Accounts Payable Fraud: Where It Hides in Your Ledger

Accounts payable is the door most of a company's cash leaves through. It is also the door fraud chooses. A padded invoice, a duplicate payment, a diverted bank transfer: all of it passes through the vendor list, the bill entry screen, and the bank reconciliation. That is your advantage. Fraud that travels through the ledger leaves marks in it, and reading those marks is bookkeeping work. So is prevention. Here is where the schemes sit, what they look like in the records, and what to do when the pattern stops looking like error.

The schemes a bookkeeper actually meets

Four patterns cover most of what you will ever see.

• Shell or inflated billing: a fake vendor, or a real one padding quantities and prices.
• Duplicate payment fraud: the same invoice paid twice, with the second payment quietly redirected.
• Personal spend through company payables: costs dressed up as supplies, repairs, or consulting.
• Payment diversion: bank details on a genuine vendor changed, so the money lands somewhere else.

Cheque tampering still exists, but it is rarer where payments run through a bank file.

The marks fraud leaves in the ledger

None of these schemes can avoid the ledger, so learn the marks.

• A vendor created and paid within a day or two, with no purchase order behind it.
• Vendor details matching an employee's address, phone, or bank account.
• Invoice numbers from one vendor arriving in unbroken sequence. Real invoice streams skip numbers.
• Round amounts, repeating monthly, for services nobody can point to.
• Amounts sitting just under the approval threshold, again and again.
• A duplicate with a tweaked number: invoice 4471 paid, then 4471A two weeks later for the same sum.
• A dormant vendor reactivated after months of silence.
• Manual payments or cheques made outside the normal run.
• A vendor bank detail change, then a quiet change back a few weeks later.

Here is a worked example. A monthly invoice for 2,450 arrives from a facilities consultant. No contract exists, no one recalls the work, and each invoice number is exactly one higher than the last. The approver is the same person every month. Each fact alone is nothing. Together they are a finding, and they took ten minutes of reading the vendor history to see.

Does the ledger show fraud or honest error?

Honest error is messy and evenly spread. You find late postings, misclassified costs, and missed matches across many vendors at once. Fraud is narrow and tidy. The paperwork for the target vendor is immaculate, while the documents underneath are thin, missing, or photocopied.

The other signal is people. For any odd payment, ask three questions: who set the vendor up, who entered the bill, and who approved it. One name answering all three is the loudest warning a small ledger can give you.

What does fraud do to the close?

Fraud reaches the close in two ways. Cut-off games push a payment into the wrong period, so it lands outside the window being reviewed. Quiet reversals of accruals hide a cost that had no business being recorded at all.

Watch the bank reconciliation too. Cleared items paying payees nobody recognizes are a finding, not reconciliation noise. So is a generic expense account, consulting or repairs, growing month on month with no story behind it.

Controls that stop the money leaving

The principle is simple: no one person should set up vendors, enter bills, approve payment, and reconcile the bank. Small practices break that rule by necessity. Compensating controls then matter more, not less.

• The owner reviews the payment list before the bank file goes out, every time.
• The bank requires a second approval above a set amount.
• Bills are matched to a purchase order or a goods receipt before entry, at least above a floor amount.
• Vendor statements are reconciled monthly, and differences are chased.
• Duplicate checks run on vendor, invoice number, and amount before each payment run.

Keep the approval threshold quiet. If the person entering bills knows the limit, every padded invoice will sit just under it.

Bank detail changes deserve their own rule

Payment diversion needs no insider. A convincing email, a lookalike domain, and a changed account number are enough. Treat any bank detail change as an event. Verify it by phone, using the number from the original vendor setup, never one from the email itself. Log who asked, and when, and let the change sit a day before payment. A genuine supplier will not mind. A fraudster will mind very much.

What should you preserve first?

The moment you suspect fraud, your job changes from recording to preserving. Stop posting in the affected area. Take a dated copy of the ledger before anyone else touches it. Export the audit log and user activity report, because deletions and edits will not wait for you. Keep the original invoices and emails, and write a dated note of what you saw.

Do not tidy up. Deleting the fake vendor or reversing the payments feels helpful and destroys evidence. Do not confront anyone yet either. The order is: preserve, quantify, tell the owner, then bring in specialists.

When does it stop being bookkeeping?

Quantifying a loss for an insurer, interviewing staff, and meeting the standards a court expects are forensic work. A certified fraud examiner or forensic accountant should lead from the point the suspicion is firm. Keep closing your months and reconciling in the meantime; a clean current ledger is itself evidence.

There is a data edge to this. When someone has deleted transactions or edited history to hide the trail, the story may still live inside the file. Recovering it is specialist data work, and where tampering has damaged the file, repair comes before analysis. We do that part. The accounting judgement around it stays yours.

Finally, the treatment of a recovered or written-off loss, for tax and for the insurance claim, depends on jurisdiction and policy. Note the facts, flag the dependency, and let the advisor choose the treatment.