- Error and duplication cost more in aggregate than deliberate fraud.
- Systematic detection beats intuition and avoids targeting individuals unfairly.
- Most controls that prevent fraud also prevent honest mistakes.
- Investigate consistently, document carefully and involve the right people early.
- A culture where mistakes are reported early prevents most escalation.
What actually happens
In our experience of documenting this category, the losses that show up are overwhelmingly mundane: a subscription nobody cancelled, an invoice paid twice, a personal purchase never flagged, a category coded incorrectly for two years.
Deliberate fraud does occur, and it is usually small, repeated and enabled by a control gap that also allowed a lot of honest error to accumulate.
Patterns and the control that addresses each
| Pattern | Control |
|---|---|
| Duplicate payment to the same vendor | Invoice number matching, and one payment route per vendor |
| Personal purchase never disclosed | A clear, blame-free disclosure process in the policy |
| Uncancelled subscription | One vendor-locked virtual card per subscription, reviewed quarterly |
| Inflated or altered receipt | Automatic capture from the merchant where available |
| Split transactions below a threshold | Pattern detection on transactions just under the limit |
| Dormant card used after departure | Termination on the offboarding checklist |
Detection that is systematic, not suspicious
Analysis should be applied uniformly rather than aimed at individuals. That is both fairer and more effective — patterns are visible in aggregate that no reviewer would spot transaction by transaction.
Run the same checks every month on everyone, and treat the outputs as questions rather than accusations.
- Transactions clustering just below an approval threshold.
- Repeated round-number amounts from the same cardholder.
- Weekend or holiday spend in categories that are normally working-hours.
- Vendors appearing in both card and payables spend.
- Receipts submitted well after the transaction date, repeatedly.
Investigating well
Most flags have innocent explanations. Handling them badly costs more in trust than the amounts involved, so the process matters as much as the finding.
- Ask a neutral question before forming a conclusion.
- Document what was found and when, factually.
- Involve human resources and legal early where deliberate misuse looks likely.
- Apply the same process regardless of the person's seniority.
Frequently asked questions
Much less common than error, duplication and drift. Most organisations recover far more by fixing duplicates and uncancelled subscriptions than by pursuing deliberate misuse.
No. Sample systematically and analyse patterns across everyone. Full review is expensive, slow, and no better at detection than well-designed sampling.
Attribution. When every transaction has an identified cardholder, a documented purpose and automatic capture, most opportunities for both error and misuse disappear.
Keep reading
Sources and further reading
Every factual statement on this page is checked against primary documentation. Terms change frequently, so confirm details with the provider before acting on them.
- IRS Publication 463 — travel, gift and car expenses Used for statements about expense substantiation and record keeping in the United States.
- FTC — how to recognise and avoid phishing scams Guidance used in our sign-in safety sections.
- FASB Accounting Standards Codification Reference point for accrual, expense recognition and close-process statements.
- Nacha — ACH Network rules and resources Used for statements about ACH timing and payment rails.