Test your AP defenses before attackers do
PayBreach sends controlled, realistic fake invoices to your Accounts Payable department — by email and physical mail — to see if your team catches them before payment.
What We Do
The red team your AP department needs
We simulate real-world invoice fraud attacks on a recurring basis so you can find weaknesses before criminals do. Companies that pass earn PayBreach Certified status.
White Box Testing
You provide your AP contacts, mailing addresses, and organizational details. We craft targeted test invoices to evaluate your processing controls and employee vigilance.
Black Box Testing
We independently research your organization to identify AP contacts, vendor relationships, and employee names — simulating how a real attacker would approach your company.
PayBreach Certified
Reject 100% of our test invoices and earn the only third-party certification for AP fraud resilience. Prove to partners, auditors, and insurers that your controls work.
How It Works
From signup to certification in five steps
PayBreach integrates into your operations with minimal setup. Here's the complete process from initial engagement through ongoing protection.
Subscribe
Choose a monthly or annual plan based on your organization's size, risk profile, and testing frequency needs. Annual plans include four quarterly testing waves; monthly plans provide continuous testing.
Onboard
For white box testing, provide your AP email addresses, mailing addresses, vendor names, and employee details. For black box testing, simply authorize us to begin — we research your organization independently. Both modes can be combined.
Testing Begins
PayBreach sends realistic fake invoices through email and physical mail using a range of attack scenarios: fictitious vendors, vendor impersonation with altered payment details, invoices naming real employees as approvers, rush payment requests, and more.
Results Delivered
After each testing cycle, you receive a detailed report showing which invoices were flagged, rejected, or processed — along with a breakdown of where controls succeeded or failed and prioritized recommendations for improvement.
Certification
Reject 100% of test invoices and earn PayBreach Certified status — valid for 12 months. If any invoice is processed, you receive a comprehensive remediation report. Six consecutive months of clean results are required to earn certification after a failure.
Attack scenarios we use
Each testing cycle includes a mix of these methods, with new variations introduced over time to keep pace with evolving threats.
Fictitious Vendors
Completely fabricated companies submitting invoices for services never rendered.
Vendor Impersonation
Invoices mimicking real vendor names but with altered payment addresses or bank details.
Employee Name Drops
Invoices listing real employees as purchase approvers to exploit trust and familiarity.
Rush Requests
Urgent payment demands designed to pressure AP staff into bypassing standard controls.
Threshold Testing
Invoices at various amounts to test approval limits, duplicate detection, and routing logic.
Multi-Channel
Simultaneous delivery via email, physical mail, and PDF to test all intake channels.
The Risk
No organization is immune
Invoice fraud has hit the largest and most sophisticated organizations in the world. If they can be fooled, any company is vulnerable.
Invoice fraud is one of the most prevalent threats to corporate finance. Attackers submit fake invoices, impersonate known vendors, alter payment details, and exploit weak internal controls — often successfully.
AI tools are making fraudulent invoices more convincing and easier to produce at scale. While companies invest heavily in IT penetration testing, virtually no one stress-tests the human processes and controls within Accounts Payable.
Most organizations discover their AP vulnerabilities only after real money has been lost.
Real-world cases
Google & Facebook
$122MA single individual sent forged invoices impersonating a real supplier and collected $99M from Facebook and $23M from Google over two years before being caught.
Yale University
$40MOne employee submitted fake technology purchase invoices and drained $40M from the university before detection.
Toyota Boshoku
$37MAttackers impersonated a trusted vendor via email, changed the bank details on a routine invoice, and Toyota's AP team wired $37M without question.
City of Fort Lauderdale
$1.2MA fraudster impersonated a contractor building the city's new police station. The paperwork matched prior requests so closely that AP wired $1.2M immediately.
UK National Trust
£1MAn employee authorized 148 fake invoices submitted by his own sons posing as vendors. An audit found no evidence of any work performed.
U.S. Dept. of Defense
$624KA civilian employee created 185 fraudulent invoices from fictitious vendors over four years, using 78 different account names to hide the trail.
Certification
PayBreach Certified
The first and only third-party credential verifying that an organization's AP department can detect and reject fraudulent invoices. Three certification tiers reflect your testing commitment. A pass/fail standard at every level — no partial credit.
Silver
Annual Plan
Validates your AP controls once per year. Ideal for establishing a baseline and demonstrating due diligence to auditors and insurers.
Gold
Quarterly Plan
Demonstrates ongoing vigilance with testing four times per year. Shows partners and regulators that your organization maintains consistent AP security.
Platinum
Monthly & Monthly Premier Plans
The highest level of certification. Proves your AP department withstands continuous or unpredictable testing — the strongest signal of fraud resilience available.
How certification works
Every tier follows the same absolute standard. Pass or fail — no partial credit.
Pass — Certified
Successfully identify and reject 100% of test invoices across all attack vectors. The standard is absolute — a single invoice processed for payment constitutes a failure.
- Certification at your plan's tier (Silver, Gold, or Platinum)
- Unique certification serial number
- Customized digital badge with company name
- Formal certification certificate (.pdf)
- Status valid for 12 months with active subscription
Fail — Remediation
If any test invoice is processed for payment, certification is not awarded. Instead, you receive a comprehensive remediation package.
- Copies of every test invoice — caught and missed
- Delivery method and attack vector for each test
- Timeline of where controls broke down
- Root cause analysis for each failure
- Prioritized recommendations
- 6 consecutive clean months required for certification
Why certification matters
Third-Party Validation
Demonstrate to stakeholders, auditors, insurers, and business partners that your AP controls have been independently tested and passed.
Vendor Confidence
Share your PayBreach Certified status with vendors and partners as proof of responsible payment practices.
Insurance Advantage
Support reduced premiums on crime or fidelity insurance policies by demonstrating proactive fraud prevention.
Regulatory Alignment
Support compliance with SOX, COSO, and industry-specific financial control frameworks.
Competitive Edge
Distinguish your organization as one that takes payment integrity and financial controls seriously.
Continuous Improvement
The 6-month remediation path after failure ensures certification reflects sustained improvement, not luck.
Pricing
Simple, transparent pricing
Every plan includes annual certification, downloadable certificates and badges, full access to penetration test results, and detailed remediation reports. Frequency determines how often we test your AP defenses.
Annual
One test per year
Silver CertificationA low-cost entry point for small organizations that want to validate their AP controls and earn PayBreach Certified status without a large commitment. Ideal for companies with lower invoice volume or simpler AP operations that want annual assurance their defenses hold up.
- Annual penetration test
- Silver certification & badge
- Customized certificate (.pdf)
- Full results & remediation report
- White box & black box testing
Quarterly
Four tests per year
Gold CertificationThe right balance of cost and security for organizations that want to stay sharp without monthly overhead. Quarterly waves introduce new attack scenarios each cycle, keeping your AP team on their toes and ensuring complacency never sets in.
- Quarterly penetration tests
- Gold certification & badge
- Customized certificate (.pdf)
- Full results & remediation reports
- Escalating attack scenarios each wave
Monthly
Twelve tests per year
Platinum CertificationThe most comprehensive scheduled approach to AP security. Continuous monthly testing delivers a steady stream of reportable results and keeps your team perpetually vigilant. Also ideal for creating internal incentive programs — reward AP employees who consistently catch test invoices and build a culture where vigilance is recognized and celebrated.
- Monthly penetration tests
- Platinum certification & badge
- Customized certificate (.pdf)
- Full results & remediation reports
- Continuous reporting for auditors
- Ideal for employee incentive programs
Monthly Premier
18 tests per year — random intervals
Platinum CertificationMaximum unpredictability. Eighteen tests delivered at random intervals throughout the year mean your AP team can never predict when the next test is coming. This eliminates the possibility of heightened alertness only during expected testing windows and provides the truest measure of your organization's everyday fraud resilience.
- 18 penetration tests at random intervals
- Platinum certification & badge
- Customized certificate (.pdf)
- Full results & remediation reports
- Continuous reporting for auditors
- Unpredictable testing schedule
- Ideal for employee incentive programs
All plans include both white box and black box testing modes. Certification tier (Silver, Gold, or Platinum) is determined by your plan. Failed certifications require 6 consecutive months of clean monthly testing before recertification — the Monthly and Monthly Premier plans are the fastest path back to certified status.
Verify
Check company certification
Verify whether a company holds current PayBreach Certified status. Search by company name or certification serial number.
This is a demo. In production, certification lookups query the PayBreach database in real time.