Inside schemes hide in routine entries
Fraud by insiders rarely looks unusual one transaction at a time. It looks unusual in aggregate, which is why we test the whole population rather than a sample. Tests are tuned to your approval limits and calendar first, so a payment run every Friday at 18:00 does not flood the list. Each result is a short list for a person to check, not a verdict.
Billing schemes surface in vendor data
A shell vendor that shares a bank account or a street address with an employee. A real vendor whose invoices arrive in round amounts just under the approval limit. A vendor whose bank details changed four days before its largest payment of the year. Each of these is a test in our library, and each produces a short list that an analyst can check against contracts and receiving records.
Some entries move results, not cash
Not every irregular entry is theft. Some move costs between periods to meet a covenant or a bonus target. We look for entries posted on weekends or late at night, entries keyed and approved by the same user, reversals just after period-end and gaps in entry sequences. The Sunday-night entries scenario shows how that pattern can look in practice.
Payroll and expense fraud repeats itself
Pay rate changes outside the normal cycle, off-cycle runs, employees who share a bank account, and receipts that repeat across claims. Generated receipts now look real, so our tests compare claims with card data and travel dates rather than trusting the image.
Outside fraud targets the payment
Business email compromise and its newer forms, cloned voices and deepfake video calls, all aim at one moment: the instruction to pay, or to change where payment goes. FinCEN warned financial institutions about fraud using deepfake media in alert FIN-2024-Alert004 in November 2024. In the widely reported Arup case that year, roughly $25 million was sent after a video call with fake executives.
Banks are tightening their side as well. Nacha's fraud monitoring rules, which reached every business that originates ACH payments in June 2026, require risk-based processes for spotting entries authorized under false pretenses, such as a payment to an impersonated vendor. The single control that matters most is a callback to a number already on file, made by someone who did not receive the request. Our payment fraud defense work builds that protocol and tests it with drills.
Finding it first changes the outcome
Since March 2026, the Department of Justice's department-wide Corporate Enforcement Policy has offered a presumption of declination to companies that voluntarily self-disclose misconduct, cooperate and remediate. A company can only disclose what it has found. ACFE's 2026 report finds that tips detect the largest share of frauds, so analytics and a working reporting channel complement each other rather than compete. The explainer on DOJ's 2026 Corporate Enforcement Policy sets out the terms.