The 5 Fraud Patterns Hiding in Plain Sight
by Hannah Khouri
What slips through the cracks when 77% of invoice entry is manual? The invoice that looked almost right. The vendor nobody remembers adding. The approval that happened while the person who normally signs off was on vacation.
Most finance leaders picture fraud as someone defeating the system, like a hacker breaking in or a rogue employee. That still happens, and it gets most of the attention, but the pattern that continues showing up is simpler. Fraud lives in the gaps between people and steps:
- The handoff between AP and purchasing
- The inbox nobody fully owns
- The phone call that would have taken minutes but never happened
Here are five real-world examples of these gaps. Some ended in real loss, others were caught with minutes to spare. All were hiding in plain sight, inside processes that were working exactly as designed.
The ghost vendor
The vendor had a name that sounded like every other supplier on the list, generic enough to blend in with the maintenance, cleaning, and facilities companies the business already paid every month.
But it had been invented by an employee who knew how vendor setup worked, because setting up vendors was part of the job. A new vendor form went in, a W-9 was attached, and banking details were entered for an account the employee controlled.
Invoices came in and were approved, either by the employee or others who signed off on anything that looked familiar. The amounts stayed modest and the descriptions were for general services like maintenance, site support, or consulting. Each payment looked like the one before it.
When someone finally pulled up the vendor record and read it closely, they noticed three details that commonly show up in this fraud pattern:
- There was no legitimate business address, only a residence
- The contact email ran through a personal domain rather than a company domain
- The bank account never appeared in their transaction history before this vendor arrived
All three signals were there, and had they been checked from the beginning, the scheme could have been exposed within a week. This is how the ghost vendor fraud survives. It just needs to look routine long enough to become routine.
The vacation override
The CFO hadn’t taken a real vacation in two years. So when the trip finally landed on the calendar, the plan was simple and, by most standards, responsible.
Before leaving, the CFO told a trusted team member to handle any approvals that came up. There was no written delegation policy, no backup approver set in the system, and no dollar threshold. Just a verbal instruction and trust.
A few days into the trip, a $75,000 payment request came through from a vendor that was in the system. The invoice looked complete, and since the employee was told to keep approvals moving, they did just that. With no formal policy in place, there was no second approver for a payment size or flag on a brand-new vendor receiving a large first payment.
The vendor had been created days earlier and was fraudulent from the start. But how had they known when the CFO would be gone?
Leadership travel is rarely a secret, revealed through a LinkedIn post about finally unplugging, an out-of-office reply, or a mention in a company update. Fraudsters look out for these signals and time their scams for periods when scrutiny runs thinnest.
One phone call away from stopping fraud
Not every fraud story has a twist. Some are just about a habit.
The request came in as an email from a long-standing vendor, from what appeared to be their usual contact. They’d switched banks, the note said, and future payments should go to the new account. Updated details were attached on what looked like company letterhead.
This is one of the most common requests an AP team sees, and most of the time it’s legitimate. Businesses really do change banks, so nothing about the email was alarming. The tone was friendly and the formatting matched past correspondence.
The AP specialist who received it had one rule she followed every time, without exception. Any banking change requires confirmation via direct phone call to the number already on file. When she called, the vendor’s accounts receivable contact told her they hadn’t switched banks.
The email had come from a lookalike domain with one character off. The next scheduled payment would have gone straight to the scammer’s account, and it would likely have been weeks before the real vendor called asking why they hadn’t been paid. This fraud almost worked, and the only thing standing in its way was a habit nobody had written down.
One person, all the keys
This example is a setup that we see again and again, usually in leaner, busier teams that are proud of how much they get done with so few people.
In these cases, one person on the team knows the AP system better than anyone. They set up new vendors because they’re fastest at it and enter invoices because they’re already in the system. Over time, they pick up approval rights too, because routing everything through someone else slows things down and nobody wants to be the bottleneck.
As a result, only one person can create a vendor, send an invoice against it, approve that invoice, and release the payment without anyone else touching the transaction. The process depends entirely on that one individual’s integrity, and on nobody ever pressuring, coercing, or impersonating them. It’s not a conscious decision to concentrate that much control in one person; it accumulates over time across a series of shortcuts.
With no second set of eyes, a mistyped amount, a duplicate payment, or a price that doesn’t match the agreed terms has nowhere to get caught. Small errors compound until a reconciliation or audit surfaces them. And when that one person is out sick or leaves the company, nobody else knows where the problems are.
The country club that lost $40,000 to reformatted invoices
A private country club runs on a long list of vendors, from groundskeeping and linens to pro shop inventory, equipment repair, and food and beverage. Invoices arrive constantly, and at this club they arrived in more than one place.
There was the main AP inbox, along with a second address, set up years earlier for a specific department, that still received invoices from a handful of vendors. Both were monitored and fed into the same payment process, but each had its own reviewer.
One of the club’s food and beverage vendors sent an invoice to the first inbox. It was reviewed, approved, and paid. Then the same invoice went to the second inbox, slightly reformatted. The details were rearranged just enough to read as a new bill, and the person reviewing it had never seen the first, so there was nothing to compare it to. It was approved and paid too.
Over roughly eight months, the duplicates kept coming, and no person ever saw both versions of any invoice. The club eventually caught it during year-end reconciliation. Someone working through vendor totals noticed the food and beverage spend ran higher than it should have. By then, more than $40,000 was gone.
Duplicate invoice fraud is so effective because it only requires a copy that looks different enough from the first, landing in front of different eyes. The process was followed correctly, but it didn’t include a step where the two inboxes met.
What these 5 patterns have in common
These five examples show different methods, different industries, and different outcomes. But in every case, the fraud occurred within the process exactly as designed:
- The ghost vendor went through vendor setup.
- The $75,000 vacation payment was approved as the CFO had instructed.
- The banking change arrived through the normal request channel.
- The person holding all the keys was given them, one reasonable step at a time.
- The country club paid its duplicate invoices because two separate reviewers each did their job correctly.
Each scheme found a control that was missing. Each was visible, but also easy to overlook because nothing in the workflow asked anyone to look for it.
The lesson for controllers and CFOs is to stop asking people to be the last line of defense against patterns that the proper system can check every time. People are good at judgment. Software is better at comparing every invoice against every other invoice, and at noticing that a bank account has never appeared before across thousands of vendor records.
Five gaps, one fix
The bright side of these patterns is that every one of them can be caught before the money moves. That’s the thinking behind Ottimate’s Invoice Trust Score, which flags the small mismatches across vendors, invoices, and payment details so your team can apply judgment where it matters.
