Fake Vendors

Criminals establish and maintain fictitious supplier or service provider accounts to channel illicit funds, issuing invoices for non-existent goods or services. By blending these sham transactions with legitimate business expenses, they hide the true source of funds and make detection less likely. Weak vetting processes and minimal documentation requirements are exploited, enabling illegal outflows to appear as ordinary operating costs. Some networks repeatedly rely on the same shell-company vendors or specialized platforms to systematize misinvoicing and mask fund movements. In many cases, the invoices refer to goods or services that never existed or were never delivered. Fraudulent payments can also be partially refunded in cash or diverted for bribery purposes, further complicating the paper trail.

[
Code
T0022
]
[
Name
Fake Vendors
]
[
Version
1.0
]
[
Parent Technique
]
[
Tactics
]
[
Risk
Customer Risk, Internal Risk
]
[
Created
2025-02-10
]
[
Modified
2025-04-02
]

Dummy Vendors

Bogus Vendors

Fabrication of Suppliers

Tactics

ML.TA0007
|
|

Fictitious vendor accounts generate sham invoices and payment flows, introducing multiple transactional layers that obscure the true origin of illicit funds. By mixing these fake expenses with legitimate business outlays, criminals complicate the money trail and impede detection.

Risks

RS0001
|
Customer Risk
|

This technique exploits vulnerabilities associated with fictitious or unverified vendor identities and beneficial ownership structures. Criminals create sham supplier accounts that distort the customer’s risk profile and hinder effective due diligence, as financial institutions cannot easily ascertain the legitimacy of these purported vendors or their controlling parties. This is the primary vulnerability enabling the laundering process through fraudulent invoices and payments masquerading as ordinary business expenditures.

RS0005
|
Internal Risk
|

Criminals systematically exploit weak vetting processes and minimal documentation requirements within institutions, allowing fake vendors to pass basic checks and appear as legitimate suppliers. The inadequate internal controls and oversight make it easier to approve sham invoices without proper scrutiny, enabling illicit funds to flow under the guise of normal operating expenses. This distinct operational weakness complements the primary customer identity vulnerability.

Indicators

IND01343
|

Vendor account registrations with unverifiable details, such as non-existent addresses, generic phone numbers, or invalid business registration data, consistent with a fictitious supplier setup.

IND01344
|

Invoices for goods or services with no corresponding purchase orders, shipping records, or delivery receipts, consistent with fictitious transactions.

IND01345
|

Multiple invoices from the same vendor featuring round-figure amounts or amounts deviating significantly from typical market rates, consistent with fabricated invoicing.

IND01346
|

Discrepancies between vendor registration information and official business registries, such as inconsistent tax or registration numbers, indicating fraudulent vendor identity.

IND01347
|

Rapid creation and activation of vendor accounts, followed immediately by invoice submissions with no prior business history, consistent with intentional fake vendor setup.

IND01348
|

Vendor bank account details that match or are linked to high-risk or previously flagged entities indicate a direct association with known illicit networks.

IND01349
|

Recurring patterns in invoice numbering or formatting that deviate from industry norms reflect automated or fraudulent invoice generation associated with a fake vendor.

IND01350
|

A high frequency of invoice issuances from a vendor, not aligned with realistic procurement cycles or actual business needs, reflects potential fake vendor activity.

IND01351
|

Invoices approved and processed without rigorous cross-verification against delivery or goods receipt documents reflect bypassed controls in handling fake vendor transactions.

IND01352
|

Invoiced amounts that are significantly misaligned with prevailing market prices for the stated goods or services reflect deliberate manipulation of invoice values.

IND01353
|

Frequent partial refunds in cash or to personal accounts shortly after invoice payments, lacking official justification or supporting documentation, indicating diversion for bribery or illicit gain.

Data Sources

  • Records vendor account openings, profile changes, and associated logins with timestamps.
  • Reveals suspiciously rapid vendor account creation followed by immediate invoice submissions, indicative of a fake vendor operation.

Comprehensive financial statements, tax returns, and related filings demonstrate a vendor’s operational legitimacy. Cross-referencing reported business income, expenses, and tax liabilities helps uncover vendors with no genuine operational footprint, indicating a likely fake vendor setup.

  • Provides invoice details, such as invoice numbers, amounts, references to goods/services, and contract terms.
  • Supports the detection of fictitious invoices by identifying missing purchase orders, nonexistent delivery records, or other discrepancies that reveal fake vendor transactions.
  • Provides comprehensive records of invoice payments, refunds, and other fund movements with timestamps and counterparties.
  • Uncovers partial refunds or suspicious redirections of funds soon after invoice settlement, aligning with bribery or fraudulent kickback schemes typical of fake vendors.
  • Includes operational metrics, procurement cycles, staffing levels, and other core business data.
  • Allows comparison of claimed vendor activity against realistic operational patterns, helping to identify anomalies consistent with fake vendor usage.
DS0033
|
|
  • Compiles lists of flagged or blacklisted entities, accounts, and addresses linked to suspicious or illicit activities.
  • Helps identify vendor bank details matching known fraud or sanction databases, suggesting potential fake vendor involvement.
  • Contains verified identity details, business registration documents, addresses, and beneficial ownership information.
  • Enables thorough cross-checking of vendor-submitted data for inconsistencies or fabricated details, helping identify fictitious suppliers posing as legitimate vendors.
  • Maintains official records of business registration, beneficial ownership, directors, and shareholders.
  • Facilitates cross-referencing vendor claims to identify inconsistencies or fraudulent registrations typical of fake or shell companies used as vendors.

Mitigations

Implement targeted rules and analytics to identify suspicious vendor-related payments, such as multiple or round-figure invoices from newly established vendors, partial cash refunds soon after invoice payments, or frequent payments not tied to legitimate purchase orders or delivery records. Cross-reference invoice details with known procurement cycles and historical vendor patterns to detect fabricated transactions and potential bribery kickbacks.

Implement a robust vendor onboarding and oversight program that requires formal verification of business activities, proof of ownership, references, and frequent performance reviews. Periodically audit vendor accounts to ensure they are not mere shell entities issuing sham invoices for money laundering purposes.

Hold vendor payment amounts in an escrow account until confirmation of actual goods delivered or services rendered. Require verifiable proof of delivery or service completion before releasing funds to prevent fraudsters from disbursing payments tied to falsified invoices.

Cross-check vendor identities, addresses, tax registration numbers, and corporate details through official registries, third-party databases, and open-source intelligence. Validate claims of business operations, confirm the existence of employees, and detect anomalies indicating a fictitious or misleading vendor profile.

Scrutinize trade-related documentation (e.g., shipping records, customs declarations) alongside invoices to detect mismatches, nonexistent shipments, or discrepancies in pricing and quantities. By verifying the physical movement of goods, institutions can pinpoint fraudulent invoicing or phony service claims tied to fake vendors.

Instruments

  • Fictitious vendor entities open or register business bank accounts to receive payments for sham invoices.
  • By blending these transactions with legitimate outflows, criminals disguise the origin and destination of illicit funds, making ordinary operating expenses appear valid on the books.
  • The ability to commingle lawful and unlawful payments within one account compounds tracing difficulties for financial institutions.
  • Criminals issue invoices for goods or services never delivered, creating artificial accounts receivable payable to the fake vendor.
  • These false invoices are recorded as standard business expenses, seamlessly introducing illicit proceeds into the company’s financial records.
  • Minimal verification of delivered goods or services enables repeated manipulation of invoice details to funnel and legitimize illegal funds.
IN0051
|
|
  • Once payments reach the fake vendor’s account, part of the funds can be withdrawn and handed out in physical currency.
  • The use of cash for partial refunds, bribes, or kickbacks obscures the financial trail by eliminating electronic records of fund flows.
  • This anonymity and difficulty in tracing cash transactions enhance the effectiveness of the fake vendor laundering process.

Service & Products

  • Criminals systematically create and track fake invoices for non-existent goods or services, exploiting weak verification procedures to pass them off as legitimate business expenses.
  • These platforms help incorporate fraudulent transactions into corporate accounting, blending illicit funds with legitimate payments and masking the source of the money.
  • Fraudsters route funds to fictitious vendors under the guise of normal operating expenses, making the payments appear routine in financial records.
  • Partial or disguised refunds can be issued to further obscure the paper trail, facilitating bribery or siphoning of funds back to conspirators.
  • Criminals open or register accounts in the name of sham vendors, receiving payments for false invoices.
  • These accounts appear legitimate, enabling fraudsters to mingle illegal proceeds with everyday business transactions and complicating detection.

Actors

Illicit operators create and maintain fictitious vendor accounts to route illicit proceeds through fraudulent invoices. They:

  • Pull funds out of legitimate businesses by issuing invoices for nonexistent goods or services, disguising payments as ordinary expenses.
  • Exploit weak documentation checks so that financial institutions cannot easily distinguish these sham flows from normal outlays.

This manipulation of invoice records hinders effective due diligence and conceals the true origin of the funds.

Shell or front companies operate as fake suppliers or service providers, issuing bogus invoices to launder illicit funds. They:

  • Present themselves as legitimate vendors, allowing criminals to blend sham invoices with genuine business costs.
  • Conceal beneficial ownership and lack real economic activity, making it difficult for financial institutions to verify vendor authenticity.

Repeated use of these shell vendor accounts systematically obscures the source and destination of illicit proceeds, complicating transaction monitoring and detection efforts.

References

  1. APG (Asia/Pacific Group on Money Laundering). (2017, July). APG Yearly Typologies Report 2017. Asia/Pacific Group on Money Laundering. https://apgml.org/methods-and-trends/documents/default.aspx?pcPage=

  2. Financial Action Task Force (FATF). (2007). Laundering the proceeds of VAT carousel fraud. FATF/OECD. https://www.fatf-gafi.org/en/publications/Methodsandtrends/Launderingtheproceedsofvatcarouselfraudreport.html

  3. Stack, G. (2023). Baltic shells: on the mechanics of trade-based money-laundering in the former Soviet space. Journal of Money Laundering Control, Vol. 18 No. 1, pp. 81-98. https://doi.org/10.1108/JMLC-10-2013-0040