Document fraud checks for finance teams

Last updated: 2026-07-09

Finance teams sit at the point where documents become money. A doctored invoice, a swapped IBAN or a padded expense claim only has to survive one payment run to succeed — and payment runs are built for speed, not suspicion. The fix is not slower payments; it is checks that fit inside the process.

The three attacks on accounts payable

Bank-detail swaps: a genuine-looking invoice from a real supplier, with one changed field — where the money goes.
Ghost invoices: plausible suppliers, plausible amounts, nothing ever delivered — tuned to slide under approval thresholds.
Expense padding: fabricated or inflated receipts inside reimbursement claims, small enough that nobody looks.

Controls that actually stop them

Process first, then the file. Every change of supplier bank details gets a callback through independently held contacts; every new supplier gets a register lookup before the first payment; expense claims get sampled deeply rather than skimmed universally. Then the documents themselves: invoices get the tax-ID, math and metadata treatment, receipts the merchant-and-math treatment, and any incoming PDF can pass through the free metadata checker as a first filter.

What the file tells you that the process cannot

A fraudulent invoice from a compromised supplier mailbox passes every process check — real supplier, real history, expected amount. The file is where it gives itself away: an edit layer over the bank-details block, a Producer field that changed from the supplier's usual invoicing software, fonts that differ in exactly one field. Forensic analysis reads those traces; the payment clerk's eye cannot.

Fitting verification into the payment run

Screen automatically, review by exception. Every invoice above a threshold — or every invoice announcing new bank details — goes through a forensic check before entering the run; clean files proceed untouched, flagged files wait for a human. The check produces a structured report per document, which doubles as your audit trail. The same applies to statements suppliers or customers submit as proof: see bank statement verification for how those are checked.

The auditor's bonus

Every verification report you file is evidence of a functioning control — useful in the annual audit, decisive in a dispute. When a fraud does slip through, a documented screening process separates an unlucky victim from a negligent one, and that distinction has a price attached in most jurisdictions.

Frequently asked questions.

What document fraud hits finance teams most often?

Three patterns dominate: supplier invoices with swapped bank details (the payment goes to the fraudster), entirely fake invoices for goods or services never delivered, and expense claims padded with fabricated receipts. All three exploit the same weakness — payment runs that process documents faster than anyone can examine them.

How do I verify a supplier's bank details safely?

Treat every change of bank details as unverified until confirmed through a channel you already had — a phone number from your records or the supplier's official site, never from the invoice announcing the change. Confirm with a person, log the confirmation, and only then update the master data.

Can document checks be automated in accounts payable?

Yes. Forensic PDF analysis runs in seconds per file, so every incoming invoice can be screened for edit traces and template anomalies before it enters the payment run — with only the flagged minority needing human review. That inverts the economics: scrutiny per document rises while effort per document falls.

Checking these documents inside your product?

The same check runs as a REST API for software that receives documents from its users:

Marketplaces and seller onboarding