Accounts Payable Fraud Detection: Red Flags and Controls

By Taylor Frizzell. Updated November 4, 2026. Worked examples are fictional.

What is accounts payable fraud?

Accounts payable fraud involves intentional deception in the purchasing, invoicing or payment process to obtain an improper benefit. An employee might approve fictitious services, a supplier might deliberately bill twice, or an outsider might redirect a legitimate payment. The ACFE’s discussion of shell companies explains why supplier identity deserves scrutiny, while also recognizing that shell entities can have legitimate uses.

A duplicate invoice, a round amount or an unusual payment is not proof of fraud. Do not accuse an employee or supplier based solely on a report.

Common schemes and practical controls

These are risk-based review ideas, not universal mandatory procedures. Tailor them to transaction values, systems and staffing. The ACFE’s analytics tests include duplicate records, missing vendor information, matching exceptions and approval conflicts.

Build controls across the payment lifecycle

Vendor onboarding and master changes

Assign a stable vendor ID. Verify the legal/business identity, reason for purchase, approved contact and payment method through appropriate independent sources. Keep sensitive tax and banking documents in restricted storage, rather than an open spreadsheet. Separate supplier creation from payment release where possible. Record who requested, verified, approved and entered a change, the timestamp, and the supporting evidence.

Any bank-detail change should trigger independent verification. Do not call a number supplied only in the change email or rely on a reply in the same thread. The FBI’s business email compromise guidance recommends independently finding contact details and verifying changes to account numbers or payment procedures. A familiar sender address does not establish authenticity.

Invoice matching and authorization

Match an invoice to the authorized purchase and evidence that goods or services were received. For inventory, this may be a three-way match between purchase order, receipt and invoice. For rent or professional services, a contract and documented service confirmation may be more appropriate. Investigate quantity, price and payment-term differences. Define who can approve exceptions and retain the reason.

Set approval authority by risk and total commitment, not only individual invoice amount. Require escalation for related invoices split just below a limit. Reconcile approved invoices to the final payment file’s count, total, beneficiary and destination. Approval of an invoice is not approval of an unverified bank change.

Access permissions and audit trails

Use named accounts, multifactor authentication and access limited to actual job needs. Review permissions when responsibilities change and revoke departing staff access promptly. Retain change history and payment approvals according to a documented schedule. Ask the software provider what its audit log captures and how long it remains available. Do not assume a screenshot contains the full history.

Segregation of duties for small teams

Divide supplier maintenance, invoice entry, authorization, payment release and bank reconciliation where feasible. When a small staff cannot fully separate them, document the conflict and install a specific independent review. The GAO Green Book is a useful control framework; its federal requirements are not automatically legal obligations for every small business.

This arrangement still has residual risk, including owner override or collusion. For higher-risk activity, consider an independent external reviewer and bank controls suited to the payment method. A signature without reviewing evidence adds little protection.

Exception reports worth running

• Duplicate candidates: same supplier and invoice; normalized numbers; repeated amounts within a defined window.
• Vendor changes: new or changed destinations before a payment, including the requester, approver and editor.
• Approval exceptions: missing approvals, overrides, self-approval and related payments near limits.
• Matching exceptions: invoices without receiving evidence or amounts inconsistent with the purchase authorization.
• Unusual activity: dormant vendors becoming active, unexpected frequency, out-of-hours releases or unusual payment methods.
• Reconciliation differences: bank withdrawals without a supported ledger entry or unexplained vendor credits.

Each report needs a complete source population, stable IDs, defined time range, owner and review deadline. Document exclusions so cancelled invoices or credit notes do not silently distort the result. Tune thresholds after reviewing false positives; do not create an unexplained “fraud score.”

A fictional investigation from flag to disposition

Desert Office Services has a $4,800 invoice awaiting payment. A second $4,800 entry has a slightly different invoice number. The reviewer first confirms that the export contains invoice-level records, then compares both documents and receiving records. They establish that the second is a reminder copy of the same service, and bank history shows the first has already been paid.

The reviewer records the related IDs, evidence and decision, obtains authorized correction of the unpaid duplicate, and identifies the duplicate-import cause. The $9,600 flagged total is not the loss. In this example, the second payment was prevented; there is no evidence establishing deliberate fraud.

Investigation and escalation steps

1. Preserve original documents, relevant communication, audit logs and payment references in restricted storage.
2. Use authorized payment holds while uncertainty is resolved. Assign an independent reviewer and avoid alerting a suspected participant unnecessarily.
3. Compare evidence across purchase, receipt, invoice, approval and settlement. Confirm externally through trusted channels where appropriate.
4. Separate verified facts, unresolved questions and explanations. Record who reviewed each item and when.
5. Escalate suspected intentional misconduct to authorized management and qualified advisers. Follow applicable reporting and preservation obligations.
6. If funds may have been redirected, contact the financial institution immediately and report suspected business email compromise to IC3, as the FBI advises. Recovery is not guaranteed.

Download a payment approval and fraud-control checklist

Download the payment approval and fraud-control checklist (.xlsx). It includes review results, restricted evidence references, reviewer/date and unresolved actions. Use it with approved system permissions and bank authorization, not as a substitute for those controls.

Common mistakes and automation limits

Common mistakes include trusting an emailed bank letter, using one account for the whole team, approving from a payment total without invoice support, deleting exceptions, and assuming automation has reviewed the supplier’s legitimacy. Automated matching can miss new schemes and can flag valid activity. Poor master data or incomplete exports can hide problems. Review how exceptions are handled and test whether staff can bypass the control.

Frequently asked questions

Tools and related accounting lessons

Start with detecting duplicate invoices in Excel and its downloadable checker. Connect resolved items to accounts payable aging and bank reconciliation. Explore the Accounting hub for the wider close process.