Duplicate Payments and Invoice Fraud: How to Find the Money You’ve Already Lost
The overpayment nobody notices
Accounts payable is where cash leaves the building, and it leaks in ways that are easy to miss. Duplicate payments are the classic example: the same invoice paid twice because it arrived by email and by mail, or was entered under two slightly different vendor names, or was paid once against the PO and once against the invoice. Individually small, collectively meaningful — and almost never caught by a sample-based review.
How duplicate and fraudulent payments happen
A few recurring patterns account for most AP leakage:
- True duplicates — same invoice number, amount, and vendor entered twice.
- Near-duplicates — same invoice with a trailing space, a different date, or a vendor spelled two ways so the system’s block doesn’t fire.
- Split invoices — a purchase broken into pieces to slip under an approval threshold.
- Price and quantity mismatches — you’re billed more than the contract price, or for more than you received.
- Fraudulent invoices — a shell vendor, or a real vendor whose bank details were quietly changed to divert payment.
The control that catches most of it: three-way match
The workhorse control in procure-to-pay is the three-way match — reconciling the purchase order (what you agreed to buy), the goods receipt (what you actually received), and the invoice (what you’re being billed). If the three don’t agree, you don’t pay until they do. Layer on a contract-price check and a duplicate screen, and you’ve closed the most common leaks.
The problem is that doing this manually, on every invoice, is impossible for a small team — so most companies check a sample or rely on the ERP’s basic duplicate block, which near-duplicates slip right past.
Finding money that’s already gone
Here’s the part owners love: this isn’t only about prevention. Run these checks retroactively across a year or two of AP history and you routinely find real money — duplicate payments to recover, overcharges against contract, missed early-payment discounts, and rebates that were never applied. Recovery audits are a whole professional service for exactly this reason. Done continuously, you catch it before it goes out the door; done retroactively, you get a recovery list.
What good looks like
A healthy AP control environment checks every invoice — not a sample — for duplicates and near-duplicates, matches it to the PO and receipt, compares the price to the contract, screens for split purchases, and flags any change to a vendor’s bank details before the next payment run. When all of that runs automatically, AP stops being a source of quiet losses and becomes a source of recovered cash.