unverified vendor risks