Accounts Payable Fraud: Red Flags and Bank Evidence

How Accounts Payable Fraud Works

Accounts payable fraud starts with someone inside the payables process who can create vendors, approve invoices or release payment batches. Access can let that person introduce a false supplier or redirect an otherwise genuine payment. Collusion lets people combine permissions that appear separate on paper.

The Association of Certified Fraud Examiners’ 2026 Report to the Nations records billing schemes in 21% of surveyed occupational fraud cases. That global case sample describes investigated frauds, not the proportion of Australian businesses affected.

Pass-through billing can involve real goods. The question is whether an undisclosed intermediary collected an inflated margin through the insider’s influence over purchasing.

Keep the focus on internal misuse of the payables function. Invoice fraud by outsiders involves a different entry point, even when both schemes target the same payment team.

Vendor Master File Red Flags

A vendor’s identity and bank details can expose a mismatch between the supplier record and the business behind its invoices. Preserve an export with the audit history before changing records. A current record alone can hide the account used for an earlier payment.

Review vendors with these features:

• An Australian Business Number (ABN) is missing, cancelled or belongs to a different entity.
• Only a post office box is recorded, with insufficient information to establish the operating business.
• The address matches an employee’s address or another vendor’s unexplained address.
• The BSB and account number match an employee’s payment account or several apparently unrelated suppliers.
• The vendor was created shortly before its first payment, especially where approval records or delivery evidence are missing.

Use ABN Lookup’s historical details to examine the status periods covering the transactions. The history displays ABN status with From and To fields. Compare the entity name with the vendor record and contract. ABN Lookup does not establish who owns a bank account.

A missing ABN or shared address is a lead, not proof of fraud. Some suppliers have legitimate reasons for those details. Confirm the business relationship and explain each match before classifying a payment as diverted.

One user creating a vendor, approving its invoices and releasing its payments is the strongest single control failure in this workflow. That user can create the payment’s supporting story and send the money without another person checking it. Compare actual user activity with permissions, including shared logins and emergency access.

Payment Tests on the Company Bank Statement

Payment tests connect the company’s settled bank debits to the payee accounts in the payment batch and the invoices that authorised them. A statement debit labelled as a supplier batch can cover many payments. Its total does not identify every recipient.

An ABA file is a Direct Entry payment file uploaded to the bank. CommBank’s file specification separates the receiving BSB and account number from the originating trace account. Use the receiving fields to test destinations. An account title entered in the file does not establish the account holder’s identity.

1. Preserve the approved batch, the file actually submitted and the bank’s processing confirmation. Record the batch identifier and processing date.
2. Extract the supplier credit entries with each receiving BSB, account number, amount and reference. Keep the originating contra entry separate to avoid counting it as another supplier payment.
3. Reconcile the supplier total to the settled company debit. Explain rejected entries, reversals, separate fees or partial processing using the bank’s records.
4. Match each settled entry to its invoice and vendor record as they stood when payment was released. Record any difference between the approved account and the submitted account.

Compare repeated amounts against invoice numbers and payment dates. Normalise spacing and punctuation in invoice numbers while keeping the original values. Test exact duplicates and near-duplicates such as INV-4821 and INV-4827 paid for the same amount to the same account.

Recurring rent or instalments can produce legitimate repeated amounts. A duplicate candidate becomes a finding only after the invoice, payment allocation and receiving account establish what happened. Check refunds and reversals before counting a second payment as an outstanding loss.

Benford’s law can screen suitable large payment populations for unusual digit patterns. It does not identify an account holder or prove that a flagged invoice was false.

FinTrace saves forensic accountants hours of statement conversion and review, leaving more time to test supplier payments and interpret the evidence. The service processes large PDF bundles into a searchable Excel ledger and a clear report of suspicious transactions, with source filenames and pages. Advanced AI workflows use source-grounding checks and independent reviews to preserve transaction facts. Firms engage FinTrace per matter for statement analysis at a fraction of the cost of manual review.

Following Diverted Payments Out of the Company

Following diverted payments requires the receiving account details from the submitted batch and bank records that show what reached that account. First establish that the payment settled. An unprocessed file proves an instruction, not a completed transfer.

Identify the receiving bank from the BSB and retain the account number exactly. Seek account-opening records and statements for the relevant payment period through an authorised production process. The account holder’s records can establish who controlled the destination and whether it belonged to the genuine supplier.

In Australian litigation, a subpoena can require a bank to produce specified records. The Federal Court’s subpoena practice note requires leave and a legitimate forensic purpose. A notice to produce depends on the applicable rules and the recipient’s role in the proceeding. It is not a general demand that any investigator can issue to any bank.

For a liquidator’s examination, section 596D(2) of the Corporations Act permits a summons to require specified relevant books in the person’s possession. Select the process for the investigation and court. A liquidator’s investigation uses these records alongside the company’s wider books and explanations.

Match receiving credits back to settled company payments using amount, processing timing and payment references. Record the destination-account statement page beside the originating debit and batch entry. Separate confirmed matches from entries that still lack supporting records.

In a hypothetical Australian-dollar example, a company batch debit is $42,000. Its settled entries include $12,000 to an account substituted for a genuine supplier’s account. The receiving statement confirms the $12,000 credit, and the supplier’s records confirm it received none of that payment. A later $2,000 repayment reduces the outstanding diverted amount to $10,000.

Count the $12,000 once, even if it appears in the batch, company statement and receiving statement. A later transfer from the receiving account is a further tracing step, not another loss to add to the original diversion. Keep gross diverted payments, verified returns and the resulting net amount separate.

Controls That Failed

Controls fail when the person diverting money can bypass an independent check at the point where the vendor or payment changes. To prevent accounts payable fraud, assign those checks to people who cannot also make and release the same change. Test the records of payments actually made.

The independent callback must use an existing trusted contact or a number obtained separately from the change request. Scamwatch’s payment-redirection guidance recommends independent phone contact. The same check interrupts an insider’s attempt to substitute account details.

Preserve the vendor history and payment records, then start with changed bank accounts and newly created vendors’ first payments. Each exception must end with an explained destination or a documented investigation action assigned to a named person.