Who's Really Behind That Business? Why KYB Alone Can't Stop Invoice Fraud
Somewhere in your finance inbox right now, there's probably an invoice you're not entirely sure about.
The vendor's email address looks right.
The amount is close to what you usually pay.
You check the logo, decide it's probably fine, and move on.
That instinct is exactly what fraudsters are counting on. It's why we sat down with Enigma last week, to dig into a question that sounds almost philosophical until you've lost money to it: who is really behind that business?
How common is invoice and vendor fraud?
We polled attendees at the start of the session. 27% said they'd already caught a suspicious payment request or invoice in the last 12 months before it went out the door. When we asked how people verify a vendor before sending money, the top answer was a phone call. Some companies described having two or three people whose job is largely just confirming vendors are who they say they are.
That instinct-based approach is expensive. The FBI's Internet Crime Complaint Center logged nearly $2.8 billion in business email compromise losses in 2024 alone (IC3 2024 Annual Report). In fact, a Proof customer shared a story where a fraudster quietly had taken over a vendor's email account, sent an invoice from an address that looked completely familiar, and the payment landed in the wrong account before anyone noticed.
Does a Secretary of State registration actually verify a business?
During the webinar, Enigma CTO Ryan Green took apart the assumption that a Secretary of State registration means a business has been meaningfully vetted. Registering a business in most states just takes filling out a form online, and nobody checks whether what you entered is true.
"I can go right now, and within about 10 minutes, register a business, Gonna Commit Fraud LLC, Mickey Mouse as my registered agent and president, and a few weeks later, when I put in that same information into most KYB systems, it's gonna come up and be like, great, this has been verified."
He still called registration data a reasonable starting point, but ranked it as the weakest signal available, then walked through what Enigma treats as harder to fake. That part of the conversation is worth hearing directly.
What is a Business Certificate, and how does it stop fraud?
Knowing a business is real only solves half the problem. The other half is carrying that trust into the exact moment someone's asking you to pay them, sign something, or hand over sensitive data, using the same kind of certificate technology that puts a padlock in your browser, bound to a company instead of a website.
A Business Certificate is a credential, built on the same public-key cryptography that puts a padlock in your browser, except it's bound to a verified company instead of a website. Proof acts as the certificate authority that issues it, and once it's applied to a document or transaction, it locks in exactly who the business is and that the details haven't been changed since. Alter anything after the fact, and the certificate breaks in a way that's visible to whoever's checking it.
In last week’s webinar, we shared what that looks like on a real invoice, and it's a lot more convincing to watch than to read about.
.jpg)
.png)
