What is the most common AP fraud?

Fake vendors and inflated invoices, duplicate payments, and employee-vendor conflicts. Controls focus on vendor master integrity, independent approval, and payment release separation.

How do you prevent duplicate payments?

System duplicate check on invoice number plus amount plus vendor, PO matching, and monthly duplicate report review before payment run.

Who should approve vendor changes?

Someone outside AP entry, with callback to known contact for bank changes. AP should never both create vendors and release payments.

What does audit test in AP?

Cut-off, PO support, approval evidence, segregation, and subsequent disbursements. Missing support or self-approval are findings.

AP and Vendor Fraud Prevention Checklist: Controls That Stop Fake Invoices in 2026

Why AP Is the Fraud Front Door

AP combines master data, approvals, and cash release — perfect for Occupational Fraud.

Use with Procurement Fraud, Fraud Prevention, Month-End Close, and SOX 404.

Control Checklist

Risk	Control	Evidence
Fake vendor	Request ≠ approve; verification + conflict check	Vendor log + approval
Bank change hijack	Callback to known number, dual approval	Call log + change ticket
Duplicate invoice	System block + monthly duplicate report	Report + follow-up
Split POs	Threshold monitoring + manager review	Exception report
Self-approval	AP entry ≠ approval ≠ release	Role report — see QuickBooks vs Xero
Cut-off games	GRNI accrual + 3-way match	GRNI aging + PO tie

Automate where possible — see Automating AP and Expense Management.

Month-End AP Tests (15 Minutes)

Age AP; investigate >60-day and debit balances.
Run duplicate invoice report; resolve before payment run.
Review vendor master changes and bank-change log.
Match GRNI to receiving; accrue with support.
Tie AP to GL and subsequent cash — see Bank Rec.

Retain per Audit Procedures: preparer, reviewer, date, support.

Red Flags to Escalate

Vendor with PO box only, no website, round-dollar invoices.
Employee address = vendor address.
Urgent out-of-channel payment requests.
Repeated just-below-threshold invoices.

Escalate via Whistleblower channel; report themes to Audit Committee.

Worked Example: The $62k Fake Vendor

March: “IT support” vendor onboarded by AP clerk with a Gmail address and PO box; no verification call. April–June: 11 invoices, $4,800–$6,200 each (just under the $6,500 approval threshold), approved by the same clerk’s buddy in operations. July: payment run releases $62k total. Discovery: employee address matches vendor address — a relative’s shell. Recovery: $9k. The three missing controls, each cheap: (1) verification call to a known number at onboarding would have failed immediately; (2) threshold monitoring would have flagged 11 sub-threshold invoices to one new vendor; (3) segregation (requester ≠ approver ≠ releaser) would have broken the chain at two points. Total prevention cost: ~2 hours of procedure. Compare with Occupational Fraud patterns and Procurement Fraud schemes.

Threshold Evasion Detection (Just-Below Patterns)

Pull all invoices within 5% below each approval threshold, grouped by vendor, for the last 6 months:

Signal	What it means	Action
8+ invoices at 95–99% of threshold, one vendor	Deliberate splitting	Freeze vendor, investigate, expand sample
Round-dollar invoices just under threshold	Fabricated amounts	Request contracts/delivery proof
Sequential invoice numbers from “established” vendor	Generated, not operational	Verify business existence independently
Approval always by same person for one vendor	Collusion risk	Rotate approvers, review history

Run this quarterly, not annually — splitters adapt to annual reviews. File the exception report with disposition (cleared/escalated) in the close packet — see Month-End Close — and report themes to the Audit Committee.

Vendor Master Hygiene (Quarterly Ritual)

Deactivate: no activity 12 months → inactive; reactivate only through full onboarding. Dormant vendors are the reactivation vector for fraud.
Deduplicate: fuzzy-match names, addresses, bank accounts, tax IDs. Merged duplicates hide split payments and double master records.
Re-verify: top 20 by spend + all bank changes in the quarter get callback confirmation to known numbers.
Conflict-screen: employee addresses, phone numbers, and bank accounts against vendor records. Matches go to the Whistleblower protocol, not to the AP manager’s discretion.

Automate matching and fuzzy logic where volume justifies it — see Automating AP — but keep human approval on master changes. No system stops a duly-approved fake vendor; the approval is the control.