Supplier invoice fraud: signals to detect it before payment

Fraud in accounts payable comes in by email, with an invoice so similar to a real one that it passes the first human filter and sometimes the second. The last line of defence is not the bank; it is the control on how the invoice is validated before it leaves the ERP.

This article captures the five fraud patterns most often seen at SMEs, the signals before payment and how to hold suspicious invoices before anyone approves them.

Which types of vendor invoice fraud arrive by email?

1. Ghost supplier. A supplier that does not exist, set up with plausible data but no real activity. Comes through internal collusion or weak onboarding.
2. BEC (Business Email Compromise) on a real supplier. The attacker compromises or impersonates a legitimate supplier’s email and sends an authentic invoice with a changed IBAN. The most expensive per ticket.
3. Deliberate duplicate invoice. The supplier resends a paid invoice with small variations. See detect duplicate invoices.
4. Colluded over-invoicing. Employee and real supplier agree to invoice at inflated prices and split the overcharge. The header matches; the lines do not.
5. Inflated no-PO invoice. Services or consulting invoiced above what was delivered, with no formal PO to match against.

All five leave a trace before payment. The question is not whether the signals exist; it is whether your process sees them in time.

How much can invoice fraud cost a company?

A recurring sector estimate: organisations lose on average 5% of annual revenue to internal fraud, and billing fraud is among the most frequent and expensive categories per case.

In Spain, INCIBE publishes regular advisories on CEO fraud and BEC. The Spanish tax authority, with SII and Verifactu, reinforces document traceability, which also hardens the AP chain.

Which signals reveal a fraudulent invoice before payment?

The signals below are universal: they do not depend on country, sector or supplier.

1. New bank account vs supplier history.
2. IBAN from a different country than the supplier’s tax residency.
3. Account change communicated by email only, no verified phone contact.
4. Sender domain similar but not identical to the historical one (typosquatting).
5. Round amount just below the approval threshold (EUR 4,999, EUR 9,950).
6. Missing PO on purchases that normally carry one.
7. Missing delivery note on physical purchases that require receipt.
8. Invoice date earlier than PO date.
9. Tax ID that does not resolve in public databases or belongs to another legal entity.
10. Non-sequential invoice number vs supplier pattern.
11. Total matches but lines don’t: overprice on one line offset by discount on another.
12. Generic concept (“professional services”) without hourly breakdown or deliverable.
13. Supplier set up <60 days ago with a first high-value ticket.
14. Unusual urgency in the email (“pay today”, “the bank is closing”).
15. Invoice received outside the real sender’s working hours.

A single signal rarely justifies a block. Three or more demand review. Specific combinations (new account + similar domain + urgency) are an immediate red flag.

How does vendor email compromise (BEC) work?

AP-targeted BEC works like this: the attacker compromises the supplier’s email (or spoofs their domain with a typosquat) and sends a real invoice, sometimes copied from a previous one, with one single change: the IBAN.

What makes it hard: the PDF is often authentic, the amount fits the real pattern and arrives when the actual supplier was going to invoice. What gives it away: the IBAN was not there before, the domain differs by one letter or changes TLD, and the email introduces urgency or asks for confidentiality.

Effective control: compare IBAN against supplier history and require out-of-band verification (call to the known phone number, not to the one in the email) for any account change.

How do you detect a ghost supplier?

The ghost supplier sneaks into master data. Clues are about the supplier more than the invoice: tax ID that does not resolve, tax address that matches an employee’s or a virtual mailbox, phone and email for personal use, first invoice a few days after setup, concept outside the usual catalogue, payments always just below the approval threshold.

Preventive control: validate tax ID and address at setup and review the first payment with a second approver, regardless of amount.

How do you catch a deliberate duplicate invoice?

ininvoice holds a possible duplicate invoice when it repeats the normalised number of another invoice from the same supplier, or the same supplier, amount and date, and a person decides. If only the amount matches on dates less than 30 days apart, it warns without holding.

Not a filing error: the supplier resends an already-paid invoice with small variations so the system does not flag it as an exact duplicate (same amount with a varied number, scan at different resolution, PDF and FacturaE in the same month, two channels in parallel).

Clean detection does not rely on the number alone: it also compares supplier, amount, date and lines. More in detect duplicate invoices, and in the duplicate invoice controls: ininvoice holds an invoice with the same normalised number from the same supplier, or with the same amount and date, for a person to decide, and never processes the same file twice.

How do you detect colluded over-invoicing?

Subtle. An employee with approval power agrees with a real supplier that invoices come inflated, sharing the overcharge. The approver signs, the supplier exists, the delivery note is received.

The signals are patterns, not events: unit price systematically above market, anomalous supplier concentration on a single approver, 100% approval rate with no exceptions ever, and overpriced lines offset by discounted lines that leave the total tidy.

That is why honest three-way matching is line by line, pre-tax, on unit price, never on the header. The total never lies, but the lines do.

How does a risk level per invoice help?

A risk level per invoice applies the same fraud checks to every invoice, which no person can sustain at volume. A reasonable policy for your team, by risk level:

• Low: if it passes three-way matching, it is ready for a person to approve.
• Medium: reviewed in the normal queue before approval.
• High: held until the supplier is verified through an independent channel.

In ininvoice every case gets a low, medium or high risk level derived from the matching verdict, with the reason shown, and every invoice is approved by a person.

The signals that weigh most: IBAN change on an existing supplier, look-alike domain, missing PO in categories that always carry one, tax ID that does not resolve, first invoice from a recently set up supplier. The risk level is not the final word: it is the filter that prioritises what the human looks at. Invoices that match are left ready for a person to approve; see touchless AP.

How do you prevent vendor invoice fraud?

1. Onboarding with validated tax ID against public registries and bank verification via an independent channel.
2. Line-by-line three-way matching with 2% / EUR 1.50 OR-mode tolerance (see invoice-to-PO-to-receipt matching).
3. Duplicate detection by fingerprint, not just by number.
4. Risk levels that hold high-risk invoices until they are verified.
5. Segregation of duties: approver ≠ payer, and two approvers on first payment to a new supplier.

What should an internal auditor check?

• New suppliers with validated tax ID and first payment reviewed by two approvers.
• High-risk invoices: documented justification from the approver.
• IBAN changes with logged out-of-band verification.
• Invoices with no PO in categories that normally carry one: nominal review.
• Supplier-approver concentration >30% of volume without justification.
• Zero exceptions from a single approver for >6 months: a signal, not a virtue.

FAQ

What is the most expensive AP fraud type per case?

BEC (vendor email compromise). The attacker moves real invoices with a changed account and tickets range from thousands to hundreds of thousands of euros.

Does the two-pairs-of-eyes check catch BEC?

Helps, but is not enough. If both approvers look at the PDF and the PDF is fine, it goes through. What fails is not comparing the IBAN against history. That is a system job.

What does the tax authority require on AP fraud prevention?

The Spanish AEAT pushes SII and Verifactu for tax traceability. Not AP anti-fraud per se, but it structures the data and makes invented invoices harder.

Is 5% of revenue lost to fraud realistic?

It is an aggregate sector average. The distribution is skewed: many companies have small or zero losses and a few have large ones.

Is a risk score enough on its own?

No. It is the layer that prioritises what to look at. Without three-way matching, segregation of duties and supplier onboarding validation, the score detects less.

Does this work if I still receive paper invoices?

It works worse. Signals like sender domain or send time only exist in email. Migrating invoice intake to a single AP inbox is step zero.

What should you remember about vendor invoice fraud?

1. AP fraud leaves a trace before payment. The question is whether your process sees the signals in time, not whether they exist.
2. Signals are universal: new account, similar domain, missing PO, tax ID that does not resolve, total matches but lines don’t.
3. A risk level per invoice, with line-by-line three-way matching and segregation of duties, closes the gap that even two pairs of eyes miss.

To see it on your invoices, try ininvoice with your own invoices. Pricing is tailored: a proposal sent within 48 hours of reviewing your invoices.

Related content

• Touchless AP: what it means in practice
• Spotting duplicate invoices early
• Three-way matching for finance teams
• Price variance invoice vs PO
• Common supplier invoice errors