Fraudulent disbursements are schemes in which an employee manipulates an employer’s own payment system — accounts payable, payroll, checks, expense reimbursement, or the cash register — to issue money for an illegitimate purpose. Because the payments move through normal channels, the losses hide inside routine activity and often grow for years before anyone notices. The four scheme families to know are billing fraud, check tampering, payroll and expense reimbursement fraud, and register disbursement fraud. Each has its own tells, its own controls, and its own federal exposure.
Billing Schemes
Billing fraud exploits the one thing every organization does constantly: pay invoices. The employee manipulates accounts payable so the company sends money it should never have spent.
Shell Company Invoicing
The employee registers a legal entity with a name that sounds like a real supplier, opens a bank account for it, and begins submitting invoices for goods or services the company never received. The invoices look routine and often fall below the dollar threshold that triggers extra scrutiny, so they sail through approval. The perpetrator collects the payments, sometimes for years, before anyone notices the company has no record of receiving what it supposedly bought.
Pass-Through Schemes
Here the goods actually exist. The employee buys them at the real price and resells them to the employer through a middleman entity at a markup. The company gets its supplies, so there is no inventory gap. The fraud lives in the price difference, and organizations tend to catch it during audits when someone compares paid prices against market rates.
Personal Purchases on Company Accounts
Some employees skip the vendor fiction and charge personal expenses directly to the company: home electronics coded as office equipment, luxury goods buried under a maintenance line. Whoever reviews the charges sees a plausible description and moves on. These schemes run especially long in organizations with broad expense categories and no receipt matching.
Check Tampering
Check tampering manipulates the checks themselves rather than the invoices behind them.
Forged Maker Schemes
The employee gains access to blank check stock and forges an authorized signer’s name. Success depends on the quality of the forgery and whether the bank actually compares signatures during processing. Banks rarely scrutinize signatures on checks below certain amounts, which gives the forger room to work.
Forged Endorsement and Altered Payee Schemes
A forged endorsement scheme starts with a legitimate check. The company issues a check to a real vendor or employee, but the fraudster intercepts it before delivery and endorses the back in the payee’s name to deposit it into a personal account. Altered payee schemes take a different angle: the perpetrator changes the payee name on a prepared check, sometimes using chemicals to remove ink, sometimes making manual corrections. Adjusting the dollar amount upward is a common add-on. When these schemes involve checks cleared through a bank, they can trigger federal bank fraud charges carrying penalties of up to 30 years in prison and fines up to $1,000,000.1Office of the Law Revision Counsel. 18 U.S. Code 1344 – Bank Fraud
Authorized Maker Schemes
This is the hardest type to catch. The signer has legitimate signing authority, so the signature is real and the bank has no reason to flag it. The employee writes checks to themselves, to fake companies, or for personal expenses, then buries them in the accounting records as payments to known vendors. These schemes typically survive until someone digs into the underlying documentation or notices that a vendor’s address matches the employee’s home.
Payroll and Expense Reimbursement Fraud
Ghost Employees
Ghost employee schemes add fictitious people to the payroll so the perpetrator can collect the extra paychecks. The fraudster might use a Social Security number belonging to a deceased person or a former employee whose records were never cleaned out. The checks get intercepted or routed to a bank account the fraudster controls. Large departments with high turnover are especially vulnerable because headcount fluctuations make an extra name less conspicuous.
Commission and Bonus Fraud
Sales staff with access to their own performance records can inflate numbers to trigger higher commissions by altering contract prices, recording sales that never closed, or counting the same deal twice under different codes. Managers who trust automated sales reports without spot-checking the underlying data hand the keys to the bonus pool to the people with the most incentive to cheat.
Expense Reimbursement Fraud
Expense fraud thrives wherever managers rubber-stamp reimbursement requests without verifying receipts. Employees submit fictitious travel costs, claim personal meals as business meetings, or resubmit the same receipt across different reporting periods. When these payments move through electronic transfer or the mail system, the conduct can expose the perpetrator to federal mail fraud or wire fraud charges, each carrying up to 20 years in prison.2Office of the Law Revision Counsel. 18 U.S.C. 1341 – Frauds and Swindles3Office of the Law Revision Counsel. 18 U.S.C. 1343 – Fraud by Wire, Radio, or Television
One structural defense against expense fraud is maintaining an IRS-recognized accountable plan. Under Treasury Regulation 1.62-2, an accountable arrangement requires employees to substantiate the business purpose of each expense, provide adequate documentation within 60 days, and return any excess reimbursement within 120 days.4Internal Revenue Service. IRS Publication 535 – Business Expenses Enforcing those requirements makes it much harder for personal expenses to slip through.
Register Disbursement Schemes
Register disbursement fraud happens at the point of sale and exploits the cash register’s own transaction records. Individual amounts tend to be small compared to billing or payroll fraud, but frequency adds up.
In a false refund, an employee processes a return for a purchase that never happened and pockets the cash. The register balances at the end of the day because the refund documentation accounts for the missing money. A false void works in reverse: the employee rings up a legitimate sale, takes the customer’s payment, then cancels the transaction after the customer leaves. The voided receipt explains why the cash is gone. Retailers combat both methods by requiring supervisor approval for every refund or void.
Red Flags and Detection
Behavioral Warning Signs
Lifestyle changes that don’t match an employee’s salary are the most visible red flag. Expensive cars, frequent high-end vacations, or a sudden home upgrade should prompt questions when the paycheck can’t plausibly support the spending. Equally telling is the employee who refuses to take vacation or share duties. Fraudsters know a substitute handling their work for a week might notice discrepancies they have been carefully managing. Territorial behavior over financial processes is one of the strongest indicators that something is wrong.
Watch also for employees who insist on using a particular vendor despite better pricing elsewhere. That loyalty, especially combined with resistance to competitive bidding, often points to a kickback arrangement or a shell company the employee controls. Increased defensiveness when questioned about financial procedures is another common tell.
Documentary Red Flags
The paper trail usually gives up the fraud before the person does. Invoices with sequential numbers from the same vendor suggest the company may be that vendor’s only client, a hallmark of a shell entity. Post office box addresses instead of physical locations, duplicate payment amounts to different vendors, and multiple vendors sharing the same mailing address all warrant investigation. On the check side, handwritten endorsements or signatures that don’t match authorized personnel are obvious flags. Missing original documents are as suspicious as altered ones.
Data Analysis Using Benford’s Law
Forensic accountants use Benford’s Law as a fast screen for manipulated numbers. In naturally occurring datasets, the leading digit is a 1 about 30% of the time, a 2 about 17.6% of the time, and so on in a predictable logarithmic curve. Fabricated transaction amounts rarely track that distribution. An auditor can run disbursement data through the test using basic spreadsheet functions and flag anomalies for deeper review. The test works best with at least a hundred data points, and a deviation is a red flag rather than proof, but it gives investigators a focused starting point.
Prevention Controls
Segregation of Duties
The single most effective structural defense is making sure no one person controls an entire payment cycle. At minimum, the employee who requests a purchase should be different from the one who approves it, who should be different from the one who processes the payment and the one who reconciles the bank statement. When the same person can create a vendor, approve an invoice, and cut a check, a shell company scheme becomes almost trivially easy. Small organizations can compensate by rotating financial roles, requiring owner or board review of high-value payments, and bringing in external auditors on a regular cycle.
Maintaining an approved vendor list with independent verification is another practical step. Before any new vendor receives a payment, someone outside the requesting department should confirm the vendor’s physical address, tax identification number, and business registration. Pre-numbered purchase orders help prevent unauthorized or duplicate orders, and independent reconciliation of invoices against purchase orders and receiving records catches phantom shipments before the check goes out.
Positive Pay and Banking Controls
Positive pay is a bank-managed service that catches forged, altered, or counterfeit checks before they clear. Whenever the company issues checks, it uploads a file to the bank containing each check’s number, amount, and sometimes the payee name. When a check is presented, the bank compares it against the file. If the details don’t match, the bank flags the check as an exception and notifies the company, which then decides whether to approve or reject the payment. Payee-level positive pay adds verification of the name on the check, which specifically targets check washing and altered payee schemes. For any organization still relying on paper checks, this service closes the gap that makes authorized-maker and altered-payee fraud possible.
Federal Criminal Penalties
Fraudulent disbursements can trigger several overlapping federal statutes depending on how the money moves and who the victim is. Penalties are steep enough that even a first offense involving modest amounts can result in years of imprisonment.
Mail fraud and wire fraud are the most commonly charged statutes in disbursement cases. Both carry a maximum of 20 years in prison per count.2Office of the Law Revision Counsel. 18 U.S.C. 1341 – Frauds and Swindles3Office of the Law Revision Counsel. 18 U.S.C. 1343 – Fraud by Wire, Radio, or Television Fines for individual defendants can reach $250,000 per count under the general federal sentencing statute.5Office of the Law Revision Counsel. 18 U.S.C. 3571 – Sentence of Fine If the fraud affects a financial institution, both statutes carry an enhanced maximum of 30 years and a $1,000,000 fine. Each individual mailing or wire transmission can be charged as a separate count, so a scheme involving dozens of fraudulent payments generates exposure that compounds quickly.
Bank fraud applies when the scheme involves deceiving a financial institution to obtain its funds. The maximum penalty is 30 years in prison and a $1,000,000 fine, one of the most severe charges available in check tampering cases where forged or altered checks are processed through a bank.1Office of the Law Revision Counsel. 18 U.S. Code 1344 – Bank Fraud
Employees of organizations that receive more than $10,000 per year in federal funds face an additional statute. Stealing $5,000 or more from such an organization carries up to 10 years in prison.6Office of the Law Revision Counsel. 18 U.S.C. 666 – Theft or Bribery Concerning Programs Receiving Federal Funds That covers a wide range of employers, including hospitals, universities, state and local government agencies, and nonprofits receiving federal grants.
Recovering Stolen Funds
Criminal Restitution
Federal courts must order restitution for property offenses committed by fraud, including fraudulent disbursement schemes, whenever there are identifiable victims who suffered financial loss.7Office of the Law Revision Counsel. 18 U.S.C. 3663A – Mandatory Restitution to Victims of Certain Crimes The order becomes part of the criminal sentence and the government enforces it. Restitution cannot be discharged in bankruptcy, and the government can pursue collection for 20 years from the date of judgment or 20 years after the defendant’s release from prison, whichever is later.8Office of the Law Revision Counsel. 18 U.S.C. 3613 – Civil Remedies for Satisfaction of an Unpaid Fine
Restitution has limits. It typically covers only the principal amount stolen and does not include attorney fees or tax penalties the victim incurred because of the fraud. Victims who discover additional losses after judgment have 60 days to petition the court for an amended order, provided they can show good cause for not including the amount originally.9United States Department of Justice. Understanding Restitution
Fidelity Bond Insurance
Many organizations carry fidelity bond coverage for employee dishonesty. These policies cover losses from fraudulent acts committed with the intent to cause the employer a loss and obtain a financial benefit. Standard bonds carry both a per-loss limit and an aggregate limit for the policy period, so a single large fraud can reduce or exhaust coverage for later claims. One detail that trips up policyholders: losses generally must be reported to the bonding company within 30 days of discovery, and missing that window can jeopardize the entire claim.10Federal Deposit Insurance Corporation. Fidelity and Other Indemnity Protection – Section 4.4
Tax Treatment of the Loss
A business that suffers a loss from employee theft can deduct the unrecovered amount on its federal tax return. The deduction is taken in the year the loss is discovered, not the year the theft actually occurred, and the amount must be reduced by any insurance recovery or restitution payments received. For individuals who suffer a theft loss connected to a trade or business or a for-profit transaction, the deduction applies under the same rules.11Office of the Law Revision Counsel. 26 U.S.C. 165 – Losses If a fidelity bond is in place, a timely insurance claim must be filed before deducting the insured portion of the loss.
Whistleblower Protections for Employees Who Report
Employees who discover disbursement fraud and report it have federal protection against retaliation. Under the Sarbanes-Oxley Act, publicly traded companies cannot fire, demote, suspend, or otherwise punish an employee for reporting conduct the employee reasonably believes violates federal fraud statutes, including the mail fraud and wire fraud provisions above.12U.S. Department of Labor. Sarbanes-Oxley Act of 2002, Section 806 The protection applies whether the employee reports to a federal agency, a member of Congress, or a supervisor within the company.
An employee who experiences retaliation can file a complaint with the Department of Labor within 180 days of the retaliatory action.13Occupational Safety and Health Administration. Tolling of Limitation Periods Under OSHA Whistleblower Laws If the Department does not issue a final decision within 180 days, the employee can take the case directly to federal court. Remedies for a successful claim include reinstatement, back pay with interest, and compensation for litigation costs and attorney fees.12U.S. Department of Labor. Sarbanes-Oxley Act of 2002, Section 806 The federal protections do not replace rights under state whistleblower laws, which may offer broader coverage or longer filing windows.