B2b payment fraud grows after onboarding, where controls fail

At a glance

What this is: This is an analysis of how B2B payment fraud shifts into the operational layer after onboarding, with controls failing across spend, approvals, reimbursements and subscription management.

Why it matters: It matters because finance, risk and compliance teams often secure entry points but leave post-onboarding payment behaviour under-governed, which is where losses accumulate.

By the numbers:

• Organisations lose 5% of annual revenue to fraud, according to the ACFE's 2026 Report to the Nations cited by SumSub.
• The median time before fraud detection is 12 months, according to the ACFE's 2026 Report to the Nations cited by SumSub.

Context

B2B payment fraud is not just a onboarding problem. The governance gap appears after a supplier, employee, or workflow has already passed initial checks, when payments, reimbursements, subscriptions, and vendor changes begin to create new opportunities for misuse.

For IAM and identity teams, the relevant question is lifecycle control, not one-time verification. Strong KYC, KYB, UBO mapping, and sanctions screening reduce bad entrants, but they do not govern the ongoing identity and entitlement conditions that let approved parties drift into abuse.

The article's starting position is typical of modern finance operations: organisations invest heavily at the gate, then discover the real risk lives in the operational layer that follows.

Key questions

Q: What breaks when B2B payment fraud controls stop at onboarding?

A: Controls fail because they only assess initial trust, not how approved vendors, employees, or subscriptions behave later. Fraud then moves into reimbursements, duplicate payments, threshold splitting, and unauthorised spend categories. Effective defence has to govern the payment lifecycle continuously, with enforcement built into approvals and monitoring, rather than relying on a one-time verification decision.

Q: Why does post-onboarding fraud create such large losses and long detection delays?

A: Because it hides inside legitimate business workflows. Once a counterparty or user is trusted, misuse can look like normal spend for months, especially when finance, procurement, and compliance tools are disconnected. That combination lets losses build quietly until reconciliation or audit finally exposes the pattern, which is why continuous monitoring matters.

Q: What are the signs that payment fraud controls are too weak or misapplied?

A: Warning signs include rising chargeback rates, clusters of small test transactions, repeated use of the same devices or accounts, and growing false-positive declines that turn away good customers. Another clue is when disputes keep succeeding because records are incomplete or policies are unclear. A weak program often reacts late and treats every transaction the same.

Q: How should finance and identity teams share accountability for payment fraud?

A: Finance teams should own payment rules, approval logic, and exception handling, while identity and access teams help ensure those rules are tied to verified people, vendors, and roles. The key is a shared operating model where vendor changes, approver access, and transaction monitoring are correlated. Without that split ownership, fraud gaps fall between teams.

Technical breakdown

Why onboarding controls miss post-payment abuse

Onboarding checks answer a narrow question: should this counterparty or user be allowed into the payment ecosystem? They do not continuously assess how that same relationship is used once access exists. B2B fraud often emerges through approved channels such as vendor updates, reimbursement flows, SaaS purchases, and approval overrides. That makes the control problem closer to lifecycle governance than initial screening. In identity terms, the issue is not only who was verified, but whether the organisation keeps governing what that identity can do after trust is granted.

Practical implication: move from entry-only checks to continuous governance of payment permissions and entitlements.

How operational drift turns approved spend into fraud

Operational drift happens when legitimate business processes accumulate exceptions, duplicate vendors, threshold splitting, shadow subscriptions, or unauthorised spend categories. Each change may look small in isolation, but together they expand the attack surface without triggering a classic fraud alert. This is especially true when finance, procurement, and compliance data are disconnected. The article's point is that fraud can exploit normal business behaviour, not just malicious compromise, so detection has to track how approved spend changes over time, not only whether a transaction is individually valid.

Practical implication: correlate approvals, vendor master data, and transaction activity in one control view.

Why policy fails without enforcement in payment workflows

Written policy only works if it is embedded into the payment path. If controls sit in a spreadsheet, a manual review queue, or a reconciliation process, they arrive too late to stop the transaction. Enforcement means the workflow itself checks thresholds, flags duplicate vendors, blocks suspicious categories, and routes exceptions before money moves. That is a governance design issue, not a fraud-team-only issue. In practice, the organisation needs control points inside the operational layer, where the payment decision is actually made.

Practical implication: place preventative checks in payment infrastructure, not only in post-transaction review.

Threat narrative

Attacker objective: The objective is to extract value through authorised-looking payment activity that avoids immediate challenge until the losses are already material.

1. Entry occurs after onboarding, when a legitimate vendor, employee, or subscription relationship has already been trusted into the payment environment.
2. Abuse begins through spend behaviour, approval workflows, reimbursements, duplicate payments, or SaaS purchases that bypass normal scrutiny.
3. Impact is financial loss that can accumulate for months before detection, especially when monitoring is fragmented across finance and risk teams.

Breaches seen in the wild

• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Post-onboarding fraud is a lifecycle governance failure, not a verification failure. Initial screening can remove many high-risk actors, but it does not govern what approved parties do once they are inside the payment stack. That is why reimbursement abuse, duplicate vendor payments, and SaaS sprawl keep recurring. The discipline needed here is continuous entitlement oversight across finance operations, not a one-time trust decision.

Shared identity and payment visibility is the named control gap: disconnected tools let approved identities, vendor records, and payment events drift apart until fraud is visible only at reconciliation. When identity verification, transaction monitoring, and operational approvals do not sit in a shared layer, the organisation loses the ability to spot abnormal spend patterns early. Practitioners should treat cross-system correlation as a governance requirement, not a reporting convenience.

Shadow AI spend is becoming a new fraud-adjacent control surface. The article's mention of unauthorized categories extends beyond classic procurement abuse into unmanaged AI-related spend, which often appears first in shadow subscriptions or unapproved service usage. That creates a governance bridge between identity, finance, and emerging technology oversight. Practitioners need to classify AI-related purchasing as part of spend governance, not as a separate technology issue.

The most effective control model is preventative, not retrospective. Reconciliation still matters, but it is too late to be the primary defence. Organisations should push policy into workflow enforcement, because operational abuse usually exploits a valid process rather than a broken login. That means finance and identity teams must share ownership of approvals, vendor changes, and exception handling.

In Latin America and similar growth markets, the risk is amplified by scale and fragmentation. Rapid expansion, distributed teams, and mixed payment channels make it easier for misuse to blend into normal activity. The article's LATAM lens shows that fraud governance cannot be imported as a pure headquarters control model. Practitioners need localised monitoring, clear ownership, and lifecycle controls that match how payment activity actually moves.

What this signals

Post-onboarding fraud is really a lifecycle control problem. The organisation has already accepted the counterparty, so the remaining risk sits in how approvals, reimbursements, vendor changes, and recurring spend are governed over time. That shifts the security question from who may enter to what they may continue doing once trusted.

Connected oversight is now the differentiator. Teams that align payment operations, identity signals, and monitoring can see abnormal spend as a pattern rather than a set of isolated exceptions. That is the practical difference between catching fraud at review time and preventing it at decision time.

For practitioners

• Embed controls into payment workflows Block or route exceptions before money moves by enforcing thresholds, vendor change checks, and approval routing inside the payment path.
• Correlate identity and transaction data Join vendor records, approver identity, reimbursement history, and transaction events so suspicious spend patterns can be detected in context.
• Monitor for recurring fraud patterns Watch for threshold splitting, duplicate vendors, unauthorised spend categories, shadow subscriptions, and repeated reimbursement anomalies.
• Treat subscription sprawl as a control issue Inventory SaaS and other recurring services, then assign ownership so unapproved renewals and duplicate services do not drift into spend.

Key takeaways

• B2B payment fraud often exploits trusted relationships and routine finance processes rather than initial onboarding failures.
• The main risk is slow accumulation, with losses building in spend, approvals, reimbursements, and subscriptions before anyone notices.
• The strongest control shift is from retrospective reconciliation to enforced, lifecycle-based monitoring inside the payment workflow.

Key terms

• Post-Onboarding Fraud: Fraud that occurs after a user has already passed initial identity checks and gained access to an account or service. It often shows up at login, password reset, or payment moments, when attackers can exploit an already trusted session. Controls must therefore extend beyond onboarding and into ongoing risk evaluation.
• Spend behaviour: The pattern of how money moves through an organisation after onboarding, including thresholds, categories, frequency, and approval paths. In fraud governance, spend behaviour matters because unusual patterns often reveal abuse earlier than a single suspicious transaction does.
• Lifecycle Risk: Lifecycle risk is the security and operational exposure created when assets move beyond their supported state or near the end of useful life. It is not limited to patching gaps. It also includes replacement delays, weak ownership, dependency constraints, and the inability to justify tradeoffs when support has expired.
• Shadow AI Spend: Unapproved or fragmented AI usage across teams that creates duplicate purchases, hidden risk, and poor cost visibility. It usually emerges when central controls are slow or unclear. Shadow AI also expands the attack surface because sensitive prompts and data can leave intended boundaries without security oversight.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and identity lifecycle control. It helps practitioners connect lifecycle governance to the broader security programme they run every day.