Three-way matching is an accounts payable control that verifies a purchase by comparing three records: the purchase order, the supplier invoice, and the goods receipt or receiving report. If the quantity, price, and vendor details align, the payment can proceed; if they do not, the transaction is flagged for review.
In cyber security, this control helps reduce fraud and abuse in finance workflows. Attackers who compromise email accounts, vendor portals, or ERP systems may try to submit fake invoices, alter bank details, or create duplicate payments. Three-way matching makes those attacks harder because a single forged document is not enough to trigger payment. Defenders strengthen it with workflow approvals, exception handling, and audit logs so mismatches are visible and investigated. It is a practical example of a detective and preventive control working together to protect financial systems from unauthorized or manipulated transactions.