A $38 dinner that never happened
On a Tuesday night, a sales manager submits a dinner receipt from a steakhouse in Denver. It shows $38.40, with itemized dishes, sales tax, a tip line, a server's first name and a table number. The image is sharp and the layout is right. The expense system approves it automatically, because it falls under the $50 limit for automatic approval. The restaurant was closed that night for a private event. (This is an illustrative example.)
Nothing in the review process could have caught it. The receipt was the only evidence, and the receipt was invented.
Receipts stopped being proof
Paper receipts were good evidence for one reason: faking one took effort. Someone had to find a template website or work in photo-editing software, and the result often looked wrong. Image generators removed that effort.
The reporting is consistent:
- On March 31, 2025, TechCrunch showed that ChatGPT's new image generator could produce a realistic receipt for a San Francisco restaurant. Its test receipt had two giveaways (a comma where the decimal point should be, and totals that did not add up), and the article noted that both are easy to fix.
- In October 2025, Computerworld, citing the Financial Times, reported that about 14 percent of the fraudulent receipts AppZen flagged in September 2025 were AI-generated, compared with none a year earlier.
- On June 23, 2026, Accounting Today reported AppZen data showing that the AI-generated share of flagged fake receipts went from zero in March 2025 to 70.8 percent by mid-May 2026. The figure rests on 1,471 AI-generated receipts submitted by 745 employees at 174 companies, totaling $148,143. They averaged about $100, with a median of about $32. The article cautions that the share does not mean expense fraud grew by that proportion, and describes the receipts as sized to slip under most companies' auto-approval limits.
These figures come from one vendor's platform, so they show a shift in method rather than how much fraud exists overall. The shift is enough to act on. If a receipt can be produced in seconds, it should support a claim, not prove it.
Move the evidence to the card
The strongest response does not involve detection at all. Put spending on company cards, so that the merchant, amount, date and time come from the card network rather than from the employee.
- Issue cards widely. Anyone who spends regularly on the company's behalf gets a card, physical or virtual, with limits by merchant category and by transaction.
- Let the receipt do less. For card spend, the receipt only adds itemization and business purpose: who attended, what was bought, whether alcohol was included. A fabricated receipt cannot create a charge that never happened.
- Route e-receipts directly. Where airlines, hotels and travel platforms can send receipts straight to the expense system, use that route instead of uploads.
- Make reimbursement the exception. Out-of-pocket claims need a reason, and above a set amount they need proof of payment, such as the matching line on a personal card statement with other entries hidden.
Checks that still catch fakes
A generated receipt has to be consistent with everything else the company knows. That is where it usually fails.
File and metadata checks
Require the original file: the photo of the paper receipt, or the PDF or email the merchant sent. Screenshots and re-saved images lose information. Check what the file says about itself, including the creating software, edit history and any content credentials. OpenAI told TechCrunch that its generated images carry metadata showing they were made by ChatGPT. Metadata can also be deleted, as Computerworld's report notes, so a file with none is a reason to look harder, not a verdict.
Duplicate checks
- The same image, or a near copy, submitted twice or by two employees.
- The same receipt number, or the same merchant, amount and date, across claims.
- A card transaction that also appears as an out-of-pocket claim.
- One receipt split across several claims or periods.
Content and context checks
- Do the line items, tax and tip add up to the total?
- Is the sales tax rate right for that city?
- Does the merchant exist at that address, and was it open at that time?
- Was the employee in that city that day, according to the travel booking or the calendar?
- Does one person file many claims just under the auto-approval limit, or many on weekends?
Every match is a question for a person to resolve, not a conclusion. Plenty of odd-looking claims have ordinary explanations.
Clauses to add to the policy
Adapt the wording to your own policy and have employment counsel review the consequences clause before you adopt it.
| Clause | Sample wording | What it closes |
|---|---|---|
| Card first | "Pay business expenses with your company card wherever the merchant accepts cards. Explain any out-of-pocket purchase on the claim." | Claims with no independent record |
| Original documents | "Submit the receipt exactly as the merchant issued it: a photo of the paper receipt or the original electronic file. Screenshots, recreated receipts and template receipts are not accepted." | Edited and generated images |
| Generated or altered documents | "Creating, altering or submitting a receipt produced or changed with an image generator, editing software or a template is misconduct at any amount." | The defense that a small claim does not matter |
| Lost receipts | "If you lose a receipt, submit a signed missing-receipt statement with proof of payment. Never recreate a receipt. More than two statements a quarter needs your manager's review." | Recreating a lost receipt from memory |
| Verification | "The company may confirm any claim with the merchant, ask for proof of payment and review files with automated tools, including metadata and duplicate checks." | Objections when a claim is checked |
| Timing | "Submit claims within 60 days of the expense. Return any excess advance or reimbursement within 120 days of the expense." | Stale claims that are hard to verify |
| Approver duties | "Approvers confirm the business purpose and that the claim fits the employee's travel and calendar. No one approves their own claim or their manager's." | Approval without review |
| Sampling | "Claims approved automatically are subject to random review after payment." | Claims sized to stay under the limit |
The timing clause mirrors the safe-harbor periods the IRS describes for accountable plans in Publication 463: an expense accounted for within 60 days, and any excess returned within 120 days, is treated as within a reasonable period. Ask your tax adviser how your own plan is set up.
Review what auto-approval lets through
Automatic approval saves time, and its limit is the line fabricated claims are drawn to. Two routines cover the gap:
- A monthly random sample. A reviewer examines a set number of auto-approved claims each month, chosen at random so nobody can predict which.
- Full-population tests. Run duplicate, arithmetic and pattern checks over every claim, not just the sample, and route the exceptions to a named reviewer. Several of the tests in continuous controls monitoring: ten automated tests apply directly to expense data.
Keep one rule separate from fraud controls. Publication 463 says documentary evidence is generally not needed for an expense, other than lodging, under $75. That is a tax substantiation rule. It does not tell you how much fraud to accept, and it gives a reason to rely on card data for small amounts.
Where to start
Pull last year's expense claims and run three tests: duplicate images or receipt numbers, claims just under the auto-approval limit, and out-of-pocket claims at merchants that also appear on company cards. The results will show how much of your exposure sits in reimbursements. Running these tests across every claim, with each flag reviewed by a person, is part of full-ledger analytics. To place expense fraud among your other risks, try the method in run a fraud risk assessment in one afternoon.