Accounts payable fraud is theft carried out through a company’s payment process — fake vendors, inflated invoices, altered checks, kickbacks from suppliers, or spoofed payment instructions that route money to a criminal instead of a legitimate payee. The Association of Certified Fraud Examiners’ most recent global study put the typical organizational loss at about five percent of annual revenue, with average losses above $1.5 million per case.1Association of Certified Fraud Examiners. ACFE Report to the Nations: Organizations Lost an Average of More Than $1.5M Per Fraud Case The median scheme runs about 12 months before anyone catches it, so the controls in place today determine how much walks out the door before the problem surfaces.
The Main Schemes
Shell Companies and Fake Invoices
The classic scheme creates a company that exists only on paper. An employee with access to the vendor master file sets up the fake entity, routes payment to a bank account they control, and approves the invoices themselves. A subtler version copies a real vendor’s invoice, inflates the amount by a small percentage, and funnels the difference through a pass-through entity. Because each individual payment looks routine, these schemes can run for years.
When payments move electronically across state lines, the federal wire fraud statute applies and carries up to 20 years in prison.2Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television Fines for individual defendants can reach $250,000 per violation.3Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine If physical mail is used at any stage, the mail fraud statute applies with similar base penalties; sentences jump to 30 years and fines to $1 million when a financial institution is affected.4Office of the Law Revision Counsel. 18 USC 1341 – Frauds and Swindles
Check Tampering
Check tampering happens when someone intercepts a legitimate check and alters the payee, forges an endorsement, or uses software to print convincing counterfeits drawn on the company’s real bank account. The goal is to drain the account quickly, before a bank reconciliation catches the discrepancy. Courts routinely order restitution, but recovery depends on whether the perpetrator still has assets to seize.
Kickback Arrangements
Kickbacks involve an employee conspiring with an outside vendor to inflate prices. The vendor charges above-market rates, the employee approves the payments, and they split the excess. The goods or services are real and the vendor is legitimate; the inflated pricing is the fraud, which is why these arrangements are hard to spot from invoice review alone.
Beyond wire or mail fraud exposure, participants who don’t report the illicit income face tax evasion charges. At scale, kickback operations can trigger civil RICO claims, which allow the defrauded company to recover three times the actual damages plus attorney’s fees.5Office of the Law Revision Counsel. 18 USC 1964 – Civil Remedies
Business Email Compromise
Business email compromise accounts for over $55 billion in reported global losses since 2013.6Federal Bureau of Investigation. Business Email Compromise: The $55 Billion Scam The scam usually starts with an email that appears to come from a known vendor or company executive requesting a change to banking details or an urgent wire. Criminals use addresses that differ from the real one by a single character, or they compromise the vendor’s actual account and insert themselves into ongoing invoice threads.7Federal Bureau of Investigation. Business Email Compromise
BEC exploits trust rather than system access. The AP clerk processing the payment is doing what an apparently authorized person asked. The FBI recommends verifying any change in payment instructions by calling the vendor at a number you already have on file, never the number in the suspicious email.7Federal Bureau of Investigation. Business Email Compromise Pressure to act quickly is the clearest giveaway.
Red Flags to Watch
Data Anomalies
The numbers usually tell the story first. Sequential invoice numbers suggest a single person generating them by hand. Payments in clean round-dollar amounts point to fabricated charges, because real invoices rarely land on tidy figures. Duplicate payments to the same vendor within a short window deserve immediate scrutiny; they can be clerical errors, and they can also be a second payment routed to a fraudster’s account. Invoices that consistently land just below the manager-review threshold are one of the most reliable indicators.
Vendor addresses that share a zip code, suite number, or P.O. box with a current employee are a strong signal of self-dealing, and this is an easy automated check. Vendors with no phone number on file, no web presence, or a recently created tax identification number warrant a closer look.
Behavioral Signals
An employee who refuses to take vacation is one of the oldest fraud indicators in the field, and it still works. The concern isn’t the workaholic tendency; it’s that a temporary replacement would review the employee’s active files and spot inconsistencies. Sudden lifestyle changes that don’t match a person’s salary, resistance to procedural changes in AP, and unusual insistence on personally handling specific vendor accounts all raise the probability that something is wrong.
Statistical Screening
Modern fraud detection software analyzes payment data continuously for statistical anomalies. One powerful technique applies Benford’s Law, which predicts how often each digit from 1 through 9 should appear as the leading digit in naturally occurring datasets. In legitimate accounting data, 1 appears as the leading digit about 30% of the time, while 9 appears less than 5% of the time. Significant deviation from that pattern suggests fabricated entries have been inserted. Researchers have found the analysis works best with datasets of at least 5,000 records.
Controls That Actually Stop It
Segregation of Duties
No single person should control an entire payment from start to finish. The employee who adds a vendor should not enter invoices, and neither should approve payments. Breaking that chain is the most basic and most effective control. For publicly traded companies, this isn’t optional. The Sarbanes-Oxley Act requires each annual report to include an assessment of internal controls over financial reporting, with an independent audit firm attesting to that assessment.8Office of the Law Revision Counsel. 15 USC 7262 – Management Assessment of Internal Controls
Three-Way Match
Before any payment goes out, the purchase order, receiving report, and vendor invoice should all agree on quantities, pricing, and terms. When they don’t match, the payment is held until the discrepancy is resolved. It sounds mechanical, and it is, but it stops a remarkable number of billing schemes because a fraudster submitting a fake invoice rarely has a matching purchase order and receiving confirmation to back it up.
Vendor Master File Controls
The vendor master file is the front door for most AP fraud. Edit access should be restricted to a small number of senior employees who have no role in approving or processing payments. Automated alerts should fire whenever someone adds a new vendor or changes existing bank information. Periodic audits should flag dormant accounts that could be reactivated for “zombie” billing.
Verification should reach further than a phone call. The IRS Taxpayer Identification Number Matching program lets you validate a vendor’s TIN and name combination before submitting information returns, catching fictitious entities early.9Internal Revenue Service. Taxpayer Identification Number (TIN) Matching Federal law also prohibits transactions with individuals and companies on the Treasury Department’s Specially Designated Nationals list, and the obligation to screen for that falls on you as the paying party.10U.S. Department of the Treasury. Specially Designated Nationals (SDNs) and the SDN List Sanctions violations carry civil penalties up to $368,136 per transaction (adjusted annually for inflation) or twice the transaction amount, whichever is greater, and criminal penalties up to $1 million and 20 years in prison for willful violations.11U.S. Department of the Treasury. OFAC Civil Penalties Adjustments for Inflation 2026
Positive Pay and Timely Reconciliation
Positive pay is a banking service where you upload a file of every check your company issues, including check number, amount, and payee. When a check is presented, the bank compares it against your file and flags anything that doesn’t match. The bank won’t pay a flagged item without your approval. It catches altered amounts and counterfeits before the money leaves your account, though it doesn’t always verify the payee, so treat it as one layer rather than the whole defense.
Speed matters here for a legal reason most businesses overlook. Under the Uniform Commercial Code, you have one year from the date your bank statement becomes available to discover and report a forged signature or alteration on a check. Miss that window and you lose the right to hold the bank responsible, regardless of whether either party was careless.12Legal Information Institute. UCC 4-406 – Customers Duty to Discover and Report Unauthorized Signature or Alteration Monthly reconciliation is the minimum; weekly is better if check volume is high.
If You Report Fraud
Employees who discover AP fraud and report it have significant legal protections against retaliation, and in some cases can collect a financial reward for coming forward.
For publicly traded companies, federal law prohibits employers from firing, demoting, suspending, or otherwise retaliating against employees who report conduct they reasonably believe involves wire fraud, mail fraud, bank fraud, securities fraud, or violations of SEC rules. The protection extends to employees of subsidiaries, contractors, and subcontractors. An employee who is retaliated against can file a complaint with OSHA within 180 days and is entitled to reinstatement, back pay with interest, and compensation for litigation costs and attorney’s fees.13Office of the Law Revision Counsel. 18 USC 1514A – Civil Action to Protect Against Retaliation in Fraud Cases
When AP fraud involves government contracts or federally funded programs, the False Claims Act creates a stronger incentive. A private individual can file suit on behalf of the federal government, known as a qui tam action. If the Department of Justice takes over the case, the person who brought it receives between 15% and 25% of whatever the government recovers. If the government declines to intervene and the individual pursues the case alone, the share rises to between 25% and 30%.14Office of the Law Revision Counsel. 31 USC 3730 – Civil Actions for False Claims The suit is filed under seal, so the employer doesn’t know about it while the government investigates.
If You Discover Fraud
Preserve Evidence First
Once fraud is suspected, the priority is preserving evidence before anyone involved realizes they’re under scrutiny. Image hard drives, preserve email archives, and secure access logs before the suspected employee can delete records. A forensic accountant traces the flow of funds through digital ledgers and bank statements to map the full scope of the loss. Everything from this point forward should proceed under the guidance of legal counsel, both to protect privilege and to keep the evidence usable in court or in an insurance claim.
Public-Company Escalation
Public companies face a specific escalation process when fraud is discovered during an audit. If an outside auditor detects potential illegal activity, they must determine whether an illegal act likely occurred, assess its financial impact, and inform management and the audit committee. If management fails to take corrective action and the illegal act has a material financial effect, the auditor must escalate to the board of directors. Once the board receives that escalated report, the company has one business day to notify the Securities and Exchange Commission.15Office of the Law Revision Counsel. 15 USC 78j-1 – Audit Requirements This is not a general obligation to report every discovered fraud immediately. It is triggered by a specific sequence: auditor finds the problem, management fails to act, auditor escalates to the board, and the SEC clock starts from there.
Civil and Criminal Recovery
Recovery typically runs on two parallel tracks. On the civil side, the company sues to freeze the perpetrator’s assets and obtain a judgment for the stolen amount. If the fraud is large enough and involves a pattern of criminal activity, a civil RICO claim allows recovery of three times the actual damages plus attorney’s fees.5Office of the Law Revision Counsel. 18 USC 1964 – Civil Remedies On the criminal side, prosecutors can seek restitution as part of sentencing, though collection depends on whether the defendant has assets left to seize.
Insurance Claims
Commercial crime insurance, sometimes called fidelity coverage, can reimburse losses from employee dishonesty, forgery, and computer fraud. Filing requires moving quickly. Most policies require notification “as soon as possible” after discovering the loss, and delays beyond a few days have been found unreasonable in court. Sworn proof of loss is typically due within 120 days, though the exact timeline varies by policy. A formal police report is almost always required, along with documentation of every fraudulent transaction identified. Deductibles vary widely, so read the policy before a loss occurs rather than after. Note that ERISA fidelity bonds, required for anyone handling employee benefit plan funds, are a separate legal obligation and protect the plan, not the company’s operating accounts.
Tax Treatment of the Loss
Businesses that suffer AP fraud can deduct the unrecovered portion of the loss from federal income taxes, but the timing rules matter. A theft loss is deductible only in the tax year you discover it, not the year the fraud actually began.16Office of the Law Revision Counsel. 26 USC 165 – Losses If you discover in 2026 that an employee has been stealing since 2022, the entire deduction belongs on the 2026 return.
There’s an important wrinkle when insurance or civil recovery is in play. If you’ve filed an insurance claim or a lawsuit and there’s a reasonable chance of recovering some of the loss, you can’t deduct that portion until the year you know with reasonable certainty that reimbursement isn’t coming.17Internal Revenue Service. Publication 547, Casualties, Disasters, and Thefts Only the amount not compensated by insurance or other recovery is deductible.16Office of the Law Revision Counsel. 26 USC 165 – Losses Getting the timing wrong means amending returns later, which is exactly the kind of complication you don’t want on top of a fraud investigation.