Test your AP defenses before attackers do

PayBreach is an accounts payable penetration testing service. We send controlled, realistic fake invoices to your AP department — via email and physical mail — to see if your team catches them before payment. Companies that successfully reject 100% of test invoices earn PayBreach Certified status.

Traditional penetration testing targets your computer networks, servers, and software. PayBreach targets the human processes and controls within your Accounts Payable department. We don't access any of your systems — we test whether your people and procedures can identify and reject fraudulent invoices delivered through normal business channels.

No. PayBreach testing is conducted exclusively via two channels: physical mail and email. We never access, log into, or interact with your computer networks, servers, databases, ERP systems, payment platforms, or any other electronic systems. No software, scripts, or network-based tools are used.

Any organization with an Accounts Payable function — from small businesses to large enterprises. If your company receives and pays invoices, your AP process can be tested and certified.

Each testing cycle includes a mix of attack scenarios: fictitious vendors, vendor impersonation with altered payment details, rush payment requests, threshold testing at various dollar amounts, and multi-channel delivery (email and physical mail simultaneously).

In white box testing, you provide your AP contacts, mailing addresses, and organizational details so we can craft targeted test invoices. In black box testing, we independently research your organization to identify AP contacts, vendor relationships, and employee names — simulating how a real attacker would approach your company. Both modes can be combined.

Testing frequency depends on your plan. Annual plans include one test per year. Quarterly plans include four tests per year. Monthly plans include 12 tests per year. Monthly Premier plans include up to 18 tests per year, sent at randomized intervals for maximum unpredictability.

That's up to you. Keep in mind the purpose is to increase awareness and diligence within your AP department, not to try to "catch" people failing. Therefore we recommend informing your team about the process, and even implementing an incentive program for when they do find a fake invoice.

No real money EVER changes hands. Test invoices contain only a URL for credit card payment, ACH or other payment types. But that URL does not have the ability to actually process any of those methods. It only collects the invoice number, and optional contact info of the payer so we can report back that the invoice payment attempt was made. No bank account numbers, routing numbers, wire instructions, or ACH details appear on any test invoice. No physical address is provided to accept payment.

PayBreach Certified is the first and only third-party credential verifying that an organization's AP department can detect and reject fraudulent invoices. It's a pass/fail standard — no partial credit.

You must reject 100% of test invoices across all attack vectors. A single invoice processed for payment constitutes a failure.

There are three tiers based on your testing frequency: Silver (annual testing), Gold (quarterly testing), and Platinum (monthly or monthly premier testing). The standard is the same at every level — 100% rejection — but higher tiers demonstrate a greater commitment to ongoing vigilance.

Certification is valid for 12 months with an active subscription.

You receive a comprehensive remediation package including copies of every test invoice (caught and missed), delivery methods and attack vectors used, a timeline of where controls broke down, root cause analysis, and prioritized recommendations. To earn certification after a failure, you must complete 6 consecutive months of successful monthly testing with zero failures.

Yes. The PayBreach website includes a public verification page where anyone can check a company's certification status using their certification serial number.

Never. PayBreach will never accept, collect, deposit, or otherwise convert any payment in connection with any test invoice. All payment details on test invoices are non-functional. When a client attempts to pay an invoice, we collect the invoice number and ask for payment type. Once the client selects the payment type, we notify the client it was a test invoice and never actually ask for any payment instrument like a credit card or ACH account. We report back to the client contact what invoice was attempted to be paid.

Test invoices include only a URL for credit card payment, ACH or Other payment methods. The URL only collects the invoice number and does not actually collect any payment information. No bank account numbers, routing numbers, wire instructions, or ACH details will ever appear on a test invoice or be requested from a client.

We offer four plans: Annual ($249/year, 1 test, Silver certification), Quarterly ($129/quarter, 4 tests, Gold certification), Monthly ($79/month, 12 tests, Platinum certification), and Monthly Premier ($99/month, up to 18 randomized tests, Platinum certification).

All plans include annual certification, a downloadable certificate and digital badge, full access to penetration test results, detailed remediation reports if any test is failed, and both white box and black box testing.

For most organizations, the Monthly plan at $79/month provides the best balance of testing frequency, certification level (Platinum), and value. Monthly Premier adds randomized timing and a higher volume of tests for organizations that want the most rigorous assessment.

Yes, you can upgrade or downgrade your plan at any time through the client portal.

Yes. Before any testing begins, an authorized representative of your organization must sign a formal Authorization Agreement. This agreement outlines the scope of testing, confirms that the signer has authority to authorize testing, and establishes the legal framework for the engagement.

Any current employee who has the authority to bind the organization and authorize third-party security testing of the AP processes. The signer certifies under penalty of perjury that they have this authority and that all required internal approvals have been obtained.

We use corporate email domain verification as one method to confirm organizational affiliation. Personal email addresses (Gmail, Outlook, Hotmail, ProtonMail, etc.) are not accepted. This helps ensure that the person requesting testing is actually affiliated with the organization being tested.

The Authorization Agreement includes strong attestation language where the signer certifies under penalty of perjury that they have authority, that all information is accurate, and that the testing is requested in good faith. The signer agrees to personal liability if any representation is false. The agreement also cites applicable federal fraud statutes (mail fraud, wire fraud, and computer fraud) as deterrents against unauthorized requests.

Yes. PayBreach testing is conducted exclusively through ordinary business communication channels (mail and email). We do not access any computer systems. The Authorization Agreement establishes clear legal authorization from the client organization before any testing begins. This is similar to how organizations authorize IT penetration testing firms — except our scope is limited to paper and email.

Yes. All test results, reports, and findings are confidential. PayBreach will not disclose your identity or test results to any third party without your prior written consent, except as required by law.

PayBreach may disclose test results and engagement details to any individual at your organization who is a current officer, director, or senior manager, provided they verify their identity through corporate credentials and hold a position of equal or greater authority than the person who originally signed up.

We collect the information needed to conduct testing: company name, AP contact information, mailing addresses, and (for white box testing) organizational details you provide. We do not access your financial systems, vendor databases, or any internal data beyond what you share with us.

Testing can typically begin within a few days of completing your Authorization Agreement and onboarding information.

No. Monthly and quarterly plans can be cancelled with 30 days' written notice. Annual plans run for the full year.

Visit our Get Started page to create an account, choose your plan, sign the Authorization Agreement, and begin the onboarding process.