Automated Bill.com Fraud Risk Payment Flags
Every morning, WebRun opens Bill.com and scans bills and vendor records for fraud risk signals: bank account changes in the past 7 days, first-time vendors above a threshold, round-number amounts from new payees, and invoice totals significantly above that vendor's historical average. Flagged items are logged in Airtable and a risk digest is posted to Slack for the controller to review before any payment runs.
How do I automatically flag suspicious payments and fraud risks in Bill.com?
Every morning, WebRun scans Bill.com for fraud risk signals including recent vendor bank account changes, first-time payees above a threshold, and invoice amounts well above a vendor's historical average. Flagged bills are logged in Airtable and summarized in Slack so the controller can review and hold suspicious payments before the day's payment run.
- Suspicious payments are flagged before the payment run, not discovered after a loss
- Vendor bank account changes are reviewed by a human within hours of being made
- Fraud risk history in Airtable gives controllers a pattern view across vendors and time
Built for controllers · CFOs · AP managers · finance directors
What does WebRun do on every run?
The exact actions WebRun takes, in order - in plain language, so you can adjust anything.
-
WebRun signs in and gets to work
Opens
app.bill.comin a real browser with your saved login - no setup, no API keys. -
1
Bill.com - scan bills and vendor profiles for fraud risk signals
bill.com
WebRun opens Bill.com to scan bills and vendor profiles for fraud risk signals. - Open Bill.com and check vendor profiles for bank account or payment method changes in the last 7 days
- Find bills from first-time vendors above a dollar threshold you set
- Find bills where the amount is more than 50 percent above that vendor's average invoice over the last 90 days
- Flag round-number bills from vendors with fewer than three paid invoices in the past year
Done when All fraud risk signals are identified across bills and vendor changes.
-
2
Airtable - log flagged items with risk type and details
airtable.com
WebRun opens Airtable to log flagged items with risk type and details. - Open the AP fraud-risk log base and append each flagged item with: vendor name, bill amount, risk type, and the specific signal that triggered the flag
- Update the risk status for each item to pending review
Done when All flagged items are logged in Airtable with risk type and details.
-
3
Slack - post daily fraud risk digest to the controller
slack.com
WebRun opens Slack to post daily fraud risk digest to the controller. - Post a risk digest to the controller Slack channel listing each flagged vendor, the risk type, and the bill amount
- Remind the team that flagged bills should be held in Bill.com pending controller sign-off. WebRun does not block or void payments automatically
Done when The controller has a fraud risk digest in Slack before the day's payment run.
How is each run configured?
Secure by default
Connect once, stays signed in
WebRun signs in once and keeps each session in a persistent environment, so every run picks up right where it left off.
Every action is checked against this policy before it runs.
Questions, answered
Will WebRun block or void a suspicious payment automatically?
No. WebRun flags and logs suspicious bills but never blocks, voids, or alters them. The controller reviews every flag and decides whether to hold or clear the bill in Bill.com.
What are the fraud risk signals it checks?
Recent bank account changes on a vendor profile, first-time vendors above a threshold, invoice amounts more than 50 percent above that vendor's historical average, and round-number bills from rarely used payees.
Can I adjust the thresholds?
Yes. The dollar threshold for first-time vendors and the percentage deviation for unusual amounts are both set during setup and can be changed at any time.
Related templates
Put this on autopilot.
Turn it on in minutes - or have our team set it up for you.