Accounts Payable Fraud Prevention: A Comprehensive Guide

The Growing Threat of Accounts Payable Fraud in the UK

Fraud is no longer a peripheral risk for transactional finance teams; it is a central operational challenge. In the UK, the sophistication of ‘push payment’ fraud and Business Email Compromise (BEC) has escalated, with the 2025 landscape showing that nearly 80% of organisations have faced attempted or actual payment fraud. While building an anti-fraud culture is the foundation, a truly resilient Accounts Payable (AP) function requires a multi-layered approach combining culture, technical controls, and rigorous oversight.

Common Types of Accounts Payable Fraud

To prevent fraud, one must first understand the anatomy of the schemes currently targeting UK businesses. These generally fall into two categories: internal (insider) threats and external attacks.

Internal Threats: From Ghost Vendors to Kickbacks

Internal fraud often goes undetected for longer periods because the perpetrator understands the system’s weaknesses.

• Ghost Vendors: An employee creates a fictitious supplier in the master file and submits fraudulent invoices, directing payments to their own account.
• Kickback Schemes: Collusion between an internal employee and an external vendor where the vendor overcharges the company, and the employee receives a share of the illicit profit.
• Expense Reimbursement Fraud: Submitting inflated or duplicate personal expenses, often involving the manipulation of digital receipts.

External Threats: BEC, Phishing, and Invoice Interception

External fraudsters often use social engineering to bypass technical defences.

• Business Email Compromise (BEC): A fraudster impersonates a senior executive or a known supplier via email, requesting an urgent change to bank details or an immediate ‘confidential’ payment.
• Invoice Interception: Criminals intercept legitimate invoices (often via hacked email accounts) and alter the bank details before the document reaches the AP team.
• Phishing: Deceptive emails designed to steal login credentials for the ERP or banking software.

Key Red Flags: How to Detect AP Fraud Early

Vigilance is the first line of defence. Finance leaders should train their teams to spot these common anomalies:

• Unusual Vendor Details: Suppliers with no physical address, or addresses that match an employee’s home address.
• Sequential Invoice Numbers: Receiving invoices from a vendor that are numbered sequentially (e.g., 001, 002, 003) suggests your company is their only client—a classic sign of a ghost vendor.
• Rounded Sums: Invoices that consistently feature rounded numbers (e.g., £5,000.00) rather than specific amounts including VAT.
• Urgency and Pressure: Any request to bypass standard payment runs or ‘fast-track’ a vendor setup should be treated with extreme caution.

7 Essential Strategies for Accounts Payable Fraud Prevention

1. Strict Segregation of Duties

No single individual should have the power to manage a transaction from start to finish. At a minimum, the person who sets up a new vendor should not be the person who approves invoices or authorises payments. This ‘four-eyes’ principle is the most effective deterrent against internal fraud.

2. Robust Vendor Master File Management

The vendor master file is the ‘keys to the kingdom’. Access must be restricted to a limited number of authorised personnel. Conduct regular ‘cleansing’ of the master file to remove inactive vendors and check for duplicate bank details across different supplier entries.

3. Implementing Three-Way Matching

Ensure every invoice is matched against a Purchase Order (PO) and a Goods Received Note (GRN). This process confirms that the goods were actually ordered, the price was agreed upon, and the items were received before a single penny leaves the business.

4. Moving Beyond Paper Cheques

In the UK, paper cheques remain a significant vulnerability due to the ease of alteration and forgery. Transitioning to secure electronic payment methods, such as BACS or virtual cards, provides a clearer audit trail and allows for more robust approval workflows.

5. Continuous Employee Training and Awareness

Fraudsters exploit human psychology. Regular training sessions—specifically on the latest BEC tactics and social engineering—ensure that the AP team remains the organisation’s most effective firewall. Encourage a ‘verify then trust’ approach to all change-of-bank-detail requests.

6. Leveraging AP Automation and AI

Modern AP automation software can identify anomalies that the human eye might miss. AI-driven tools can flag duplicate invoices, detect ‘split’ invoices (designed to stay under approval thresholds), and verify VAT numbers against official databases in real-time.

7. Regular Internal and External Audits

Surprise audits of the AP process can uncover irregularities before they become catastrophic. Focus on high-risk areas, such as manual payments, one-time vendors, and any transactions that bypassed the standard PO process.

UK Compliance: UK SOX and Financial Controls

With the move towards ‘UK SOX’ (the strengthening of the UK’s internal control framework), directors are under increasing pressure to certify the effectiveness of their financial controls. Accounts payable fraud prevention is a cornerstone of this compliance. Documenting your AP processes, maintaining clear audit trails, and demonstrating a proactive approach to risk management are no longer optional—they are a regulatory necessity for many large UK entities.