Stop Accounts Payable Fraud: Tips, Audits, and Small Team Controls

Accounts payable fraud is the theft or diversion of company funds through falsified invoices, fake vendors, or manipulated payment processes, and the priority for finance leaders is early detection paired with strict vendor and payment verification. The ACFE Report to the Nations and IC3 both track how often this fraud slips through, and firms like AmCFO see the aftermath when controls fail before the fix arrives.

TL;DR:

• Clear segregation of vendor setup from payment approval and verification of bank details are critical controls to prevent AP fraud in small teams.
• Proactively reconciling vendor files quarterly and flagging recent vendor additions before large payments can detect fraud early.
• Whistleblower tips and internal audits are the most effective detection methods, with faster discovery reducing overall fraud costs.
• Speed is essential; immediately freezing disbursements and preserving records are key steps once fraud is suspected.
• Rebuilding controls using forensic accounting and process redesign helps organizations recover from fraud and strengthen defenses.

Table of Contents

• Types of AP fraud and the schemes finance teams see most
• Red flags and detection methods that actually catch fraud
• Building controls that stop AP fraud before it starts
• What to do the moment you suspect AP fraud
• Making compensating controls work when your team is small
• Controls that hold up without slowing the business down
• How AmCFO helps when AP controls need rebuilding
• Sources
• FAQ

Types of AP fraud and the schemes finance teams see most

Accounts payable fraud splits into two broad categories: internal fraud committed by employees with access to vendor files or payment systems, and external fraud carried out by outsiders such as fake vendors or impersonators. The two frequently overlap. A staff member colluding with an outside vendor to approve inflated invoices is both at once, and that collusion is often what allows a scheme to persist much longer than otherwise expected.

Several schemes account for most losses:

• Invoice fraud: an employee or vendor submits invoices for goods or services never delivered, sometimes altering real invoices to inflate amounts.
• Ghost vendors: someone in accounts payable creates a fictitious vendor profile and routes payments to an account they control.
• Payment tampering: checks are intercepted, altered, or forged after approval but before they clear.
• Duplicate and overbilling: the same invoice is submitted or paid twice, or a legitimate vendor is billed at inflated rates with a staff member's knowledge.
• Expense reimbursement fraud: employees submit personal expenses or exaggerated amounts as business costs.
• Vendor collusion: a real vendor and an internal employee coordinate to split the proceeds of inflated or fake invoices.

A common real-world pattern: an AP clerk sets up a shell company using a home address, submits monthly invoices for "consulting," and approves them under a threshold that does not require a second signature. The scheme often surfaces only when someone reviews vendor addresses against employee records, which is why address and bank-detail cross-checks matter more than most finance teams assume.

Red flags and detection methods that actually catch fraud

Certain behavioral and transactional signals show up again and again in AP fraud cases. Watch for vendors with post office box addresses, invoice numbers that are sequential or oddly consistent, employees who resist taking vacation, and staff living beyond their apparent means. On the transactional side, look for round-dollar invoices, payments just under approval thresholds, duplicate invoice numbers, and new vendors added shortly before large payments.

Not every detection method works equally well. Tips consistently outperform every other channel.

Whistleblower tips detect a large share of occupational fraud cases, according to the ACFE Report to the Nations, with internal audits and management review adding another substantial share. Together, tips, internal audits, and management review account for the large majority of cases actually caught, which means a finance team's fraud budget belongs in hotlines and audit hours before it goes into anything else.

That same ACFE data shows organizations that catch fraud through proactive methods, meaning internal audit or management review rather than accident or external tip, tend to suffer lower losses and shorter fraud duration. Passive detection, like an outside party stumbling on the scheme, tends to mean the fraud ran longer and cost more before anyone noticed.

Practical monitoring priorities for AP teams:

• Reconcile vendor master files against payroll and HR records quarterly to catch employee-owned shell vendors.
• Flag any vendor bank-detail change and hold the next payment until independently verified.
• Run duplicate-payment reports monthly rather than annually.
• Review new vendors added in the last 90 days before approving payments over your standard threshold.

Building controls that stop AP fraud before it starts

Segregation of duties is the backbone of AP fraud prevention. No single person should be able to add a vendor, approve an invoice, and issue payment. The GAO Standards for Internal Control (Green Book) treats this separation as a foundational control activity, and where a small team makes full segregation impossible, the Green Book calls for management to design and document compensating controls instead of simply accepting the gap.

Here is a practical sequence for building out AP controls:

1. Separate vendor setup from payment approval. The person who adds or edits vendor records should never be the same person who releases funds to that vendor.
2. Verify every bank-detail change independently. Call the vendor using a phone number already on file, not one supplied in the change request itself.
3. Set tiered approval limits. Require a second approver for any invoice above a set dollar threshold, and a third for anything unusually large.
4. Favor secure payment methods. Virtual cards and tokenized ACH payments limit exposure compared with paper checks, which remain easy to intercept or alter.
5. Automate duplicate and anomaly detection. AP automation software flags duplicate invoice numbers, mismatched purchase orders, and unusual payment timing far faster than manual review, and it leaves an audit trail that manual processes often lack, a point covered in more detail in invoice processing automation guidance.
6. Put policies in writing and train staff on them. A written AP policy that spells out approval limits and vendor verification steps gives employees a clear standard to point to and gives auditors something concrete to test.
7. Maintain a whistleblower channel and publicize it. ACFE data ties trained staff and an accessible hotline to a much higher likelihood that an employee will actually report suspicious activity.

Reconciling accounts payable against bank and vendor records on a fixed schedule, rather than only at year-end, is one of the simplest ways to surface duplicate or unauthorized payments before they compound, a practice covered further in reconciliation best practices. A tightened AP process, covered in more depth in fixing your accounts payable process, tends to close several of these gaps at once rather than one at a time.

Pro Tip: Require a mandatory 48-hour hold on any newly changed vendor bank detail before the first payment goes out under the new information.

What to do the moment you suspect AP fraud

Speed matters more than almost anything else once fraud is suspected. Every hour a wire or ACH payment sits unreported reduces the odds of recovering it.

1. Stop payment and isolate the account. Freeze further disbursements to the vendor or employee in question immediately.
2. Preserve every record. Pull transaction logs, emails, and invoice files before anyone with access can alter them, and document the timeline as you go.
3. Run targeted reconciliations. Compare the suspect vendor's invoice history against purchase orders and delivery records to size the exposure.
4. Contact the bank without delay. Ask about recalling the payment, and file a report with IC3 when the loss involves wire transfer or business email compromise. IC3's Recovery Asset Team and Financial Fraud Kill Chain process depend on fast reporting to have any chance of freezing funds.
5. Bring in counsel and forensic accounting. Legal exposure and evidentiary standards make outside expertise worthwhile once the numbers involved are significant.
6. Escalate internally. Notify audit and compliance leadership, then prepare a remediation plan and a communication plan for anyone who needs to know.

Making compensating controls work when your team is small

Small finance teams rarely have the headcount for full segregation of duties, but the GAO Green Book does not treat that as an excuse, it treats it as a design problem. Compensating controls fill the gap.

• Have someone outside the AP function, an owner, controller, or fractional CFO, review a sample of payments before and after they go out.
• Require a second person's sign-off on every new vendor, even when that person's main job is unrelated to AP.
• Schedule a vendor file scrub every quarter, checking addresses and bank details against public registries and prior invoices, a step covered in the vendor onboarding process checklist.
• Call in forensic accounting or fractional CFO support once a suspected loss exceeds what your team can document and reconcile on its own; expect a defined evidence trail, a loss estimate, and a remediation plan as deliverables.

Controls that hold up without slowing the business down

Fraud controls fail when they exist only on paper or when they make every invoice a bottleneck. The teams that hold up over time pick two or three high-friction points, vendor verification and payment approval thresholds are the usual candidates, and enforce those without exception, while leaving everything else lighter.

Training and an active tip channel cost little and return more risk reduction than most software purchases.

— Angelica

How AmCFO helps when AP controls need rebuilding

Rebuilding AP controls after an incident, or before one happens, takes a mix of investigative work and process redesign that most internal teams do not have the bandwidth for. AmCFO offers forensic accounting to trace losses, preserve evidence, and document findings in a form that holds up with banks, auditors, or counsel.

Beyond the investigation itself, specialized services can address the gaps that let fraud happen in the first place:

• Forensic accounting to size the loss and build a documented timeline.
• CFO oversight to redesign approval limits and vendor verification workflows.
• Cleanup bookkeeping to correct the books once the scheme is understood.
• Business process optimization to build compensating controls that fit a lean team.

An engagement typically starts with evidence preservation, moves through a remediation plan, and ends with control implementation that stays in place. Full details on fractional CFO and process optimization services are on the fractional CFO services page.

This article is general information, not a substitute for advice from a qualified financial advisor. Consult a qualified financial professional about your own circumstances before acting on anything here.

Sources

• ACFE Report to the Nations 2024
• GAO Standards for Internal Control (Green Book) — Principle 10

FAQ

What are some examples of accounting fraud?

Accounting fraud includes falsifying invoices, creating fictitious vendors, altering checks after approval, submitting duplicate payments, and inflating expense reimbursements. Financial statement fraud, such as recording revenue that has not been earned, is a related but separate category that affects reported earnings rather than cash disbursements.

What are the key red flags for ACH fraud?

Watch for a sudden request to change a vendor's bank account details, especially one arriving only by email, along with payment amounts that shift slightly from a vendor's usual pattern. A new payee added shortly before a large transfer, or a request that pressures staff to bypass normal verification, are also strong signals worth stopping to confirm by phone.

What are examples of procurement fraud?

Common procurement fraud includes bid rigging, splitting purchases to stay under approval thresholds, and awarding contracts to vendors with undisclosed ties to an employee. It often overlaps with accounts payable fraud once the favored vendor starts submitting inflated or fictitious invoices.

What are the biggest challenges faced in accounts payable?

Limited staff makes full segregation of duties hard to maintain, which is why the GAO Green Book calls for documented compensating controls when segregation is not practical. Manual, paper-based processes also make duplicate payments and vendor impersonation harder to catch quickly, which is part of why AP automation and independent vendor verification have become standard recommendations.

When should a business bring in forensic accounting for AP fraud?

Forensic accounting is worth engaging once a suspected loss is significant enough that internal staff cannot fully document the timeline, or once the case may involve law enforcement or legal action. AmCFO's forensic accounting service is built for exactly that stage, tracing losses and preparing findings that hold up under scrutiny.

Recommended

• Three Levers to Fix Your Accounts Payable Process for Finance Teams
• What Is Segregation of Duties, and Why Auditors Test It First