Organizations lose up to 5% of their revenue of their revenue to occupational fraud each year, 86% of which can be linked to accounts payable (AP) processes. While checks and wires continue to be the most accessible methods for fraudsters due to the manual processing inefficiencies, they also target electronic invoices.
The financial toll of AP fraud extends far beyond obvious theft. Research indicates businesses lose an estimated $280,000 on average annually to detected fraud—with many organizations unable to quantify their actual losses because fraud often goes unnoticed. Recent surveys show that over half of organizations experienced increased fraud attempts in the past year, with finance professionals identified as primary targets in approximately 60% of phishing and fraud schemes.
Accounts payable fraud encompasses dishonest and illegal actions designed to steal funds from your business's payment systems. These fraudulent schemes can originate from three primary sources: internal employees with system access, external vendors exploiting business relationships, and cybercriminals targeting payment processes through sophisticated scams.
However, there are many ways to combat this rising problem. A combination of improved human processes and accounts payable automation can both limit opportunities for fund misappropriation and enhance fraud detection.
Before an AP department can map out its solution, it's essential to understand what techniques are being used today.
AP fraud tends to fly under the radar, and for a good reason. Essentially, accounts payable fraud deals with asset misappropriation, primarily through fraudulent expenses. Most organizations tend to scrutinize their employees since they have the most access and opportunity, but third-party vendors and even malicious actors can commit AP fraud. Sometimes, multiple parties may work together to siphon money from company accounts. The fraud may be entirely accidental in other cases, such as miscalculating a service cost on an invoice.
Before we can touch on types of accounts payable fraud prevention, it's essential to understand the most common methods of payments fraud. This makes it easier to detect red flags and invest in solutions to reduce fraud risk.
The Association of Certified Fraud Examiners (ACFE) keeps a pulse on fraud cases and offers insights into the most widespread fraud methods across industries. Understanding these schemes is the first step in protecting your organization. When it comes to accounts payable, fraud can originate from both inside and outside your organization. Here are the most critical schemes every business should guard against:
Billing Fraud - In this case, an employee sets up a fake supplier, generally through a shell company, to accept payments from the company through invoice fraud. They may also use duplicate invoices to real suppliers to siphon off money. The goal is to pay themselves the stolen funds and any other accomplices through this fake account.
How it works - The employee creates a fictitious vendor in your system, complete with fake business documentation and a bank account they control. They then submit fraudulent invoices for goods or services that were never provided, routing company funds directly to themselves. In more sophisticated versions, they may create invoices that mimic legitimate suppliers, making detection even more difficult.
Check Fraud - Check tampering is one of the most common ways to commit AP fraud. While it can be challenging to catch, investigators can trace the fraudulent activity to its source if the checks are poorly altered.
Common methods include - Altering the payee name on legitimate checks, changing dollar amounts after checks have been signed, stealing blank checks and forging authorized signatures, or intercepting checks intended for legitimate vendors and depositing them into fraudulent accounts. Despite the decline in check usage, this remains a significant threat for organizations that haven't fully transitioned to electronic payments.
ACH Fraud - In this case, the employee will use their ACH bank account as the recipient to intercept funds meant for the company.
How it operates - Employees with access to payment systems modify ACH payment details to redirect funds to their personal accounts. This can involve changing vendor banking information in your system, creating unauthorized ACH transfers, or manipulating payment files before they're transmitted to the bank. While rare compared to other schemes, ACH fraud can result in substantial losses due to the typically larger transaction amounts involved.
Reimbursement Fraud - Employees can also take advantage of the expense reporting process by inflating their expenses, claiming costs that aren't covered by company policy, or creating fake receipts.
Common tactics include - Submitting personal expenses as business costs, inflating actual expense amounts, claiming reimbursement for the same expense multiple times (through different reporting periods or submission methods), using digitally altered receipts, or claiming expenses that never occurred. This type of fraud often starts small but can escalate significantly over time, particularly when expense review processes are lax.
Bribery and kickbacks - Corporate bribery, often called a kickback, is also a possibility. In this case, the employee receives a gift, either in cash or another form, for signing on a specific supplier.
How kickback schemes work: - A vendor and employee collude together for mutual benefit. The supplier submits inflated invoices or bills for goods and services never delivered, while the employee facilitates approval and payment. In return, the employee receives a percentage of the fraudulent payments—the "kickback." These arrangements can be surprisingly sophisticated, with payments disguised as consulting fees, gifts, entertainment, or even charitable donations to organizations connected to the employee.
These threats come from outside your organization, targeting your AP processes through deception, impersonation, and exploitation of business relationships.
Business email compromise has become one of the fastest-growing and most costly fraud schemes targeting accounts payable departments. This sophisticated scam involves cybercriminals impersonating trusted parties to manipulate employees into making fraudulent payments.
How BEC attacks work: Fraudsters send emails that appear to come from legitimate sources—executives, vendors, or business partners—but the email address is slightly altered (for example, @companyname.com becomes @company-name.com or @companyname.co). These emails typically request urgent wire transfers, changes to vendor banking information, or immediate payment of "overdue" invoices.
Common scenarios include:
BEC attacks often target finance teams during high-pressure periods like quarter-end or when key personnel are traveling or on vacation. The emails create urgency and exploit authority, making recipients feel they must act quickly without following normal verification procedures.
Vendor overbilling occurs when suppliers intentionally inflate invoice amounts beyond agreed-upon pricing, charge for quantities not delivered, or bill for services never performed.
How overbilling schemes operate: Unlike honest billing errors, overbilling fraud is systematic and intentional. Vendors may charge premium rates while delivering standard products, inflate quantities on invoices while shorting actual deliveries, add unauthorized fees or charges not covered in contracts, or bill for rush delivery or special services that weren't provided.
This type of fraud often goes undetected when organizations fail to match invoices against purchase orders and receiving documents. It can also involve collusion with internal employees who receive kickbacks for approving fraudulent invoices.
Duplicate invoice fraud involves submitting the same invoice multiple times to receive payment more than once for a single transaction.
Common methods:
This scheme exploits poor invoice tracking systems, lack of communication between business units, and high-volume AP environments where duplicate detection is challenging. Organizations without automated three-way matching are particularly vulnerable.
This scheme involves billing for goods or services that were never fully delivered, don't meet specifications, or differ significantly from what was ordered.
How it manifests:
This type of fraud requires collusion with receiving personnel or exploits weak receiving and inspection processes. It's particularly common in industries with complex supply chains or where quality verification is difficult.
Fraudsters create fake companies that impersonate legitimate suppliers, often using names very similar to established vendors in your system.
How these scams work: External criminals research your vendor relationships and create fictitious companies with names like "ABC Office Supplies Inc." when your real vendor is "ABC Office Supply Inc." They then submit professional-looking invoices for plausible amounts, hoping they'll be paid without careful verification.
Warning signs include:
Understanding these fraud schemes—both internal and external—is essential for developing effective prevention strategies. While internal fraud typically involves employees exploiting their system access and knowledge of processes, external fraud relies on deception and manipulation of business relationships. The most sophisticated attacks may combine elements of both, with external criminals collaborating with internal employees. By recognizing the warning signs and implementing controls targeted at these specific schemes, your organization can significantly reduce its vulnerability to accounts payable fraud.
When investigating potential accounts payable fraud, it's critical to conduct both an internal report and bring on an external auditor. According to the ACFE, most organizations learn about fraudulent activity from whistleblowers. While internal audits may detect potential fraud cases, an external auditor is far more likely to be unbiased.
If you suspect potential fraud, the first thing to do is preserve evidence. This means collecting checks, invoices, contracts, journal entries, bank statements, and other relevant documentation.
To further investigate potential fraud schemes, setting up a fraud control committee or bringing in an external auditor to review the files would be wise. They may also want to take additional steps, such as:
Verify suppliers
Reconcile accounts
Investigate transactions
Review checks before cutting them
As you evaluate the AP department employees and AP process, it is important to have someone new come in to review suppliers and check payments. This can be an auditor or someone from another part of the accounting office.
The good news is that there are ways to prevent fraud cases. While no single approach can completely eliminate the threat of fraud, a comprehensive strategy combining process controls, technology solutions, and organizational culture can significantly reduce your risk.
Here are the essential measures every AP department should implement:
Strong internal controls create checks and balances that make fraud significantly more difficult to execute and easier to detect.
Modern AP automation and artificial intelligence provide powerful tools to detect anomalies and prevent fraud before payments are processed.
Creating an environment where fraud is difficult to justify and easy to report is essential for long-term prevention.
To enhance fraud detection, certified fraud examiners use an array of tools. But one of the most common is Benford's Law. Basically, this mathematical principle suggests that numbers in a sequence are likely to be part of a pattern, even if they seem random.
In other words, for each number, there is a probability it will be used in a certain slot. For example, the probability of the number 1 being used in the first position in payment, such as $1XX, is 30.1%. Payment fraud is more likely to break the natural pattern.
While it isn't foolproof, Benford's Law provides a simple tool for an AP department to evaluate its payments.
Over the past few decades, accounts payable automation has evolved tremendously. The use of OCR (Optical Character Recognition) to extract data from invoices makes it faster to review both electronic and paper documents. Furthermore, artificial intelligence has largely automated the matching process.
These state-of-the-art AP automation systems immediately alert users of a red flag - whether that be a duplicate invoice, missing tax IDs, or an incorrect receipt. As a result, automation helps to mitigate fraud risk while streamlining the AP process for the entire team.