Skip to content
Get started
Vendor payments

New vendor payments: how a single-use virtual card limits your first-invoice risk

Paying a vendor you have never paid before is the riskiest invoice you will approve, because you have no history to check the request against. Verify the vendor through a channel you already trust, then cap a single-use virtual card to the exact amount due, so a padded bill or an impersonated vendor has a hard ceiling on what it can cost you.

By Sreekuttan, SEO at Zil MoneyUpdated 7 min read

VirtualCardMaker.com, powered by Zil Money, is a financial technology company, not a bank. Banking and money movement services are provided through partner financial institutions and licensed service providers. FDIC insurance coverage applies only to eligible deposit products and accounts, and is subject to applicable terms, conditions, limitations, and requirements. Additional information regarding partner institutions, products, and services is available in the applicable terms and agreements.

  • PCI DSS aligned
  • ISO 9001 Quality Management Certified
  • ISO 20000 IT Service Management Certified
  • ISO 27001 Information Security Management Certified
  • Aligned with NIST SP 800-53 controls
  • AICPA SOC for Service Organizations
  • AICPA SOC Service Organization Control Reports
  • HIPAA-aligned safeguards
  • CCPA requirements followed
A finance professional cross-checking a new vendor's invoice by phone next to a laptop and a plain gold virtual card, representing vendor verification before a first payment.

Read summarized version with:

Why the first invoice from a new vendor is the riskiest one

Every vendor you pay regularly has a pattern: roughly the same amount, roughly the same schedule, the same bank details month after month. A new vendor has none of that. There is nothing to compare the first invoice against. That gap is exactly what fraud is built to exploit. A padded amount, an unfamiliar payment request, or an entirely fabricated vendor can all look like a normal first bill to someone approving payments quickly.

This is not a hypothetical risk. In AFP's 2026 Payments Fraud and Control Survey, 76% of organizations reported experiencing attempted or actual payments fraud in 2025, and business email compromise, the category that includes spoofed vendor emails and vendor impersonation, was the most common attack type, hitting 74% of organizations.

None of that means every new vendor is a threat. It means the first payment deserves a different process than your fifteenth payment to a supplier you have worked with for two years.

What actually goes wrong the first time you pay a new vendor

A few patterns show up again and again in a new vendor's first invoice:

  • A padded amount with no history to catch it. There is no prior invoice to compare against, so an inflated first bill is easy to wave through.
  • Bank or payment details that do not actually belong to the vendor. A convincing email claiming to be the new supplier, sent before or during onboarding, is a common vendor impersonation pattern.
  • A "confirm your details" message that changes the payment info. A last-minute update to routing or billing details, timed right before the first payment, is a known warning sign rather than routine account maintenance.
  • Card or account details saved and reused later. If you hand over your everyday company card, a new vendor's billing system can store and reuse it well beyond the invoice you meant to pay.

A short vendor-vetting checklist before the first payment

Run through this before the invoice gets approved. None of it takes more than a few minutes:

  • Confirm the vendor's identity through a contact channel you already had, not a phone number or email printed on the new invoice itself.
  • Match the invoice amount to a signed agreement, purchase order, or original quote before approving it.
  • Confirm internally who brought this vendor in and why, so the relationship is verified, not assumed.
  • Treat any "updated bank details" or "new payment info" message near the first invoice as something to verify independently, not act on directly.
  • Add the vendor to the Payees module with their confirmed contact and company details, so the check has a record attached to it.

How a single-use virtual card limits the damage if something still slips through

Create one virtual Visa card for this vendor's invoice, fund it from your wallet, and cap it to the exact amount on the invoice instead of a rounded-up buffer, then hand the vendor that card instead of your everyday company card or bank details. A charge above the cap is declined on the spot, and once the vendor's charge settles you cancel the card, which is what makes it single-use in practice.

This article focuses on the vendor-vetting side of that first payment. For the full mechanic, including what settlement actually means and a worked invoice example, see the complete guide to single-use virtual cards for vendor payments.

Ready to pay a new vendor for the first time?

See the full cap-and-cancel mechanic, worked example, and FAQ for issuing a single-use vendor card.

Why a capped card beats handing over your everyday card or bank details

Here is the difference between the two ways most first payments to a new vendor actually go out.

First payment with your everyday card or bank details

The vendor gets the same number every other supplier has.

  • No cap tied to this specific invoice, so a padded amount can clear.
  • The number sits in a brand-new vendor's billing system indefinitely.
  • If the vendor turns out to be fake, your main account was already exposed.
  • A second, unapproved charge later looks like just another line on your statement.
First payment with a capped single-use card

The vendor gets a number scoped to this one invoice.

  • A charge above the exact invoice amount is declined at authorization.
  • Your main company card and bank details never touch a vendor you have not vetted twice.
  • If the vendor turns out to be fake, the exposure is capped at one invoice, not your whole account.
  • You cancel the card once the charge settles, so nothing about it can be reused later.

When to move a vendor off single-use cards

Single-use cards are for the first payment, not every payment. Once the vendor delivers what was agreed, the invoice matches the quote, and you expect to pay them again, a fresh one-time card for every bill becomes friction rather than protection. At that point, move the relationship to a reloadable card capped at the expected amount, or fold it into your regular vendor-payment workflow. The comparison in single-use vs reloadable virtual cards covers exactly when to make that switch, and how to pay vendors with virtual cards covers running that ongoing relationship day to day.

Keep the verification on record, not just the payment

A vetting check that only lives in someone's memory disappears the moment that person is out sick or has moved on. Use the Payees module to record the vendor's confirmed contact and company details, and note there what you verified and how. That way, the card, the invoice, and the check you ran to approve it all sit next to each other, with a per-payee transaction history you can pull if a payment is ever questioned later. Clean records are also what make an audit or a dispute fast instead of a reconstruction project.

Mistakes to avoid when paying a new vendor for the first time

Do not skip verification because the invoice looks professional. A polished layout and a real-looking logo are the easiest parts of an invoice to fake; they say nothing about whether the vendor or the bank details are genuine.

A cap set above the invoice amount is not a safety margin. It is headroom a padded invoice can spend into, so match the cap to the exact figure due.

Do not treat the card as full protection against a fake vendor. A capped card only limits the amount at risk; if the vendor itself is fabricated, that capped amount can still be collected.

Frequently asked questions

Do I still need to verify a new vendor if I pay by single-use virtual card?
Yes. A capped card controls how much money is at risk once you pay; it says nothing about whether the vendor is genuine. Verify their identity first, through a channel you already trust, and let the card handle the dollar exposure.
What if the vendor asks me to send future payments to a different bank account?
Treat any changed banking, billing, or contact detail as a signal to verify independently before you act on it, regardless of which payment method you use. Requesting a change like this, right before or after a first payment, is one of the more common tactics in vendor impersonation fraud.
How is vetting a new vendor different from just capping the card at the invoice amount?
The cap limits how much a padded or fraudulent invoice can take from you. Vetting confirms the vendor and the invoice are genuine in the first place. They solve different problems, so use both together.
Does a single-use card stop business email compromise?
No single control stops business email compromise (BEC) on its own. BEC remains the most common payments fraud type organizations report, so a capped card limits your exposure while your independent verification step is what actually catches an impersonated vendor before you pay.
Can I reuse the same single-use card for the same vendor's next invoice?
No. The card is scoped to one invoice; cancel it once that charge settles. For the vendor's next bill, create a fresh capped card, or move to a reloadable card once the relationship is established.
Where do I keep a record of the vendor check I ran?
Add it to the vendor's payee profile, where their contact details, company information, and full transaction history already live, so the check travels with the record instead of sitting in an inbox somewhere.
Try it

Issue a card with these rules on it.

Set the limit, restrict the merchant, choose the active window, and send the card. Every charge lands in one dashboard, already attributed.

Build one in Card Studio

Share

Keep reading

Next, on the same problem.

All posts
  1. Vendor payments

    Single-use virtual cards for vendor payments: one card, one invoice.

    Paying a vendor once and worried they will overbill, double-charge, or save your number for later? Create one virtual Visa card per invoice and cap it to the exact amount due. A charge over that figure is declined, the card cannot fund a second invoice, and once the charge settles you cancel the card so it cannot be used again. Each card maps to one bill, so reconciliation is a clean 1:1 instead of guesswork on a shared account.

    June 15, 2026 · 11 min read
  2. Vendor payments

    Pay one vendor, once, with a single-use card

    Not every vendor is a standing relationship. When you only expect to pay someone a single time, a virtual card built for exactly one invoice keeps your everyday company card out of a billing system you will probably never touch again, and you cancel it once the job is done.

    July 29, 2026 · 9 min read
  3. Vendor payments

    Managing recurring vendor payments with virtual cards

    Capping a card the day you sign up with a vendor is the easy part. The harder part is six months later, when the vendor list has grown, a couple of prices have crept up, and nobody remembers why one of the cards still exists. This is the ongoing review process: a vendor card registry, an owner for every card, and a cadence that catches price creep and clears out cards nobody claims.

    July 16, 2026 · 11 min read

The next vendor gets its own Visa card.

Not the shared one. Its own number, its own ceiling, its own line in the ledger.

Create your first cardBook a demo