Supplier Fraud Risk Is Not Credit Risk — and Treating It That Way Will Get You Burned

Australian businesses spend millions annually on credit risk tools — CreditorWatch, Equifax, Dun & Bradstreet — to assess whether the companies they deal with are likely to pay their own debts on time. It's a legitimate concern, and these tools do it well.

But credit risk and supplier fraud risk are different problems with different data requirements, different failure modes, and different consequences. Confusing them — or assuming that a clean credit score means a supplier is safe to pay — is one of the more common and expensive mistakes in procurement risk management.

What Credit Risk Tools Measure

Credit risk scores are fundamentally about payment behaviour over time. They draw on:

• Trade credit history — does this company pay its suppliers on time?
• Court judgments and defaults — are there legal actions for unpaid debts?
• Payment terms and overdue balances from credit reporting members
• Company financials (for listed companies or large private entities)
• Industry default rates and macroeconomic factors

A high credit score means the company has a track record of paying its own bills. It says nothing about who is behind the company, whether the company is legally authorised to operate, or whether the company will still exist next month.

What Supplier Fraud Risk Actually Looks Like

RISK ASSESSMENT FRAMEWORK

Risk Type	Risk Level	Assessment
Supplier Insolvency	High	Public Records
Identity Misrepresentation	Medium	Verification Required
Non-Payment History	Low	Credit Reports
Business Closure Risk	Medium	Market Research
Regulatory Non-Compliance	High	Regulatory Checks

The supplier fraud scenarios that actually cost Australian businesses money tend to look nothing like a traditional credit default. The three most common patterns:

Ghost suppliers

An employee creates a fictitious supplier — often with a real-looking ABN, a plausible business name, and a bank account they control. Invoices are raised and approved through the normal AP process. By the time it's discovered, the money is gone.

A credit risk check on a ghost supplier returns nothing because the entity has no credit history. An ABN verification would show whether the ABN is active and whether the entity type matches what the supplier claims to be. An account number check would flag that the BSB belongs to a consumer bank account, not a business account.

Phoenix companies

A company accumulates debts — to creditors, employees, and the ATO — then is wound up or allowed to deregister. The same directors immediately start a new company with a similar name and continue trading, leaving the old entity's debts behind.

Phoenix companies often have excellent credit profiles for the first 18 months: they're new, they have no adverse history, and they're paying their current bills. The risk is the history of the principals behind them — which shows up on the ASIC banning register, in the insolvency records of related entities, and in the pattern of company registrations associated with the same directors.

Identity fraud and impersonation

A fraudster creates an entity designed to be mistaken for a legitimate business — a domain that differs by one character from the real company, an ABN belonging to a different business, business cards and letterhead that look plausible at a glance. The invoice arrives, looks legitimate, gets paid.

Credit risk tools don't catch this because there's nothing in the payment history of a fraudulent entity that looks wrong. Verification catches it by confirming that the ABN on the invoice matches the business name, that the bank account number matches the expected entity, and that the domain matches the ABN registration.

The Data Is Different

Credit risk tools draw on private payment data shared between lenders and trade creditors. Supplier fraud risk draws on public registers:

What you're checking	Where the data comes from	What credit tools see
ABN active / entity type	Australian Business Register (ATO)	Usually not checked
Company legal status	ASIC company register	Partial (deregistration events)
External administration	ASIC insolvency register	Typically yes
Director banning orders	ASIC ban register	No
Financial services licence	ASIC AFSL register	No
Fair Work compliance notices	Fair Work Ombudsman newsroom	No
ATO super guarantee non-compliance	ATO quarterly register	No
Personal insolvency (sole traders, directors)	AFSA insolvency register	Partially (via credit file)
Domain age vs ABN age	RDAP / WHOIS	No
Bank account to entity match	BSB directory + account validation	No

The overlap is real but small: credit tools are very good at "will this company pay its debts" and moderately good at "is this company in financial distress." They are not designed to answer "is this the company it claims to be" or "can this person legally operate a business."

The Consequences Are Different Too

A credit default costs you a delayed payment or a bad debt. You pursue it through normal channels — demand letters, PPSR security interest, legal action. It's unpleasant but it's a known risk with known remediation paths.

Supplier fraud has no clean remediation path. If you've paid a ghost supplier, the money is usually gone. If you've contracted with a phoenix company whose director is subject to a corporation ban, the contract may be voidable but the counterparty has nothing to recover from. If you've been impersonation-scammed, the legitimate business doesn't owe you anything — you paid the wrong account.

The asymmetry matters: credit defaults are recoverable, often partially. Fraud losses are typically unrecoverable. That argues for treating supplier fraud prevention as a separate discipline, not a subset of credit risk management.

What the Best AP Teams Do Differently

Procurement and AP teams who take supplier fraud seriously typically run two separate checks at onboarding:

1. Identity verification: is this entity who it claims to be? Active ABN, correct entity type, director identities confirmed, no banning orders, company status clean, domain age consistent with claimed trading history. This is pre-commercial — it happens before the supplier is added to the approved list.
2. Credit assessment: is this entity financially stable enough to deliver? Payment history, defaults, adverse judgments, financial distress signals. This typically comes after identity is established.

Running them in the wrong order is a common mistake. You don't need to know whether a ghost supplier pays their bills on time. You need to know it's real first.

For ongoing monitoring, the checks diverge even further: credit risk monitoring watches payment behaviour; supplier fraud monitoring watches register changes (director banning orders, company status changes, new compliance notices) that credit tools don't track.

A Practical Note on Sole Traders

Credit risk tools are substantially less useful for sole traders than for companies, because most of the trade credit history data they draw on is company-level. A sole trader with 15 years of history in cash-based industries may have a thin credit file and a low score through no fault of their own.

Supplier fraud risk for sole traders is a different dataset entirely: personal insolvency (AFSA), ABN status, whether they hold any required licences (QBCC, NSW Fair Trading, ASIC), and whether their identity documents match the ABN record. None of this comes from a credit bureau.

---

Gumshoe is a supplier verification tool — distinct from credit risk. It checks 11 public registers for identity, legal status, and conduct signals. It does not check payment behaviour or credit scores. For most procurement teams, both types of check are appropriate; what matters is running the identity check first. See what Gumshoe checks, or search a supplier now.

Uncommon Insights

Australian businesses that rely solely on credit risk tools to vet suppliers are likely to miss the warning signs of phoenix companies, which can have excellent credit profiles for the first 18 months of operation. In fact, ASIC's Phoenix Taskforce has identified that phoenix companies often have no adverse history and are paying their current bills, making them appear creditworthy. However, a check of the ASIC banning register (Section 1274 of the Corporations Act) would reveal the history of the principals behind the company, including any previous director disqualifications or banning orders.

The ATO's own data suggests that employee-created ghost suppliers are often the most difficult to detect, as they can have a real-looking ABN and a plausible business name. However, a simple ABN verification (using the ATO's ABN Lookup tool) would show whether the ABN is active and whether the entity type matches what the supplier claims to be. Furthermore, an account number check would flag that the BSB belongs to a consumer bank account, not a business account, which is a common red flag for ghost suppliers.

While credit risk tools provide valuable insights into a supplier's payment history, they do not account for regulatory non-compliance, which can be a significant risk for Australian businesses. For example, a supplier may have a clean credit score but be operating without the necessary licenses or permits (Section 911A of the Corporations Act). A regulatory check, such as a search of the ASIC register or a review of the supplier's compliance documentation, would be necessary to identify this risk.

The Australian Securities and Investments Commission (ASIC) has identified that identity misrepresentation is a common tactic used by fraudulent suppliers to gain the trust of their victims. However, a simple verification of the supplier's identity, such as a check of the ASIC register or a review of their business documentation, can help to prevent this type of fraud. In fact, ASIC's Regulatory Guide 252 recommends that businesses verify the identity of their suppliers as part of their anti-money laundering and counter-terrorism financing obligations.