November offer: EXTRA 30% off all courses & bundles. Use NOVEMBER30 at checkout. Ends 30 Nov.

AP Invoice Fraud: 10 Red Flags and How to Check Them

Ten invoice fraud red flags in accounts payable, from duplicate invoices to bank detail changes, with one quick check for each and the controls that stop them.
Oct 28 / Peter Ilas, FCCA
Most invoice fraud doesn't look like fraud. Each invoice looks normal on its own: a known supplier, a plausible amount, complete approvals in the system. What gives it away is the pattern across invoices, vendors and people.

In the ACFE 2026 Report to the Nations, billing schemes appeared in 21% of occupational fraud cases, with a median loss of USD 90,000 and a median duration of 14 months (ACFE 2026 Report to the Nations).

Here are 10 invoice fraud red flags, each with one quick check in your AP data. International Fraud Awareness Week (15–21 November) is a good moment to run them once, and then every month. Remember: a red flag is a question, not proof.

The short answer

These are the 10 red flags of AP invoice fraud:
1.   Unexplained spikes in vendor payments
2.   Extraordinarily large single payments
3.   Suspicious payment timing
4.   Invoices just below approval thresholds
5.   Duplicate invoices or payments
6.   Repetitive or round-number invoice amounts
7.   Vendor identity anomalies (duplicate IDs or addresses)
8.   Frequent vendor master changes
9.   One-time vendors with big payouts
10. Employee behavioural red flags

One red flag is a question. Two or more on the same vendor or approver deserve priority.

Why invoice fraud is hard to see

AP teams look at invoices one at a time. Fraud hides in the pattern across months, vendors and approvers.

Controls also check the document, not the intent. A three-way match confirms that the invoice agrees with the purchase order and the goods receipt. If the fraudster controls the order, or its price, the invoice passes.

And many schemes need an insider who knows the limits and the gaps. In the ACFE 2026 data, 49% of cases involved two or more perpetrators. The median loss was USD 55,000 with one perpetrator, USD 125,000 with two and USD 324,000 with three or more. So the signal is rarely one test. It is the combination, on the same vendor or approver.

The 10 invoice fraud red flags and how to check them

These are the 10 red flags from the Red-Flag Cards in my course AP Invoice Fraud Prevention: Red Flags & Effective Controls, each with one quick check in your AP and vendor data. The thresholds are starting points; set your own by vendor, amount and risk.
#Red flagQuick check
1Unexplained spikes in vendor paymentsMonthly total per vendor vs the median of the previous 6 months; follow up at 2.5 times or more
2Extraordinarily large single paymentsEach payment vs the median of the vendor's last 12 payments; follow up at 5 times or more, and above a fixed amount
3Suspicious payment timingInvoices entered at weekends or out of hours; payments released within 4 hours of entry
4Invoices just below approval thresholdsInvoices at 90–100% of a limit, by vendor and approver; one vendor's invoices within 7 days that together exceed it
5Duplicate invoices or paymentsSame vendor, amount and invoice number; numbers one character apart within 30 days; payments above the invoice amount
6Repetitive or round-number invoice amountsExact multiples of 1,000; the same amount from one vendor 3 times or more in 90 days
7Vendor identity anomalies (duplicate IDs or addresses)Vendors sharing a bank account, tax ID or address; no registration or tax ID; a private address or P.O. box; matches with employee data, where the law allows
8Frequent vendor master changesBank details changed within 14 days before a payment; who requested and approved each change
9One-time vendors with big payoutsNew or one-time vendors paid a large amount within 30 days of set-up; payments to inactive or blocked vendors
10Employee behavioural red flagsWho never takes leave, works unusual hours or insists on handling certain vendors; one user entering 80% or more of a vendor's records in a month
On a single invoice, a vague description, no PO reference and missing supplier identification can also justify a check. A single invoice number is not a warning sign on its own; invoice-number patterns need several invoices.

The fictitious invoice below has seven intended warning signs, not all ten data patterns in the table. Brightwater requires Procurement orders and their references on invoices, settles on the same date the following month, and requires a second approver from EUR 10,000. These are the example's policies, not universal rules.

The seven questions are the missing Tax ID, missing PO, vague description, new bank account, seven-day payment term, amount just below the approval limit and apparently residential address. Check what identification is required locally; a home address can be legitimate. None proves fraud.
Fictitious invoice with seven warning signs numbered, including missing identification, missing PO, vague description, bank change, short term, near-limit amount and residential address.
One red flag is a question; several on one invoice are a priority
Your approval limit is EUR 10,000. A new vendor, Nordline Consulting Ltd (fictitious), was set up four weeks ago, with a private address and no purchase order. Within three weeks it sends three invoices for "consulting services": EUR 9,850, EUR 9,900 and EUR 9,950, all approved by the same manager. The third, NC-0047, is dated 29 October 2026 and due on 5 November, seven days later rather than the usual month. Two days before the third payment, the bank account is changed after an email request.

Worked example: four red flags on one vendor

Your approval limit is EUR 10,000. A new vendor, Nordline Consulting Ltd (fictitious), was set up four weeks ago, with a private address and no purchase order. Within three weeks it sends three invoices for "consulting services": EUR 9,850, EUR 9,900 and EUR 9,950, all approved by the same manager. Two days before the third payment, the bank account is changed after an email request.

The total is EUR 29,700, almost three times the limit, possibly one purchase split in three. Red flags 4, 7, 8 and 9 sit on the same vendor. That justifies a review before the next payment, not an accusation.

Bank detail changes and business email compromise

The most direct loss needs no fake invoice: the invoice is real, only the bank account is not. An insider can change the vendor's bank details. An outsider can ask for the change by posing as the supplier, through business email compromise (BEC).

The FBI's Internet Crime Complaint Center received 24,768 BEC complaints in 2025, with reported losses of about USD 3.0 billion (FBI IC3 2025 Annual Report). The control takes three steps:
  1. Call back on a number you already have in the vendor master or the contract, never one from the email.
  2. A second person approves the change, and whoever changes bank details cannot release payments.
  3. Review all bank changes before each payment run.
Supplier email with new bank details next to the three-step callback control
Call back on a number you already have, never the one in the email

Controls that work: prevent, then detect

Red flags find problems once they have started. Controls make them harder to start. My course covers 15 must-have controls, 8 preventive and 7 detective, from segregation of duties and bank account change verification to data analytics and surprise inspections.

The ACFE 2026 data supports the case for monitoring. Proactive data monitoring and analysis was present in 49% of cases and was associated with a 53% lower median loss (USD 70,000 vs USD 150,000) and a 44% shorter median duration (9 months vs 16). These are comparisons across occupational fraud cases, not AP-only results or guaranteed savings from a particular tool. Automation can help apply the same checks consistently to every invoice, but findings still need an owner, an independent review and a documented conclusion (see AP Automation in 6 Steps: From Invoice Receipt to Payment).

One limit matters, as my own case shows: a three-way match checks that the invoice matches the order, not that the price is fair.

From practice: when the problem is the approver

Most fraud cases I have worked on, in audit, fraud investigations, internal control and finance, were not AP invoice cases. This one was a true AP billing fraud, through inflated invoice prices. The details are changed so the company cannot be identified.

A supplier invoiced parts at unit prices that the purchasing team believed were 50–100% too high. The purchasing manager approved them every time, and when the team raised concerns, they were explained away. The same supplier also had more favourable payment terms than others.

Every three-way match passed: the goods were delivered in the quantities and at the prices on the purchase orders. The problem was in the orders.

Once the picture was clear and other managers raised loud concerns, the manager left the company rather quickly. The problem stayed: finding another supplier took months, and until then the company depended on the same one.

The company gave the supplier a choice: reduce prices and grant a discount equal to the estimated overcharge, or end the relationship. Even with the insider gone, the negotiations were hard. The supplier denied all accusations, but agreed to much better prices for the future, "for the long business relationship".
A three-way match tells you the invoice matches the order. It does not tell you whether the price is fair.
Peter Ilas, FCCA
Internal and External Auditor, Business Controls Manager
The red flags were there: one approver for the vendor, always, with concerns explained away (red flag 10), and better payment terms for the same suppliers (red flag 3). My course calls this vendor–employee collusion; the ACFE would usually count it as corruption rather than a billing scheme. In its 2026 data, 17% of perpetrators had an unusually close association with a vendor or customer, and the purchasing department accounted for 6% of cases, with a median loss of USD 120,000.

The control lessons: price benchmarks for key vendors; competitive bidding or a second approver for strategic suppliers; a channel where concerns go to someone other than the approver; and a second source for critical parts before you need it.

Monthly data monitoring

Once a year is not enough. Excel can run these checks, but rolling time windows and comparisons across files take work to build and maintain. In my course AI Finance: Build an AP Billing Fraud Dashboard, you build a dashboard with AI, without coding, covering 12 rules with 24 red-flag patterns. Five examples:
  • Split invoices: one vendor's invoices, each below an approval limit, that together exceed it within 7 days.
  • Payment spikes: a vendor's monthly payment total at 2.5 times or more the median of its previous 6 months.
  • Near-duplicates: the same vendor and amount, but invoice numbers one character apart, within 30 days.
  • Bank changes before payment: link the change log to payments to find bank account changes 0–14 days before payment.
  • Approval exceptions: compare payments, approval timestamps and the approval matrix to find payments with missing, late or insufficient approval.

Adjust the default thresholds to your company. The dashboard groups related findings into one investigation, and each month's new transactions can be added without losing earlier comments and conclusions.

What to do with a hit

If a check finds something, look for an ordinary explanation first: a contract, a project, a known instalment. If there is none, don't confront the person or the vendor, and don't let the person who created the transaction review the flag. Secure documents, data and system logs before anyone is alerted, then escalate to the agreed person, such as internal audit, compliance or legal. In my case, the evidence was difficult and slow to collect, so securing it early matters. Either way, document each finding: explanation, evidence, reviewer and conclusion.

Key takeaways

  • Invoice fraud hides in patterns: test across vendors and approvers every month, and look first where two or more red flags meet.
  • Bank detail changes need a callback on a known number, a second approver and a review before each payment run.
  • A three-way match does not test the price; key vendors need price benchmarks.
  • A red flag is a question: explain it or escalate it, and secure the evidence first.

FAQ

Is a red flag proof of fraud?

No. Most red flags have an ordinary explanation, such as a new contract, a retainer or an error. Treat each one as a question: check it, document the answer and escalate what you cannot explain.

What is the difference between invoice fraud and business email compromise?

Invoice fraud usually involves an insider and fake, inflated or duplicate invoices. In business email compromise, an outsider poses as a supplier and asks you to pay a real or fake invoice into a new account. A callback on a known number is the key control.

How can a small finance team prevent invoice fraud without full segregation of duties?

Add review where you cannot separate duties. The owner or CFO reviews new vendors, bank detail changes and the payment list before release.

Learn the red flags, then automate the checks

In AP Invoice Fraud Prevention: Red Flags & Effective Controls, I take you through the 8 fraud schemes, the 10 Red-Flag Cards, 15 must-have controls and how to respond to a suspected case without destroying evidence. 4.5 CPE/CPD credits, 162 minutes of video and a 64-page text course.
To run the checks every month, AI Finance: Build an AP Billing Fraud Dashboard shows you how to build the dashboard step by step, with ready-made prompts and no coding. 5.0 CPE/CPD credits and 3 hours of video. All fraud prevention courses: rsagile.com/fraud-prevention-ethics.

Peter Ilas, FCCA

Founder, RSAgile | E-LITE Consulting
30 years in finance, accounting, audit and internal controls.
Builds practical AI tools for finance teams.
LinkedIn
Created with