Accounts Payable Fraud: Types, Red Flags, and Prevention

Accounts payable is where most of a company's money leaves the building, which makes it the part of finance fraudsters study hardest. The Association of Certified Fraud Examiners reports that organizations lose roughly 5 percent of revenue to fraud every year, and billing and check schemes that run through AP are among the most common and most expensive. The losses are rarely one dramatic event. They are usually small, repeated, and dressed up to look like ordinary invoices, which is exactly why they survive for an average of more than a year before anyone catches them.

This guide covers the fraud schemes that target accounts payable, the red flags that give them away, and the controls that actually stop them. It is written for controllers, AP managers, and business owners who sign the checks and want a practical defense, not a compliance lecture.

What accounts payable fraud actually is

Accounts payable fraud is any scheme that uses the invoice-to-payment process to move company money to someone who is not owed it. It can be committed by an outsider posing as a vendor, by an employee inside AP, or by the two working together. The mechanism is almost always the same: create a payable that looks legitimate, get it approved, and collect the payment before anyone reconciles it back to a real good or service.

What makes AP a target is volume and trust. A finance team processing thousands of invoices a month cannot inspect each one closely, so it relies on process and pattern. Fraudsters exploit the gaps in that process, the rushed approval, the vendor record nobody verified, the bank-account change that went through on an email request.

The most common accounts payable fraud schemes

Fraud in AP tends to fall into a handful of repeating patterns. Knowing the shape of each one is the first step to building a control against it.

Billing schemes and shell-company fraud

The classic internal fraud. An employee sets up a fake vendor, often a shell company with a real bank account and a plausible name, then submits invoices for goods or services that were never delivered. Because the same person frequently controls vendor setup and invoice entry, the payable sails through. Variations include billing for inflated quantities on a real vendor's account or paying a personal expense through a business vendor record.

Check tampering

An employee with access to outgoing checks alters the payee, forges a signature, or reroutes a legitimate check to themselves. Check tampering causes some of the largest median losses in the ACFE data because the person committing it usually has signing authority or physical control of the checks. It thrives where check stock is unsecured and bank reconciliations are done by the same person who cuts the checks.

Vendor email compromise and bank-change fraud

The fastest-growing external scheme. A fraudster impersonates a real supplier, often after compromising the supplier's email, and sends a routine-looking request to update banking details. The next legitimate invoice gets paid into the fraudster's account. The invoice is real, the amount is right, the only thing changed is where the money lands. This is why an emailed bank-account change should never be trusted on its own.

Duplicate and overpayment fraud

Some duplicate payments are honest mistakes, but a duplicate can also be engineered: submit the same invoice through two channels, or resubmit a paid invoice with a slightly altered number, and pocket the second payment or the vendor credit. The line between error and fraud is thin here, which is why detection matters as much as intent. Duplicate invoice detection software flags exact and near-duplicate bills before they are paid, whether the repeat is an honest mistake or engineered. We cover this pattern in depth in our guide to duplicate invoice payments and how to detect and prevent them.

Expense reimbursement and kickback schemes

Padded or fabricated expense reports, mischaracterized personal spending, and inflated mileage all route money out through AP. Kickback schemes are harder to see: an employee steers business to a vendor in exchange for a cut, often hidden inside prices that are a little too high. Collusion between a buyer and a vendor defeats single-person controls, so it usually surfaces through spend analysis rather than invoice review.

Red flags of accounts payable fraud

Most schemes leave fingerprints in the data and on the documents. None of these is proof on its own, but several together deserve a closer look.

• A vendor bank-account change requested by email, especially with urgency or just before a large payment is due.
• Invoice amounts that sit just below an approval threshold, for example a string of invoices at 4,950 dollars when sign-off kicks in at 5,000.
• A vendor address that matches an employee address, or a vendor reachable only through a P.O. box or a personal email domain.
• Missing details: no tax ID, no purchase order, vague line items, or invoice numbers that run in a neat sequence from one supplier.
• Round-number or even-dollar totals on a vendor whose real invoices are usually itemized to the cent.
• Pressure to pay fast or to skip the normal approval, framed as a favor or an emergency.
• A new vendor that appears, gets paid quickly, and goes quiet, or two vendor records with nearly identical names and the same bank account.
• Reconciliations that are always done by the same person and never reviewed by anyone else.

How to prevent accounts payable fraud

Prevention controls stop a bad transaction from entering or moving through the process. Detection controls surface what slipped past. A strong AP program uses both, layered so that no single failure exposes the company. Here are the controls that carry the most weight.

Separate the four AP duties

The single most important control is segregation of duties. The person who sets up a vendor should not be the person who enters invoices, who should not be the person who approves payment, who should not be the person who releases the money. When those four roles are split, no one individual can both create a fake payable and pay it. In a small team where you cannot fully separate them, require a second reviewer on vendor setup and payment release.

Control the vendor master file

Most fraud starts at the vendor record. Restrict who can add or edit vendors, require documentation for every new supplier (tax ID, W-9, a verifiable address and phone), and review the vendor master regularly for duplicates, inactive records, and anything that points to an employee. A clean vendor master also prevents the duplicate-vendor trick where two slightly different records funnel to the same account. A controlled vendor onboarding process that collects and verifies the tax ID, W-9, and bank details before the first payment closes off this entry point.

Verify every bank-account change out of band

Never change vendor banking details on an email alone. Call the supplier back on a phone number you already have on file, not one printed on the request, and confirm the change with a known contact. This one habit defeats the majority of vendor-email-compromise losses. Log who verified the change and when.

Enforce three-way matching and approval thresholds

Match every invoice to its purchase order and receiving record before it is paid, so you are paying only for what was ordered and received. Our guide to three-way matching in accounts payable walks through how this stops phantom invoices. Pair it with tiered approval limits and watch for invoices that cluster just under a threshold, a classic sign of someone gaming the limit.

Use positive pay and secure your check stock

If you still issue checks, enroll in positive pay or payee positive pay with your bank so altered or forged checks are flagged before they clear. Lock up check stock, restrict signature authority, and move as much spend as you can to controlled electronic payments with an audit trail.

Reconcile and audit on a schedule

Reconcile AP to the general ledger and to the bank every month, and have someone independent of the payment process review it. Verifying that cleared payments match real bank activity is how check tampering and unauthorized ACH transfers come to light; when you reconcile against the bank statement converted to a clean spreadsheet, mismatches are far easier to spot. Add periodic spend analysis to catch kickback patterns and run a duplicate-payment audit at least annually.

Train the team and open a reporting channel

People are the last line of defense. Train AP staff to recognize bank-change requests, BEC tactics, and pressure to bypass controls, and refresh that training every year. The ACFE consistently finds that tips are the number one way fraud is detected, so give employees a confidential way to report concerns. A culture where it is normal to question an unusual request prevents more loss than any single tool.

Accounts payable fraud and AI: the 2026 wrinkle

Two things changed recently. First, generative AI has made fraudulent documents and impersonation cheaper and far more convincing, with AI-assisted fraud attempts rising sharply over the past year. A fake invoice or a spoofed vendor email no longer has the spelling errors and clumsy formatting that used to give it away. Second, the same technology now powers the defense. Modern AP platforms learn each vendor's normal invoice patterns, flag anomalies a person would miss across thousands of documents, and catch near-duplicate submissions and out-of-pattern bank changes automatically. The takeaway for 2026 is that manual eyeballing alone no longer keeps pace, and the controls below should be backed by software that watches the whole stream.

How automation helps prevent accounts payable fraud

Automation does not replace judgment, but it enforces the controls consistently and removes the gaps fraud lives in. Accounts payable software captures every invoice as structured data, runs duplicate and anomaly checks on the whole stream, and holds an immutable audit trail of who touched each record. Routing invoices through a defined invoice approval workflow hard-codes segregation of duties and threshold limits so they cannot be skipped under pressure. Accurate invoice data capture standardizes vendor names and amounts so duplicate vendors and altered invoices stand out. Together these controls shrink the manual gaps where billing schemes, check tampering, and bank-change fraud take hold. Dedicated invoice fraud detection software layers vendor validation and bank-detail-change alerts on top, tuned specifically to catch fraudulent bills before they are paid. If you are evaluating tools, our comparison of the best AP automation software covers what to look for, and our overview of the accounts payable process shows where each control fits in the full cycle.

Frequently asked questions

What is accounts payable fraud?

Accounts payable fraud is any scheme that abuses the invoice-to-payment process to send company money to someone who is not owed it. It includes fake-vendor billing, check tampering, vendor bank-account-change fraud, duplicate-payment schemes, expense padding, and kickbacks. It can be committed by an outside party, an internal employee, or the two colluding.

What are the most common types of accounts payable fraud?

The most common types are billing schemes using shell or fake vendors, check tampering by employees with check access, vendor email compromise that reroutes payments through a fraudulent bank-account change, duplicate and overpayment fraud, and expense reimbursement or kickback schemes. The ACFE finds billing and check schemes cause the largest share of AP losses.

How do you prevent accounts payable fraud?

Prevent it by layering controls: separate vendor setup, invoice entry, approval, and payment into different hands; lock down the vendor master file; verify every bank-account change by phone using a known number; enforce three-way matching and approval thresholds; use positive pay on checks; reconcile and audit monthly; use accounts payable audit software to make those reviews continuous rather than month-end only; and train staff with a confidential reporting channel.

What are the red flags of accounts payable fraud?

Watch for emailed bank-account changes, invoices priced just below an approval threshold, vendor addresses matching an employee or only a P.O. box, missing tax IDs or purchase orders, round-number totals, pressure to pay fast, and new vendors that are paid quickly and then go silent. Several flags together warrant a closer review.

Who commits accounts payable fraud?

Both insiders and outsiders. Internal fraud is often committed by employees with access to vendor setup, invoice entry, or check signing, sometimes acting alone and sometimes colluding with a vendor. External fraud is usually committed by criminals impersonating real suppliers, increasingly through compromised email. Collusion between an employee and a vendor is the hardest to detect.

How does automation help prevent accounts payable fraud?

Automation enforces controls consistently and closes the gaps fraud exploits. It captures invoices as structured data, runs duplicate and anomaly detection across the whole stream, hard-codes segregation of duties and approval limits into the workflow, standardizes vendor data so duplicates stand out, and keeps a tamper-proof audit trail of every action for review and investigation.