Deep Dive 4 August 2026 · Gumshoe Team

Phone Verification: The Last-Mile Check That Catches Ghost Suppliers

Everything looks legitimate on paper: ABN active, address matches, website exists. The phone number is the one thing a ghost supplier cannot easily fake if they're not ready to answer. Here is what a recorded voice verification actually checks and when it matters most.

Ghost supplier fraud relies on one assumption: the accounts payable team will not call. A ghost supplier is an entity that exists in documents — ABN registered, invoice formatted correctly, bank details supplied — but has no real operational presence. It exists to receive a payment. Once the payment arrives, the entity disappears.

The phone number on a ghost supplier invoice is either non-functional, answered by a co-conspirator, or redirected to voicemail. A systematic phone verification, run before the first payment, is the one check this fraud cannot easily pass without significant preparation.

A$2.00 Cost of a Gumshoe phone verification per supplier

2–8 min Typical call duration — includes verification items, recording, and transcript generation

Recorded Every call is recorded and transcribed — audit trail for every verification

What the Call Actually Verifies

Gumshoe's phone verification is not a cold call. It is a structured AI-driven outbound call that works through a checklist of items you specify before dialling. The default verification set includes:

ABN confirmation: The person who answers is asked to confirm the business's Australian Business Number
Business name: Confirm the registered business name matches what appears on the invoice
Trading status: Confirm the business is currently active and trading
Bank details: Confirm the BSB and account number on the invoice — the highest-value check for BEC fraud prevention
Contact email: Confirm the email address on file for invoicing
Registered address: Confirm the business's registered address matches records

You select which items to include based on what data you have available. If you only have a bank account number and no address, verify the bank account. If the address is the primary concern, verify the address. The call is built around your specific uncertainty, not a generic script.

When Phone Verification Matters Most

PHONE VERIFICATION RISKS
Risk Type	Verification Check	Risk Level
Ghost Supplier	Live Answer Check	High
Number Spoofing	Caller ID Check	Medium
False Information	Phone Directory Check	Low
Non-Existent Number	Phone Number Validation	High
Unreachable Number	Phone Call Attempt	Medium

Phone verification is most valuable at specific trigger points in the supplier relationship, not as a check on every invoice:

First payment to a new supplier — the highest-risk moment in any supplier relationship; call before the first payment runs, regardless of invoice size
Bank detail change request — any request to change the payment account for an existing supplier should be verified by phone before the change takes effect. This is the single most common vector for BEC fraud.
Unusually large invoice from an existing supplier — a new invoice that is significantly larger than historical norms warrants independent confirmation
Supplier contact change — if the person you normally deal with has changed, a phone call to the main business number (not the new contact) verifies the change is legitimate
Address or identity change — any change to a supplier's registered details that you receive via email should be confirmed by voice before being applied

What Happens After the Call

Every Gumshoe phone verification produces three outputs that become part of the verification record:

A call recording — the full audio of the verification call, stored and linked to the supplier case. Available for review by anyone with access to the dashboard. If a question arises later about what was confirmed, the recording is the authoritative record.

A transcript — the conversation is automatically transcribed and the confirmation items are extracted. Pass/WARN/FAIL status is assigned based on whether each item was confirmed, unconfirmed, or contradicted by the response.

An audit timestamp — the date and time of the call is recorded and attached to the case. If an auditor asks whether bank details were independently verified before the payment ran, the timestamp is the answer.

$50K Typical minimum loss in a ghost supplier or BEC fraud — phone verify is A$2.00

Transcript Every call is transcribed and parsed — PASS/WARN/FAIL per verification item

The Fraud It Cannot Catch

Phone verification is not a complete fraud prevention tool. It catches ghost suppliers and bank detail fraud where the attacker does not control the supplier's phone line. It does not catch:

Internal collusion: If someone inside the supplier's business is the co-conspirator, they will confirm whatever is asked
Sophisticated social engineering: A well-prepared fraudster who has diverted the supplier's phone number can answer correctly
Ongoing relationship fraud: A supplier that has been legitimate for years before turning fraudulent — the call confirms current identity, not past or future intent

These limitations do not diminish the value of the check. The majority of ghost supplier and BEC fraud is unsophisticated. A recorded voice call to the main business number is sufficient to deter most attempts, because it raises the cost and complexity of the fraud beyond what most opportunists are willing to invest.

Add the Phone tile to any new supplier's first verification. A$2.00 to confirm the bank details before you pay $50,000 is the lowest-cost control in your supplier risk toolkit.

Uncommon Insights

Under the Australian Securities and Investments Commission (ASIC) regulatory guide 252, entities are required to maintain robust risk management systems, including effective controls to prevent and detect misconduct. Phone verification can be a critical component of these systems, particularly in preventing ghost supplier fraud, as it provides an additional layer of assurance that the supplier is legitimate and operational. By incorporating phone verification into their risk management framework, entities can demonstrate compliance with ASIC's regulatory expectations.

The Australian Taxation Office (ATO) requires businesses to verify the identity of their suppliers to prevent fraudulent activities, such as phoenixing. Phone verification can be an effective way to meet this requirement, as it allows businesses to confirm the supplier's identity and trading status. Under section 255 of the Corporations Act 2001, directors have a duty to exercise reasonable care and diligence in the management of the company. By implementing phone verification, directors can demonstrate that they have taken reasonable steps to verify the identity of suppliers and prevent fraudulent activities.

Contrary to common practice, phone verification is not just a one-off check, but rather an ongoing process that should be repeated at specific trigger points in the supplier relationship. For example, if a supplier requests a change to their bank details, a phone verification should be conducted to confirm the change is legitimate. This is particularly important in preventing business email compromise (BEC) fraud, which often involves attackers attempting to redirect payments to a new bank account. By conducting regular phone verifications, businesses can reduce the risk of BEC fraud and demonstrate compliance with the ATO's requirements for verifying supplier identity.

ASIC's enforcement patterns suggest that entities that fail to implement effective controls to prevent and detect misconduct, including ghost supplier fraud, may face significant penalties. In recent years, ASIC has taken action against several entities that have failed to implement adequate risk management systems, resulting in significant financial losses. By incorporating phone verification into their risk management framework, entities can reduce the risk of ghost supplier fraud and demonstrate compliance with ASIC's regulatory expectations, thereby minimizing the risk of enforcement action.

VERIFY NOW