Who's Really Behind That Business? Why KYB Alone Can't Stop Invoice Fraud
Updated September 16, 2026
Somewhere in your finance inbox right now, there's probably an invoice you're not entirely sure about.
The vendor's email address looks right.
The amount is close to what you usually pay.
You check the logo, decide it's probably fine, and move on.
That instinct is exactly what fraudsters are counting on. It's why we sat down with Enigma last week, to dig into a question that sounds almost philosophical until you've lost money to it: who is really behind that business?
Key takeaways
- KYB checks confirm a business exists on paper, but they do not verify who controls that business at the moment of a transaction, which is where invoice fraud actually happens.
- Secretary of State registrations take minutes to file and are never independently verified, making them the weakest signal available for vendor identity.
- Business Certificates use the same public-key cryptography that secures websites, bound to a verified company instead of a domain, so any tampering after issuance breaks the certificate visibly.
- The most effective invoice fraud prevention combines verified business identity at onboarding with tamper-proof document records at the moment of payment.
How common is invoice and vendor fraud?
We polled attendees at the start of the session. 27% said they'd already caught a suspicious payment request or invoice in the last 12 months before it went out the door. When we asked how people verify a vendor before sending money, the top answer was a phone call. Some companies described having two or three people whose job is largely just confirming vendors are who they say they are.
That instinct-based approach is expensive. The FBI's Internet Crime Complaint Center logged nearly $2.8 billion in business email compromise losses in 2024 alone (IC3 2024 Annual Report). In fact, a Proof customer shared a story where a fraudster quietly had taken over a vendor's email account, sent an invoice from an address that looked completely familiar, and the payment landed in the wrong account before anyone noticed.
Does a Secretary of State registration actually verify a business?
During the webinar, Enigma CTO Ryan Green took apart the assumption that a Secretary of State registration means a business has been meaningfully vetted. Registering a business in most states just takes filling out a form online, and nobody checks whether what you entered is true.
"I can go right now, and within about 10 minutes, register a business, Gonna Commit Fraud LLC, Mickey Mouse as my registered agent and president, and a few weeks later, when I put in that same information into most KYB systems, it's gonna come up and be like, great, this has been verified."
He still called registration data a reasonable starting point, but ranked it as the weakest signal available, then walked through what Enigma treats as harder to fake. That part of the conversation is worth hearing directly.
What is a Business Certificate, and how does it stop fraud?
Knowing a business is real only solves half the problem. The other half is carrying that trust into the exact moment someone's asking you to pay them, sign something, or hand over sensitive data, using the same kind of certificate technology that puts a padlock in your browser, bound to a company instead of a website.
A Business Certificate is a credential, built on the same public-key cryptography that puts a padlock in your browser, except it's bound to a verified company instead of a website. Proof acts as the certificate authority that issues it, and once it's applied to a document or transaction, it locks in exactly who the business is and that the details haven't been changed since. Alter anything after the fact, and the certificate breaks in a way that's visible to whoever's checking it.
In last week’s webinar, we shared what that looks like on a real invoice, and it's a lot more convincing to watch than to read about.
.jpg)
.jpg)
