How invoice fraud happens: three patterns that look routine
The most convincing invoice-fraud attempts look ordinary. Three patterns worth checking before a bill reaches approval, and what to do when one shows up.
Invoice fraud rarely looks like a fake invoice. The document has the right supplier name, a familiar layout and an ordinary amount. The risk sits in how this bill differs from the paperwork that came before it.
Start with what changed
A useful review asks what changed since the last invoice you trusted: the bank account, the number of invoices this month, the approval path, the order it bills against. That turns fraud review from a visual spot-check into a control anyone on the team can repeat.
A new bank account on a real-looking invoice
The classic diversion: a supplier's mailbox is compromised, and a genuine-looking invoice arrives asking to be paid into a new account. Nothing else is wrong with it.
The recovery step matters more than the detection. Confirm the change with the supplier through a channel you already had, such as a number from an earlier contract. Replying to the email that carried the invoice is not that channel, because that mailbox may be the one compromised.
DocuBite compares the bank account on each invoice with the one on file for the supplier, and holds the bill when it changes. The bank-details check, in detail, including what it does not cover yet.
Several invoices, each just under the line
If bills above a certain amount go to a second approver, that amount becomes a target. Several invoices from one supplier, each just below it, can add up to a large sum in a few weeks.
DocuBite looks for that crowding: invoices from the same supplier inside a short window whose total comes close to the amount at which your routing asks for more review, while each stays below it. A flag is not a verdict that every small invoice is fraud. It is a reason to look at the supplier, the timing and the orders together.
The same invoice, sent again
The same invoice can come back as a re-scan or a phone photo, so comparing files alone misses it. Supplier, invoice number and total say more, and a number one character off is often a misread or a deliberate resubmission.
Duplicate checks should explain themselves rather than merge documents quietly. A credit note or a corrected re-issue can legitimately resemble an earlier bill, so the check names the earlier invoice and leaves the decision with a person.
A control loop to keep
- Compare the supplier's bank details with what you already know.
- Look at the supplier's recent invoices together, not one at a time.
- Keep doubtful bills visible, with the reason and the next step to verify.
- Record what was decided, so the next review starts with context.
No software spots every fraud. The aim is to make the suspicious change hard to miss and quick to investigate.