule has ever seen. Each of those breaks the rule silently. The transaction either falls into “Uncategorised,” or gets miscategorised and quietly distorts the forecast.
Then there is the maintenance burden. Every new counterparty needs a rule. Every edge case needs an exception. The person who built the engine left two years ago, and nobody is sure which rules are still in use. The library grows, contradictions multiply, and the rules never quite catch up with how the business actually moves money.
Rules work on the world you’ve already seen. They collapse on the one you haven’t.
AI categorisation is pattern recognition with feedback.
The model trains on your historical transactions and the categories a human assigned to each one. It learns the signals that distinguish a customer payment from an intercompany transfer, a one-off bonus from a payroll run, a tax settlement from a supplier payment. Not just the counterparty name, but the amount, the description, the account pair, the currency, the timing, all weighed together.
When a new transaction lands, the model doesn’t ask “does this match any rule?” It asks “which pattern does this look most like?” and outputs a category with a confidence score. Above the threshold, it tags automatically. Below it, the transaction goes to a treasurer for review. Their decision feeds back into the model.
That feedback loop is the key difference. Rules don’t learn. AI does. Every correction makes the next prediction sharper. New counterparties get classified the moment they appear. Description changes don’t break anything. The model handles ambiguity because it doesn’t need an exact match.
Rules need explicit logic. AI captures patterns you’d never think to encode: that a particular customer always pays on the 27th, that a supplier’s invoices come in two amount bands, that a certain intercompany flow only happens at quarter-end. Those signals improve accuracy in ways no rule library could.
And rules don’t scale across entities. AI does. One model categorises transactions across every subsidiary, in every currency, with consistent logic.
The fear with AI is the black box. A good system isn’t one. Every prediction comes with a confidence score and a visible reason. The treasurer can override any tag, and the model learns from that override. Transactions can be marked as System Outliers so they don’t pollute future training. The taxonomy can be set at any level of hierarchy: entity, account, subsidiary.
You keep the control rules gave you. You lose the maintenance burden.
Rules-based categorisation was a step forward thirty years ago. It is now the bottleneck: the library nobody owns, the edge cases nobody covered, the silent miscategorisations nobody catches until the forecast misses.
AI categorisation handles the messy reality of real treasury data, learns from every correction, and stays accurate as the business changes. It isn’t a faster rules engine. It’s what rules engines were trying to become.
Treasury Masterminds is a community of professionals working in treasury management or those interested in learning more about various topics related to treasury management, including cash management, foreign exchange management, and payments. To register and connect with Treasury professionals, click the button below.
This article is written by Trustpair
Imagine discovering that one of your trusted employees had spent years editing real supplier invoices to redirect payments into their own account. That’s exactly what happened at Miami University, which lost over $2.3 million to an internal fraudster. Vendor fraud is a severe and growing threat to UK businesses. The Home Office estimates fraud cost UK businesses £5.2 billion in the year ending March 2024, while fake invoice fraud alone affected 11% of UK businesses in the same period.
In this article, learn the most common types of vendor fraud and how to fight against it with Trustpair.
Phishing emails involve the impersonation of a genuine third party in order to gain access to sensitive information or divert a payment. In the vendor fraud context, this is often called Business Email Compromise (BEC) or Vendor Email Compromise (VEC).
There are different levels of sophistication. Spear phishing involves detailed prior research: fraudsters identify the payment approver’s name, the company’s standard invoicing process, and the real vendor’s email format, often spoofing it convincingly. Busy procurement teams are unlikely to spot the difference.
Pharming goes further, directing victims to malicious websites designed to harvest employee login credentials and gain access to confidential company systems.
A significant and growing threat is AI-enhanced phishing. According to Abnormal Security’s 2026 Attack Landscape Report, 63% of organisations report an increase in email attacks using AI-generated content — text with no spelling errors, accurate tone, and contextually appropriate personalisation. In controlled testing, AI-generated phishing emails achieve a 14% click rate, nearly double the 8% rate for human-crafted attacks.
BEC attacks rose 38% year-over-year in 2025, with Vendor Email Compromise (VEC) — where fraudsters operate from inside a compromised supplier account — growing 67% in the same period (Abnormal Security).
These attacks rely on social engineering tactics. A typical scenario: fraudsters impersonate a known supplier mid-contract and submit a convincing invoice for legitimate-sounding services. Because the supplier relationship exists and no automated verification is in place, the payment goes through unchallenged.
Fraudsters frequently target payments made via Faster Payments and BACS, requesting account detail changes that re-route funds to mule accounts. Given the near-instant settlement of Faster Payments and the direct debit capabilities of BACS, funds can be irrecoverable within minutes. CHAPS payments for high-value transfers carry similar risk.
Internal fraud, also known as employee fraud, is another example of vendor fraud.
In this scheme, an employee exploits their access to submit and conceal fraudulent invoices. They may siphon payments to a shell company, inflate the price of goods or services, or redirect funds to an account they control. Because the employee understands exactly how invoices are normally processed, the fraud can remain invisible for extended periods.
With hundreds or thousands of suppliers in a typical organisation, accounts payable staff are unlikely to flag an invoice that looks and behaves like all the others.
The fraud triangle explains why employees commit fraud through three converging factors:
One example of employee fraud at a British business illustrates this precisely. The financial controller, facing personal financial pressure after her partner became redundant, noticed an existing supplier had ceased trading. She edited a previous invoice, replaced the bank details with those of her own shell company, and deliberately kept each transaction below the co-authorisation threshold. The CFO, busy and trusting of a long-standing colleague, only scrutinised payments to new suppliers. The fraud went undetected, costing the business approximately £20,000.
Under the PSR’s APP fraud reimbursement rules, which came into force in October 2024, banks and payment service providers must reimburse victims of authorised push payment fraud up to £85,000. The PSR reported that in the first three months of the rules being in force, 86% of money stolen through in-scope APP fraud was returned to victims (UK Finance, Fraud Report 2025). While this applies primarily to personal accounts, it is increasing scrutiny on corporate payment controls and reinforcing the need for businesses to demonstrate pre-payment due diligence.
Invoice fraud is a third attack vector. Here, the communication genuinely appears to come from a real supplier, because that supplier’s email or systems have been hacked.
The attacker, operating from inside the compromised supplier account, requests a change in bank account details. They may also submit invoices for goods or services never delivered. These attacks are particularly dangerous because businesses are far less suspicious of established supplier relationships, typically concentrating verification efforts on new vendors only.
According to the Home Office’s Economic Crime Survey 2024, mandate fraud — where fraudsters trick a business into changing bank details to divert payments — affected 7% of UK businesses in the preceding 12 months, while fake invoice fraud was the most common type of fraud, affecting 11% of all businesses.
Sade Telecom, an electrical network company, fell victim to this type of fraud before partnering with Trustpair. Their accounts payable team received a payment detail change request from what appeared to be an existing supplier. Without an automated verification system, they processed the change and sent subsequent payments to the fraudulent account. It was only when the genuine vendor issued a late-payment notice that the fraud was discovered.
Following the incident, Sade Telecom implemented Trustpair to automatically validate payment details before every transaction. The result: 100% of subsequent fraud attempts were blocked, with the solution live within 72 hours.
For UK organisations, mandate fraud most commonly targets BACS Direct Credit and Faster Payment instructions. Because Faster Payments settle in seconds, early detection before payment authorisation is the only reliable defence. Trustpair’s pre-payment validation integrates directly into your payment workflow to prevent fraud at source.
Vendor account validation is the most effective way to prevent all three types of vendor fraud and detect vendor fraud red flags before a payment is ever released.
The process involves cross-checking the details on a supplier invoice against international and domestic databases, verifying:
By automating this validation across every payment cycle, UK finance teams can confirm they are paying who they believe they are paying, not fraudsters who have intercepted the relationship.
Manual checks are slow, inconsistent, and easily circumvented. Automated vendor account validation removes human error and scales to match the size of your supplier base, whether you have 200 or 200,000 vendors.
The three most common vendor fraud schemes are:
Protect your business by validating supplier accounts against verified databases in real time, before every payment. With Trustpair, you can demonstrate the due diligence required under current UK payment regulations while blocking 100% of fraud attempts.
Treasury Masterminds is a community of professionals working in treasury management or those interested in learning more about various topics related to treasury management, including cash management, foreign exchange management, and payments. To register and connect with Treasury professionals, click the button below.
