A payment process that looked “automated enough” turned into a $50 million logistics company’s worst nightmare.
They were using Microsoft Dynamics ERP and a bill pay provider to manage payments. But when an urgent vendor request came in before a holiday weekend, their team skipped one step in their internal verification process. The result? They updated the wrong bank account and unknowingly sent funds directly to a fraudster.
ACH payments can’t be recalled, and the money was gone.
This wasn’t just a FAIL. It was a wake-up call.
Bill Pay vs. Fully-Managed Payments Solution for Microsoft Dynamics ERP
The company assumed their current provider was protecting them. But the truth is, many bill pay services don’t manage vendor bank data or take on liability. That work still falls on the internal finance team, along with all the risk.
That’s what makes different.
In this One Fail One Fix interview from Corpay explains how their team took over vendor onboarding, bank verification, payment method selection, and execution and accepted full liability for fraud prevention.
With four layers of human verification, API integration into Microsoft Dynamics, and a massive network of pre-validated vendors, Corpay transformed this company’s payment process from vulnerable to secure.
Once Corpay was in place, the company saw immediate and measurable improvements:
- No more internal management of ACH changes
- Liability shifted from the internal team to Corpay
- Virtual card usage increased from 12% to 28%
- Rebate revenue nearly doubled, from $50K to $100K/year
Want to avoid the same fail?
Tiffany also shares two key questions every finance team should ask when evaluating payment automation tools, especially those using Microsoft Dynamics ERP.
Watch the full 10-minute interview to hear the full story.
Video Transcription “Corpay Changes the Game for Microsoft Dynamics ERP Company Hit By ACH Fraud”
Anya Ciecierski, ERP Software Blog:
Welcome to "One Fail, One Fix." Today, we are talking about a very scary topic, ACH fraud.
A $50 million transportation and logistics company using Microsoft Dynamics ERP already had a payment processing tool they thought was protecting them, but were shocked and appalled to find out they were victims of ACH fraud.
Tiffany Allen from Corpay, tell us a little bit more about the scary situation.
Tiffany Allen, Corpay:
The scary part here is that more people are in the same exact scenario. They've invested in a program that they think is going to support them in the fraud space as it relates to B2B payments, and that's truly not the case.
There are definitely varying levels of payment automation providers out there, and this particular client thought they were covered 100%.
In this situation, they were still managing the ACH information from each of their vendors directly within their ERP, so they definitely had steps in place that, when they got a notification, "Okay, we need to follow X, Y, Z steps before we update the ACH information."
But that's the problem. It's within their four walls that they had to manage that. That is amongst all their other responsibilities and duties, right?
They then needed to follow a three- or four-step process, which did not include calling the number that they keep within the ERP to verify with the finance team, "Did you really update the ACH information?"
It happened right before a holiday weekend.
They got an urgent email that they were going to stop work on a project, because they had failed to receive payment.
"Here's our updated ACH payment. We need to receive payment before end of day."
They did two of the four steps that they had cataloged for their organization to update the ACH information, thought it was good enough, did not want the project halted, and went ahead and updated the ACH.
They processed that payment, absolutely. When I say they processed that payment, apologies, they went ahead and forwarded that payment on to their payment provider, right?
"Look, we need to get this payment done on rush."
Payment was made by the payment provider.
And an ACH, you can't call back at all. Once it's done, that fraudster can pull that money out of that account immediately.
There's no recourse. You can't put a stop payment on it, you can't cancel the card number.
They have zero recourse. No one has any recourse on the ACH side of things.
So a week later, when they get a call from that provider saying, "Hey, we're going to have to stop your project," they're like, "Wait a minute, we paid that!"
And that's where they found out they were a victim of fraud.
And the scary part here is the FBI has agencies, obviously, to support the amount of business-to-business fraud that we're seeing within the space. And it was reported in 2023, that there was $173 million of fraud for virtual card and check.
But, Anya, for ACH it was 2.9 billion, 2.9 billion! ()
So when people are worried and concerned about check fraud, that's not your worry anymore, it's truly ACH, and that's where we need to do a better job in the "One Fail, One Fix" of educating people and finance teams that you really do have to have a fully-managed payment process end-to-end, 100%.
Anya Ciecierski, ERP Software Blog:
Shocking statistics, I never would've thought of that.
Anya Ciecierski, ERP Software Blog:
So tell us, Tiffany, I know there is one, what is the fix for this fail?
Tiffany Allen, Corpay:
The fix here is, this is a fabulous story, one of our Microsoft partners introduced us to this organization, and said, "Hey, Tiff, they're working with the current automation provider, they're doing both invoice automation as well as payment automation with them. How and why were they a victim of ACH fraud?"
And we quickly defined for them that there are bill pay providers in our space that are simply going to draw funds off of their accounts and make payments on their behalf.
They may take the ACH and the virtual card, but they won't do the check, and because it's kind of a disparate system, they're still required to do all that vendor maintenance, all that vendor management, all the onboarding if you have an update in an ACH or you want to move to the virtual card, they were responsible for collecting that information.
When you use a fully-managed payment provider, such as Corpay we take on 100% of that responsibility. But we also take on the liability, and that's the wild part, right?
That's the part that we really have to do a better job of educating the finance community on, is that you truly can limit your amount of liability and risk in this space when you look at an end-to-end, holistic, fully-managed process.
So the way we work is, within your ERP, in this instance, Microsoft, they say, "Hey, this is the payment batch for the week. This is who we're going to pay."
They transmit a single file. When I say they transmit, they approve it, and it automatically, because of our API integration, comes into Corpay, and we decide how to pay each of those vendors. We maintain all of the ACH information, and we have not just software, but we also have a team of over 1,000 payment providers in our space that are managing those vendor accounts.
So for us, the protocols are, obviously, we have software to catch what we consider potential fraudulent payments, but we also use people. We never change any ACH information without four different human verification levels, one of which is actually calling and talking to the vendor, based on the number we maintain on file, not the number in the email, because you have to think these fraudsters are getting smarter and smarter.
Business email compromise is how the fraud is happening. They're lying in wait within your email system. They are the ones sending an email that looks like it's coming from your organization, but instead of it being Corpay, it might be Corpoy, an O at the end versus an A.
You think it's the right organization that you're communicating with. They're just leveraging some very small, minute details to, you know, allow you to fall victim to fraud.
Anya Ciecierski, ERP Software Blog:
Very interesting. So this specific company, in addition to getting them more secure with the fraud, what other quantifiable results did they get from using Corpay?
Tiffany Allen, Corpay:
I know you were shocked by the amount of ACH fraud that's out there, but I hope I get to shock you here too, Anya, as well.
So one of the greatest parts about the payment automation piece is that the most secure method of making a payment is by a virtual card, and I will explain that, because not everybody understands what that is.
It's a unique 16-digit card that is sent to the vendor for the payment, and it is sent for the exact amount of the payment. So their payment might be summing up four invoices that total $282.33, that's the exact amount that the card has to be processed for, not a penny more, not a penny less.
But we are using a card, and just as you have rewards and points with your cards in your back pocket, we issue rewards to our customers as well for leveraging that card.
So there is interchange that is available there, so they're going to get rewards for any portion that we transition to the virtual card.
In this instance, this customer was leveraging more of a bill pay provider,
and they did great. They did move a portion of their customers to the more secure method,
or they did move a portion of their vendors to a more secure payment method, virtual card, 12%.
We analyzed all of their vendor spend over the year, and we knew, immediately upon taking on their account, we could move that 12% to 28%.
Why? We've been around for over 50 years. We have the largest vendor network, we have 4 million vendors in our network, we are already verified to pay 600,000 of those vendors by virtual card. So not only did they adopt a more secure, less risky, we're taking on the liability for making those payments, solution, but they also were able to generate almost $100,000 in rebate versus just over $50k with their prior provider.
We almost doubled the amount of rebate that they're earning on an annual basis.
Anya Ciecierski, ERP Software Blog:
I am very impressed. Thank you very much for sharing that story with us, Tiffany. There are some great takeaways from that.
And what would be your advice to people who are maybe in the situation of looking for a payments provider, or have been victims of ACH fraud?
Tiffany Allen, Corpay:
Great question. My first suggestion is, obviously, do your research and investigate those players.
If you're looking to automate your solution, there are huge benefits to looking at it end to end.
Don't just think about the invoice, think about the payment piece as well.
And ask questions.
"Who maintains the ACH information? Will it continue to be my finance team, or are you all maintaining that?
And also, when funds are leveraged to make payment, are you doing that from my bank account or are you doing that on your bank account, obviously through an FBO-type relationship?"
That would be the key criteria.
That's really where you're going to be able to identify if this is a more secure payment automation path.
Rebates are going to be available, not as much, obviously, as we just highlighted here.
Rebates are going to be there. Don't get overwhelmed and excited by the rebates.
Continue to do the research on how those funds are being transmitted and how securely they're going to keep your information.
Next Step? Book a call with Tiffany Allen:
By Anya Ciecierski, ERP/CRM Software Blog Editor, www.erpsoftwareblog.com
