A new vendor sends everything you asked for: a W-9, a certificate of insurance, a letter on bank letterhead confirming their account details, and a link to a clean, professional website. A week later, an existing contractor emails to say they’ve switched banks and attaches an updated payment form. Every document looks right. Some of them may not be.
Verifying who you’re dealing with is a core part of our work. We vet vendors and services before recommending them to clients, and we investigate fraud cases where money went to someone who only looked legitimate. Payments and financial services have long had formal processes for this, known as KYB and KYC (know your business, know your customer). The lesson carries over to any organization: a document is a claim, not proof. Generative AI has made that much more important for small organizations.
Why “Looks Legitimate” No Longer Counts
For years, small organizations relied on an informal filter: real businesses have polished paperwork and fraudsters don’t. Sloppy letterhead, odd fonts, a misspelled bank name, or a website that looked thrown together were the tells.
Those tells are mostly gone. Image and language models can produce, in minutes and with little skill:
- Invoices and statements that match a real vendor’s layout, tone, and numbering pattern, copied from a single genuine example.
- Bank letters and account confirmations on convincing letterhead, with plausible signatures and reference numbers.
- Identity documents and pay stubs good enough to pass a glance or a low-resolution upload.
- Company websites with team pages, case studies, testimonials, and AI-generated headshots, built in an afternoon.
- Supporting correspondence written fluently in whatever voice the situation calls for, from a nervous first-time grant applicant to a terse accounts-receivable clerk.
None of this requires breaking into anything. The forger only needs to know what a real document should look like, and many real documents are public or have leaked.
How Synthetic Identities Work
A forged document impersonates someone real. A synthetic identity is different: it blends real and fabricated data into a person or business that doesn’t exist but passes checks.
The classic version pairs a real identifier, such as a Social Security number belonging to someone unlikely to notice (a child, for instance), with an invented name, date of birth, and address. Over months, the identity accumulates a history: an account here, a utility bill there. Even rejected credit applications can create a credit file, which then grows as the identity keeps being used.
The business version follows the same logic. A registered LLC with a real filing, a fresh domain, a virtual office address, a phone number that answers, and a website full of generated content. Each piece checks out on its own. The fraud only shows when you look at how they fit together, or at how recently all of them appeared.
AI speeds up every part of this, from generating faces and backstories to producing the paperwork that makes the identity look established.
Match Verification to the Risk
Not every relationship needs the same scrutiny. A one-time $50 donation and a contractor who will receive recurring five-figure payments are different risks. Spend your verification effort where money moves or sensitive access is granted.
A rough tiering we recommend:
- Low risk: one-time, small, or no money flowing out. Basic checks.
- Medium risk: recurring payments, access to client or donor data, or grant disbursements. Independent verification of identity and payment details.
- High risk: large payments, any change to existing payment details, or a relationship that arrives with urgency. Full playbook, two people involved, documented decision.
The single highest-risk event for most small organizations is not onboarding a new counterparty. It is a request to change bank details for an existing one.
The Verification Playbook
Use channels you found yourself
The core rule: never verify a claim using contact information supplied alongside it. If a bank letter lists a phone number, that number connects to whoever made the letter. Look up the vendor’s number from an earlier contract, an invoice you know was genuine, or the company’s listing in an official registry, then call. If you contact the bank named on a letter, use the number on the bank’s own website, not the one on the letter, and expect that many banks won’t confirm a customer’s details to a third party. Confirmation from a known contact at the vendor matters more.
Confirm bank detail changes out-of-band
Treat any change to payment details as unverified until confirmed through a separate channel, by voice, with a person you already know at that organization. Email alone is never enough, because the email thread itself may be compromised. If the “vendor” pushes back on a verification call or insists the change is urgent, treat that as a strong warning sign.
Check official registries
For businesses, search the state’s business entity registry, usually run by the Secretary of State. Check that the legal name matches exactly, the entity is active, the formation date is consistent with the history the company claims, and the registered agent and addresses make sense. For nonprofits, the IRS Tax Exempt Organization Search shows whether an organization’s status is current. A company claiming fifteen years of experience with an entity formed last quarter needs an explanation.
Look at the domain and the details
A WHOIS or RDAP lookup shows when a domain was registered; privacy services hide the owner, not the creation date. A brand-new domain behind a supposedly established firm is a flag, as is an email domain that differs from the website by one character. Then look for inconsistencies across the package: a phone area code far from the stated address, team photos that appear on unrelated sites in a reverse image search, a bank in a different state or country than the business, or invoice metadata and formatting that don’t match earlier genuine invoices.
Require two people for new payees
No single person should be able to add a new payee or change payment details and then send money to them. One person gathers and verifies; a second reviews the evidence and approves. In a two-person office, that might be the executive director and the treasurer. This one control would have interrupted many of the payment-fraud schemes we investigate, because it breaks the isolation that social engineering depends on.
Keep a decision record
For medium- and high-risk relationships, write down what you checked, how, when, and who approved. A shared document or a simple table in Airtable or a spreadsheet works. In trust and safety work we documented the rationale behind access decisions, and the habit pays off the same way here: it makes the process repeatable, it makes skipped steps visible, and if something goes wrong, it gives your bank and law enforcement a clear timeline.
Identity-Verification Services and Their Limits
For organizations onboarding many people remotely (customers, gig workers, grant recipients), a professional identity-verification service can help. Typically these check an uploaded ID against known document formats and security features, compare it to a live selfie, and sometimes cross-reference data sources.
They are useful, and they have real limits:
- They verify a document and a face, not intent. A real person can pass identity checks and still commit fraud.
- Deepfakes and injected video are an active attack. Vendors work to detect them, but no detection is perfect, and it gets harder as generation improves.
- False rejections happen. People with older IDs, name changes, or poor cameras may fail. For nonprofits serving vulnerable populations, that can mean excluding exactly the people you exist to serve, so plan a manual fallback.
- They become a holder of sensitive data. You are sending ID images and biometrics to a third party. Vet them the way you would any vendor handling sensitive data; our due-diligence checklist for AI vendors applies directly.
Use these services as one layer in your process, never as a replacement for out-of-band confirmation of payment details.
Signs You’re Being Targeted
Patterns that should slow you down:
- A change of bank details, especially arriving by email or near a large payment.
- Urgency, secrecy, or pressure to skip your usual process.
- Reluctance to take a call, or a call that can only happen on their number.
- A package of documents that is unusually complete and polished for the size of the relationship.
- Small mismatches: a sender address one character off, a name spelled two ways, a reply that answers a question you didn’t ask.
If Money Has Already Moved
Speed matters, though recovery is never guaranteed.
- Call your bank immediately using the number on its website or your card. Ask them to attempt a recall of the payment and to flag the receiving account.
- Report to the FBI’s Internet Crime Complaint Center (IC3) at ic3.gov, with transaction details, dates, and the accounts involved.
- Preserve evidence. Keep the original emails with full headers, the documents as received, call logs, and your decision record. Don’t delete anything or confront the sender.
- Secure the channel. If a vendor’s email was used, assume either their account or yours may be compromised. Reset passwords, enable multi-factor authentication, and check for forwarding rules you didn’t create.
- Notify the real counterparty through a channel you trust, so they can warn others and check their own systems.
Our guide to AI-powered scams covers the first hours after a scam in more detail.
Getting Help
Most small organizations don’t need an elaborate fraud program. They need a short, written verification process that staff actually follow, payment controls that don’t depend on one person’s judgment, and someone to call when a request feels off. We help small businesses and nonprofits design onboarding and payment-approval workflows, vet vendors and counterparties, and investigate when something has already gone wrong. Learn about our systems work for organizations.