Accounts payable fraud is any dishonest and illegal actions that steal funds from your business’s payment system. It comes from employees, vendors, and external scammers, and the methods have changed faster in the past two years than in the decade before them.
The 2026 AFP Payments Fraud and Control Survey found that 76% of US organizations faced attempted or actual payments fraud in 2025, and 74% were targeted by business email compromise. The volume is not what’s new. What’s new is that attackers now generate convincing invoices, clone executive voices, and mimic a supplier’s writing style closely enough that the warning signs AP teams were trained to look for no longer apply.
Types of accounts payable fraud.
Common accounts payable fraud schemes fall into two main categories.
Technology now reduces the risk of most of them, but the schemes themselves are worth understanding first.
Internal fraud
A billing scheme is one of the more common AP invoice fraud schemes and occurs when an employee issues fraudulent payments by submitting invoices for fictitious goods or services and involves three steps:
- Creating a fake vendor (also known as a ghost vendor)
- Creating a fake invoice
- Manipulating invoice approval and payment processes to perform the payment
Check fraud is forgery, tampering or theft of physical checks deposited into accounts controlled by fraudsters.
A kickback scheme occurs when an employee and a supplier collude. The supplier submits inflated or false invoices while the employee facilitates payment, resulting in profits for both parties.
When an employee submits false expenses and claims for reimbursement, it can include fictitious expenses, inflated expenses or multiple requests for the same expense.
External fraud
Vendor fraud schemes use phishing scams by sending an email that seems to be from a trusted source, making a legitimate request. However, the email address is slightly different.
That difference used to be the giveaway, along with awkward phrasing or formatting that didn’t match the supplier’s usual invoices. Neither holds anymore. Attackers compromise a supplier’s mailbox or register a lookalike domain, then wait for a real invoice cycle before making contact. Language models let them match the supplier’s tone and reuse genuine invoice numbers, so the request arrives looking like the correspondence that preceded it.
Common scenarios include:
- Fake invoices
- Messages trying to trick victims into revealing confidential information
- Malicious software infiltrating company networks
While rare, ACH fraud is unauthorized transactions or fraudulent funds transfers through an ACH Network. ACH fraud typically targets a specific bank account and takes advantage of the time delay in ACH processing.
When the same services or products are invoiced multiple times or sent to multiple companies within a group.
When the delivered services or goods do not align with what was ordered or specified in the invoice.
The invoice price fails to align with the originally agreed upon and ordered items during the purchase process.
Generative tools can replicate a supplier’s invoice layout, logo, and purchase order references closely enough to pass visual review. Some operations go further and register entirely fictitious suppliers using forged onboarding documents, then bill small amounts repeatedly to stay under the thresholds that trigger scrutiny. The individual invoices look ordinary. The pattern only becomes visible when someone examines supplier data across the whole vendor master file rather than invoice by invoice. This is now a recognized enterprise finance risk, not a fringe scenario.
Voice and video cloning has moved from proof of concept to working attack. In one widely reported 2024 case, an employee at a multinational firm joined a video call with colleagues he recognized, including a senior finance executive, and went on to authorize 15 transfers totaling roughly $25.6 million. Every other participant on that call was synthetic.
These schemes target the exception path rather than the standard workflow. They arrive as urgent, confidential requests that bypass normal approval routing, and they cluster around quarter-end, holidays, and payment runs, when exception handling is already rushed. Callback verification, long treated as the backstop control, fails when the callback number came from the fraudulent request or when a cloned voice answers it. AI-based detection is increasingly what separates a caught attempt from a completed one.
Why is invoice fraud detection and prevention important?
With the potential for significant financial losses, damage to reputation and disruptions to operations, your organization has a lot to lose. Medius research found the estimated average loss is $168,204, but a lot more likely slips through the cracks. In addition, the acceptance of so-called "shallowfakes" or small-scale fraud committed and often viewed as "too small to matter" can add up quickly.
Small-scale fraud that once required an insider willing to cut corners can now be produced at volume by anyone with access to generative tools, which means the cost of attempting fraud has dropped while the sophistication of each attempt has risen.
$168,204 is a lot to lose.
87% of finance professionals have ignored a claim they suspected was fraudulent, and 67% say they’d do it themselves if their coworkers did too. That small-scale fraud should be starting to look a lot more serious.
How can you detect AP fraud in an organization?
Fraud detection depends on both people and technology. The people side is a culture of fraud awareness: documented procedures, regular training, and a team that is expected to question a transaction without it being treated as an accusation. The technology side is what applies that scrutiny to every invoice rather than only the ones someone has time to examine.
What to look for has moved away from appearance. Mismatched logos, odd phrasing, and invoice numbers out of sequence are no longer reliable signals, because a well-executed attack reproduces all three correctly. The signals that still hold are relational, and they surface only when transactions are compared against each other: the changes to supplier payment details that arrive close to a scheduled payment run, near-duplicate invoices separated by a small amount or a single character, bank accounts shared across suppliers with no apparent connection, new suppliers that bill immediately at consistent amounts just under an approval threshold, and invoice volume that clusters at quarter-end or over holidays when review capacity is thinnest.
None of these is conclusive alone. Each is ordinary in isolation and meaningful in combination, which is the kind of comparison AI-backed software handles better than manual review. Medius Fraud & Risk Detection flags suspected duplicate invoices, changes in payment address, invoices from unapproved suppliers, and unusual invoice date patterns, and shows the reason an invoice was flagged alongside a recommended action so reviewers can judge it rather than simply clear it.
Who is responsible for detecting AP fraud?
Ideally, efforts to combat fraud should be a team effort and include finance, IT, AP teams and more. Finance professionals are the most common targets, but they cannot bear the burden alone. Establish checks and balances to ensure effective detection and prevention of fraud.
That shared responsibility matters more as attacks get better at targeting individuals. A request engineered to look like it came from a specific executive is difficult for any one approver to refuse, which is why the control has to sit in the process rather than in a person’s judgment.
What are common AP fraud prevention
and mitigation strategies?
Accounts payable fraud prevention is better than detection but requires a plan that often includes these key practices:
Implement policies
Company policies keep everyone on the same page.
Educate employees
Train your team regularly so they understand the common schemes, recognize them in practice, and know the procedure when something looks wrong. Training that still centers on spotting suspicious wording is training for an attack that no longer happens. Include examples of synthetic audio so staff have heard one before they get a call that matters.
Perform audits
Conduct regular audits of AP processes and records.
Implement reporting function / whistleblowing
Give your team an anonymous way to report issues.
Match invoices
Invoice matching (three-way matching) will verify legitimacy. Two-way and three-way matching both compare the invoice against what was actually ordered and received.
Utilize 4 eyes principle
Ensure at least two people verify transactions.
Validate vendor master data
Implement secure processes for checking and updating vendor master records. Review that file as a whole on a schedule, not only when a record changes, since synthetic suppliers are easier to spot by comparing records against each other than by examining any one of them.
Verify payment changes out of band
Treat any request to change bank details as high risk regardless of who appears to be asking. Confirm it using a contact method already on file rather than one supplied in the request, separate the roles of requester, approver, and releaser, and hold the first payment to a new account long enough for a reversal to be possible. Controls applied before an invoice is paid are considerably cheaper than recovery afterward.
Require more than a conversation
No payment instruction should be valid on the strength of an email, phone call, or video meeting alone. This applies to requests that appear to come from executives, which is precisely the exception most approval processes are built to accommodate.
Automate AP process
Use automation software and ensure your AP team has clear duties for AP fraud prevention.
How can accounts payable software help in AP fraud prevention?
AI-powered accounts payable software will automatically identify patterns, irregularities and anomalies that are often hard to spot manually in AP transactions. It applies the same scrutiny to every transaction regardless of size or urgency, which closes the gap these schemes are built to exploit. Fraud and risk detection tooling adds anomaly flagging, a four-eyes principle on approvals, and step-up authentication on payments to that baseline.
Consequences
of AP fraud
Accounts payable fraud can cause serious problems for a business, like financial losses, damage to reputation, legal issues and even potential bankruptcy. Not only that, it can also lead to mistrust among employees, customers, and stakeholders and affect the business's overall operations.
“AI is having an impact on almost all areas of life, and we’re really only at the beginning of what those issues could be. AI could be a powerful tool for criminals, so it’s important workplaces stay on top of the latest developments and make sure staff are up to date as well.”
Paul Ellis
UK Head of Excellence, Medius
Benefits of Medius fraud
and risk prevention
Medius AP automation software keeps your business prepared and protected.
With Medius, you can:
Detect and prevent fraud by automatically capturing vendor data and monitoring new suppliers, changes in alphanumeric invoice numbers, unusual payment values, and alterations in payment instructions. Medius Fraud & Risk Detection surfaces these in a single risk dashboard so flagged items are tracked to resolution rather than handled ad hoc.
Create traceable approval workflows with managed permissions for employees. Detect anomalies in spending patterns to prevent fraud in real-time.
Automate invoice/PO matching for error-free processing and liability prevention. Maintain complete audit trails and seamlessly track payments, invoices, and approval history within the system without manual cross-referencing.
Prevent fraud by centralizing payments through a single channel. Your suppliers will embrace your AP platform with faster payment times.