Actionable Tips to Prevent Invoice Fraud

I’m sure you’ve heard the expression “the best defense is a good offense,” right? It means that it’s better to have proactive plans in place rather than reacting to situations as and when they come up. When it comes to invoice fraud, that expression couldn’t be more true. 

We recently talked about the signs of invoice fraud and how you can spot them. Since invoice fraud is such a wide-spread issue, it might feel like you’re doing nothing but spotting signs. But the unfortunate truth is that if you’re spending all your time putting out fires, you could miss further risks.

So, what do you do if you’ve spotted signs of invoice fraud? Well, the key is to prevent invoice fraud before it becomes a problem. Don’t worry, you don’t need a crystal ball or superpowers to get ahead of invoice fraud. Instead, you should set up internal processes and controls so you can stop fraud in its tracks. 

Let’s take a look at a few of the most common types of invoice fraud and what you can do to prevent them.

Everybody makes mistakes, but what if those mistakes aren’t all that accidental? Duplicate invoice payments happen when a fraudster sends an invoice almost exactly like an invoice you’ve already paid to try and get you to pay it twice (but the second one is being paid to a fraudster, not a legitimate vendor). The scammer might change things like the invoice number or the date to try and work their way into your existing workflow in the hope that your company sends the money automatically.

Duplicate invoices are a problem no matter what the cause, but sometimes they aren’t malicious. Sometimes, simple invoicing errors can lead to duplicate invoice payments. But no matter what, if you’re paying the same invoice twice, it’s a problem when it comes to your bottom line. 

Thankfully, you can protect yourself from duplicate invoice payments by keeping a close eye on your Accounts Payable portfolio. Reducing the amount of manual entries is a great way to keep your system running smoothly and to reduce duplicate invoices. 

Since your business prides itself on being a reliable payer with a low Days Beyond Terms (DBT), your AP team pays out invoices within the payment terms (or as close to it as possible). Now picture this. Your company has worked with a vendor for the last two years and things have gone smoothly throughout that time. And based on the  master vendor contract, you have agreed to a set fee each month that should never change in return for goods produced and delivered by the vendor. But then your AP team receives an invoice from this vendor one month, where the payment amount is much higher than usual. Something doesn’t seem right. What should your team do?

This would be a clear case of overbilling. It’s a type of invoice fraud that can go unnoticed for a long time, especially in industries like professional services. They could inflate invoices by adding extra billable hours they haven’t actually worked or include hidden fees and surcharges. In more extreme cases, they could charge you for products you never ordered or received. 

In 2019, for example, a cleaning company called A-1 Janitorial sent companies “free samples” of their products. Once they had an in at the company that accepted the products, A-1 Janitorial sent invoices to those companies asking for the full cost as payments. If a business fell into the overbilling trap and paid up, the cycle continued. A-1 Janitorial sent more products and invoices. In the end, the Federal Trade Commission had to refund more than $2.6 million to the affected businesses. Overbilling can be a gray area. Sometimes labor costs end up being more than expected when a service takes longer than you thought. But when there’s a pattern of consistent “mistakes” that point to a clear fraud scheme, the offending company could be breaking federal law. 

When working with vendors, you should always create and countersign a master vendor contract with them. This contract should include important information related to your working relationship with the vendor, including the start and end date of the working relationship (depending on how many years of a contract you’re signing), the scope of work agreed to by each party, payment terms, rates and payment amounts (if recurring), payment schedule, payment method (i.e. check, direct deposit, wire transfer, etc.), bank account details, termination clause and more. When you receive an invoice from your vendors, make sure all the information (every month) matches what has been agreed to in the master vendor contract.

Wouldn’t it be nice if businesses just sent you money on a regular basis, without you having to do any work? The criminals who run altered invoice fraud schemes think so, too. In this type of fraud, invoices are intercepted (usually through hacking) on their way to you. From there, the criminals change key information, like bank accounts, mailing addresses or email addresses, so that the money you owe a vendor goes to the scammer instead. 

Always be wary if a company asks you to send money in a way you haven’t already agreed to. If a business asks you to send money to a different bank account, for example, you should contact them directly to see if it’s really them asking. Sometimes though, scammers won’t even make the request. Instead, they’ll subtly change the banking information and hope that you pay it without looking too closely at the details. To prevent this type of invoice fraud your team needs to carefully review every invoice submitted by vendors. There should be accurate and-up-to-date invoicing information listed in each master contract to cross-check against invoices. 

We all know the phrase “time is money.” But sometimes speed can be your biggest enemy. Scammers know this and use urgency as a way to get people to fall for their traps. After all, if you got an email from your CEO demanding a client be paid immediately, you’d probably consider dropping everything to get it done. Unfortunately, that’s exactly what fraudsters are banking on: you losing your cool and sending the money without thinking it through and triple-checking things to make sure the invoice is legitimate and for services performed/goods delivered. 

In 2020, Shark Tank judge Barbara Corcoran was targeted by a scam like this. A scammer emailed Corcoran’s bookkeeper, pretending to be her assistant. In reality, the email address they used left off one letter of the assistant’s name. They told the bookkeeper that Corcoran was renovating an investment property in Europe and said they needed nearly $400,000 sent immediately to the renovators. Since Corcoran is so well known for her real estate investments, her assistant thought anything of it. The money was sent right away. 

When in doubt, slow down. I’m sure the actual CEO would much rather a payment was sent a few hours later to the right person, as opposed to making a speedy, large payment to a criminal. In the case of Barbara Corcoran, for example, this kind of thinking is what killed the scam. The bookkeeper sent an email asking for more information about the wire transfer and CC’d Corcoran’s actual assistant. They quickly figured it out from there and the bank was able to freeze the money before it got to the scammers.

It’s your business: you know when someone’s ordered something and when they haven’t.

But can you really be so sure? Between 2013 and 2015, for example, Google and Facebook paid more than $120 million to Quanta Computer. Nothing strange for multi-billion dollar companies like that, but there was something sinister at play. They weren’t actually sending money to Quanta Computer, but rather to a man named Evaldas Rimasauskas. Since companies like Google and Facebook work internationally and pay large invoices all the time, it was easier for Rimasauskas to impersonate a supplier and divert funds to himself. This story might unsettle you: if those tech giants couldn’t even spot the signs, is there any hope for you?

Don’t worry, we aren’t here to depress you – of course there is.

You need to know your customers inside and out. Keep accurate, up-to-date records of all of them. Make sure you include their bank account details, so if something changes in an invoice, you’ll be able to spot it early. Your team should always check an invoice against previous invoices or the master contract. Continuously monitoring your portfolio also goes a long way. If you’re using a single source of data across your business, everyone will be able to easily check order details. That way, even if one team misses the fake invoice, it’s way more likely that another team will catch it before it’s too late. 

Checks may seem a bit retro these days, but check fraud is still hot. In fact, it’s the leading form of B2B fraud. Issuing checks can be problematic for a few reasons. They’re slower, for one thing. But many businesses still rely on checks to pay their vendors and suppliers and appreciate the literal paper trail checks allow them to leave. The problem is on the checks themselves: when you pay a vendor with a check, that vendor then has access to your banking details like your business bank account number and routing number. 

Most of the time, the companies you send checks to are trustworthy and probably don’t even think about the ways that information could be used against you. But if you end up issuing a check to a business with bad intentions, they could quickly wreak havoc on your finances. 

The most obvious way to avoid check fraud is to avoid checks, period. If you can find a different way to pay your vendors and suppliers, it could eliminate a lot of the risks of check fraud. 

If that’s not an option for you, then you need to know your vendors inside and out. Each person you pay needs to be trustworthy enough to have access to your business’ financial information – so don’t leave it up to chance. 

It might be tough to think about someone from your own business committing invoice fraud against it, but it happens. After all, there’s a reason why “the call is coming from inside the house” is such a classic horror movie trope. 

Insider fraud is another type of fraud that even the biggest players in the world have trouble protecting themselves against. For example, a former Amazon operations manager was recently sentenced to 16 years in prison for committing insider fraud. Between August 2020 and March 2022, she created fake vendor profiles and fake invoices within Amazon’s systems. She funneled the payments from those invoices into her own bank account, netting over $9.4 million in the process. 

Of course, there are obvious steps that go into preventing insider fraud. You should make sure all your employees pass background checks and never hire or retain anyone you don’t trust. But beyond that, it can be really tough to nail insider fraud down. The whole point of this type of fraud is that trusted employees take advantage of that trust for their own gain, after all. Thankfully, keeping your invoice procedures tight and secure will go a long way in preventing insider fraud. If everyone’s on the same page about what should be coming in and out of your accounts payable portfolio, it’ll be much easier to spot the signs of insider fraud.