Home · Solutions · Finance & accounting
Solution · Finance & accountingA supplier's bank account changes in SAP only after the registers and a phone call agree
Vendor master changes with bank-account fraud control
Every new or changed supplier bank account is checked against official registers, confirmed by a call-back to a known number and approved by a second person before a robot updates SAP.
Executive summary
One convincing email is all it takes to send a six-figure payment to a fraudster's account.
Mientha maintains vendor master data for clients in its Business Process Outsourcing practice.
Every new or changed bank account carries a register confirmation and a recorded call-back before it can be paid.
SAP S/4HANA supplier master; SharePoint request register and evidence library
Business problem
Master data & fraud control
Suppliers merge, switch banks and move offices; a company with a few thousand vendors edits hundreds of master records a month, each requested by email, each typed into SAP. The bank account is the one field that moves money, and it is edited with the same routine as an address.
Payment-diversion fraud lives on that routine. The attacker sends a plausible email from a look-alike domain or a compromised supplier mailbox, attaches a letter, and answers the phone number in the signature. The FBI's Internet Crime Complaint Center logged 21,442 business email compromise complaints and USD 2.77 billion of reported losses for 2024.
The master data team is blamed for a control nobody defined; the treasurer pays twice; the CFO explains the write-off. In Poland, payments of PLN 15,000 or more to an account outside the VAT taxpayer list add tax consequences of their own. And three people cannot call back 65 suppliers a month, so they call only when something feels wrong, which is the judgement a fraudulent email is written to pass.
How it works today
- PersonA supplier or buyer emails the shared mailbox: new bank details, sometimes a letter as proof
- WaitingThe request waits three to seven working days while the supplier chases the buyer in Teams
- PersonThe clerk retypes the IBAN from the attachment into SAP
- Risk of errorThe VAT list is checked when someone remembers; a call-back, if any, goes to the number in the email signature
- SystemThe team lead confirms sensitive fields in SAP in a Friday batch, without seeing the request
- PersonThe email is the only evidence; the change document records who saved, not who verified
- Risk of errorNobody counts how many accounts changed or were checked; the first sign of a diverted payment is a dunning letter
Why the current process costs more than it appears
Behind every exception is an hour nobody logged.
- Every change hides an investigation no timesheet records: which company code, which of three suppliers with the same name, is the requester genuine.
- A control applied when someone has time is, for auditor and fraudster alike, a control that does not exist.
- A supplier updated too late is paid to the old account; the reconciliation costs more than the change.
- In Poland a payment of PLN 15,000 or more to an unlisted account can cost the tax deduction and bring joint VAT liability.
- A diverted payment is rarely recovered: the company pays the fraudster, then the real supplier, then spends months with the bank and the insurer.
Cost of inaction
Nobody touches this process for years, precisely because the handling cost is modest. The tail event changes the picture: one payment run to a larger supplier, modelled at €120,000, diverted once, costs as much as two and a half years of the team's handling, and the real supplier still has to be paid. Nothing in the current process would catch it.
Meanwhile late payments, unlisted-account tax exposure and the same audit finding return every year.
A plausible organisation with realistic proportions. The figures are there to be recalculated on your data; they are not a client result.
European FMCG producer, three countries, about 6,000 active vendors, SAP S/4HANA, Microsoft 365 E3; a team of three maintains supplier master data.
About 450 master-data changes a month across three company codes, roughly 65 of them bank accounts; most come from buyers by email.
Requests are worked from the shared mailbox in the order of who chases loudest; the clerk edits SAP from the attachment; bank fields are confirmed in a Friday batch; nothing is recorded.
About 20 minutes of handling per change, spread over three to seven working days; no independent call-back, no register of changes, no audit evidence.
A form in Teams; a robot checks the new data against SAP, the VAT taxpayer list, VIES and the vendor base; a second person calls the number on file; the master data lead approves; only then does the robot update SAP.
In the modelled case, human time per bank-account change falls to about five minutes, every such change carries a register confirmation and a recorded call-back, and cycle time drops to the next working day. Everything here is modelling; we have measured none of it at a client.
Proposed solution
Mientha maintains vendor master data for clients in its Business Process Outsourcing practice; this control model comes from people who handle such requests daily. The principle: no bank-account field in SAP changes on the strength of an email.
Requests enter through a Microsoft Forms form in Teams; a Power Automate flow with standard connectors writes each response to a SharePoint list that starts the UiPath job. The robot reads the supplier's current SAP record and runs deterministic rules: the VAT taxpayer list for the account and tax number, VIES for the EU VAT number, IBAN checksum and bank country, the same IBAN on another vendor, the requester's domain against the one on file.
A call-back task in UiPath Action Center goes to someone who is neither requester nor approver and shows the phone number on file before the request, never the number from the email. A positive call-back releases the four-eyes approval to the master data lead, both tasks completed in Teams; a failed check or call-back rejects the request and posts it to the control channel. After approval the robot applies the change in SAP and files the evidence pack on SharePoint. New suppliers follow the same path plus a duplicate check by tax number, IBAN and name.
UiPath Orchestrator queues; UiPath Action Center App tasks with assignment, due dates and actionable notifications in Microsoft Teams; UiPath Integration Service connectors for Microsoft OneDrive & SharePoint, Microsoft Teams, Microsoft Outlook 365 and SAP; Microsoft Forms with its Power Automate trigger; SharePoint with Microsoft Purview retention labels
Request form and register, rule set, call-back and approval action apps with assignment logic, SAP read and update workflows, evidence pack, control channel posts, monthly control report, runbook
Polish VAT taxpayer list (wl-api.mf.gov.pl API or daily flat file); VIES SOAP web service (checkVat, checkVatApprox); national business registers with a machine interface; SAP GUI automation as a fallback for older releases
How the automated process works
- AutomationA form response (or an email converted into one) creates a request in the SharePoint list and Orchestrator queues it
- SystemThe robot reads the supplier's current SAP record: bank details, tax number, country, phone number on file
- AutomationChecks run against the VAT taxpayer list, VIES, IBAN rules, duplicates and requester domain; results go into the case
- PersonA call-back task appears in Teams for a second person, pre-filled with the number on file; they call and record the outcome
- PersonThe master data lead approves or rejects in Teams, with the check results and call-back record in the task
- AutomationOn approval the robot updates SAP, captures the change document number and files the evidence pack on SharePoint
- AutomationRejected cases go to the control channel with the reason; confirmations reach requester and supplier through the known channel
Human-in-the-loop model
Automation handles
- Intake and case creation; nothing moves outside the form
- Every lookup and comparison: SAP record, registers, IBAN rules, duplicates, domains
- Task assignment so that requester, verifier and approver are three different people
- The SAP update, the evidence pack, the confirmations and the monthly report
People decide
- Whether the supplier on the phone confirms the change
- Whether to approve, with all check results visible
- What happens to a rejected case: escalate or close
- The rules: registers per country, thresholds, who may verify and approve
Before and after
Systems and integrations
We do not add technology to make an architecture look serious. Every element below has a specific job in this process.
Inputs
- Microsoft Forms request in Teams
- shared mailbox for legacy requests
- SAP supplier record
- Polish VAT taxpayer list
- VIES
- national business registers
Automation layer
- UiPath Orchestrator
- UiPath Robots
- UiPath Integration Service
- UiPath Action Center
- Power Automate cloud flow
Target systems
- SAP S/4HANA supplier master
- SharePoint request register and evidence library
Human touchpoints: call-back task in Teams; approval task in Teams; vendor master control channel in Teams; confirmation emails
Technologies used
queue each request, run the checks, update SAP, log and audit
Acall-back and approval tasks with fields, assignment, due dates, audit
Arequest-list trigger, evidence library, SAP read and update, control channel posts
Arequest form in Teams; a cloud flow writes responses to the SharePoint list
Asource of the record before the change, target of the approved change
Aconfirms that the new account belongs to the supplier's tax number on the query date
Bvalidates EU VAT numbers; the request identifier is stored as proof
BIllustrative economic model
What it is worth, with the arithmetic shown.
Nothing here comes from a client; the ranges are typical of shared-services centres. Twenty minutes per change covers typing, lookups and chasing; €26 is a fully loaded hourly cost for a master-data role in Central Europe. The table values today's handling; the target flow still needs a few human minutes per change, and the fraud exposure is not in the table.
Run the numbers on your data
An illustrative estimate from your own inputs. It models released capacity; it is not a promise of savings.
Business benefits
- Every new or changed bank account carries a register confirmation and a recorded call-back before it can be paid
- A diversion attempt is stopped at the call-back or register check and becomes a documented event
- Changes complete by the next working day, so payment runs use the right account
- Polish payments to unlisted accounts are blocked for the whole supplier base
- Human effort per bank-account change falls from about twenty minutes to about five
- The auditor gets one evidence pack per change: names, timestamps, register references, SAP change document
The management view
- One register of every change: who asked, what changed, who verified, who approved, how long it took
- Segregation of duties enforced by the flow; the robot cannot approve
- The monthly control report gives the CFO and internal audit a number instead of an assumption
- New company codes and countries join with a rule change, not new people
Board-level KPIs
Security and governance
Security is designed with the process, not after it.
- In SAP the robot may maintain supplier master data and nothing else, with no payment rights; its password never appears in a workflow and is read at run time from the Orchestrator credential store or Azure Key Vault
- Requester, verifier and approver are always three different people; assignment reads Microsoft Entra ID groups owned by finance
- Nothing crosses the tenant boundary: evidence packs and reports sit in your Microsoft 365 tenant under a Purview retention label, and Orchestrator with its logs stays in the EU region of UiPath Automation Cloud
- Bank details of sole traders are personal data: Teams notifications show only the last digits of an account; the evidence library is restricted to master data and audit
- Rules are versioned, changed only with finance sign-off; no AI sits in the decision path
Why now
Handling costs the modelled €3,900 a month; the exposure is the €120,000 payment run, and the control costs a fraction of the first event prevented
The FBI's Internet Crime Complaint Center reported USD 2.77 billion of business email compromise losses for 2024; in Poland payments of PLN 15,000 or more to unlisted accounts are a tax risk
The registers have machine interfaces (VAT taxpayer list API and flat file, VIES web service), Action Center tasks complete in Teams, and UiPath's SAP connectors update the supplier master
Relevant executive roles
A diverted payment is a write-off, a double payment and a board conversation; this turns a hoped-for control into a documented one.
The team gets a queue with due dates, assignment rules and evidence instead of being the last line of defence.
Buyers stay the entry point for supplier requests without deciding whether a bank account is genuine.
Register checks and SAP updates run through standard interfaces and a service account, not through clerks with wide roles.
Common questions and objections
SAP's confirmation proves that a second user pressed a button; it checks no register and forces no call to an independent number. This flow adds those steps and the evidence.
The only new step for the supplier is a call from your team to a number they gave you earlier; legitimate suppliers expect it; their banks do the same. Their change then takes a day instead of a week.
The call-back is the one step where a person talks to a person on a channel the attacker does not control; automating it removes the control. A model gives a probability, a register gives a fact.
When this is not the right solution
- A single company code with a few dozen changes a month, where a written procedure and a strict call-back rule can be run by hand
- A vendor base dominated by suppliers outside the EU, where public registers give no answer
- No reliable phone numbers on file; a cleanse comes first, because a call-back to an unverified number proves nothing
A question for the next management meeting
Who in our company can change a supplier's bank account today, who checks it against what, and what evidence could we show the auditor for the last fifty changes?
Implementation approach
What we deliver, and what we need from you to start.
We deliver
- A change-history review covering your last three months: types, requesters, countries, verification done
- Control design: checks per country, call-back rule, assignment logic, approval authority
- Form, register, evidence library and control channel in your Microsoft 365 tenant
- Robots for SAP read and update, register integrations, rules and the monthly report; Action Center apps for call-back and approval in Teams
- Pilot on one company code, then rollout with hypercare and a runbook
We need from you
- Three months of SAP change documents for the supplier master and the matching request emails
- A process owner in master data, an approver in finance, a contact in internal audit
- Technical accounts for SAP test and production limited to supplier master maintenance
Stages
Discovery
Change history, request channels, verification habits, registers in scope
Design
Control sequence, rules, task assignment, approval authority, security model
Build and validation
Form, register, robots, integrations, Teams tasks; replay of historical changes and planted fraudulent requests
Go-live
One company code first, hypercare, then rule tuning and new countries
Departmental. Effort depends on the countries and registers in scope, the SAP interface, and the quality of phone numbers on file.
Name the last bank-account change in your ERP that somebody verified by phone.
Send us three months of SAP change documents for the supplier master and your current approval rule; we come back with a target control sequence and an estimate of what the gaps are worth.
Review your vendor change controlThe neighbouring process usually has the same problem
Stop losing three weeks and the compliance evidence every time a plant needs a new supplier.
View solution Legal & complianceCounterparty screening: sanctions, VAT status, registersYour counterparty file was true on the day you checked it. Sanctions and VAT status moved after that.
View solution Finance & accountingInvoice processing without manual data entryStop paying your finance team to move numbers from PDFs into the ERP.
View solution Legal & complianceInsurance policies, renewals and claims on one registerYour whole insurance programme is administered from one workbook and one person's mailbox.
View solution Case studyAutomated P2P query handlingInvoice copies, statuses and statements delivered instantly — around the clock.
View case study Case studyB2B client onboarding in 24 hoursA new client does not stop being “hot” just because your process has nine steps.
View case studyIndustries we deliver this in most oftenManufacturing & industryShared services