5 checks to guard your small business against invoice fraud

By Stacker

Published October 27, 2026 2:29 PM

By Kassi Luja for Xero

Q4 is when small business owners sit down to reconcile the year. They’re chasing W-9s, confirming vendor payments and preparing for the Form 1099-NEC deadline on Feb. 1, 2027. It’s tedious work, but it’s also the moment when invoice fraud becomes visible, if an owner knows what to look for.

Duplicate bills. Invoices from vendors who were never hired. Bills paid twice by accident. Small businesses lose more to fraud than any other organizational size, with a median loss of $126,000 per incident, according to the Association of Certified Fraud Examiners’ 2026 findings. That’s valuable cash that could have paid staff, bought inventory or kept the business afloat during a slow quarter.

Most fraud is preventable with simple steps that catch duplicate or fake bills before money leaves the account. Xero’s guide to the accounts payable process outlines five such checks.

A duplicate bill looks innocent. The same supplier invoice lands twice – once as “INV-1001” and once as “1001” – and both slip past a quick glance on a busy day. Or a PDF gets forwarded to two inboxes and gets entered twice. A monthly statement arrives and someone treats it like an invoice and pays it again.

Fake bills take a different path. The Federal Trade Commission warned in May 2026 that scammers send unsolicited invoices for products or services businesses never ordered, hoping someone will pay without checking. They’re counting on a busy back office to miss it.

Duplicate and fake bills get through when a business can’t check that a bill matches something it actually ordered, received, and approved. Five steps in the accounts payable process do that check.

1. Three-way match: Bill, purchase order and delivery records need to align

A purchase order goes out for 40 cases. The supplier bills for 40 cases. But the delivery record shows only 32 arrived. If the business pays based on a two-way match (bill and purchase order), it’s paying for eight cases that never showed up. A three-way match adds the receiving or delivery record to the comparison. Now the mismatch is visible. The business pays only for what it ordered and received.

A fake bill for something nobody ordered fails immediately. There’s no purchase order to match it to.

It’s easy to set up the process for three-way matching:

Require a written purchase order before anything ships.
When a bill arrives, pull the original PO it references.
Check the delivery or receiving log to confirm what actually arrived.
Compare quantities and unit prices on the bill against both records.
Hold any bill that doesn’t match and ask the vendor to explain.

This is basic work, but it’s where many payment errors and most fraud can be caught.

2. Search past bills to avoid accidentally paying duplicates

This check helps catch duplicate bills before they’re paid. Picture the same invoice amount from the same vendor arriving twice within 30 days, but under different invoice numbers. A simple search by invoice number alone misses it. Someone has to search by vendor name, amount and date together.

Smaller companies are more exposed to this risk because fewer people touch the bills. One person handling receiving, data entry and payments means no second set of eyes.

How to catch duplicates:

Search past bills by vendor and amount, not just invoice number.
Check the invoice date against other recent bills from that vendor.
Never pay from a monthly statement. Pay only from invoices.
Flag near-duplicates and amount changes for a second look before payment.

3. Set approval limits for larger payments

A $6,200 bill from a new vendor arrives while the owner is traveling. If one employee can approve and pay it alone, nothing stops them. But was that even a real invoice? Was it for the correct amount? Was it a duplicate that already got paid last week? The accounts payable process keeps flowing, but fraud can easily slip through.

Approval limits tie sign-off authority to the dollar amount. A tiered system might look like this: a manager approves bills under $500, a department head approves bills up to $5,000, and anything over $5,000 needs the owner’s approval.

This does two useful things: It prevents any single person from having too much control and it creates a verification step. When an approver reviews a bill, especially the owner reviewing larger amounts, they ask questions like: “Do we actually work with this vendor? Is this amount in line with what we usually order? Did we already pay this?” That extra set of eyes can help spot fake or duplicate invoices.

Implementing approval limits is simple:

Write down each limit and who holds the authority
Decide who approves bills between the lower and upper limits
Route every bill over the top limit to the owner
Watch for vendors whose bills keep landing just under a limit

Once a bill is approved, the biggest risk is still ahead: how the money actually leaves.

4. Pay by ACH to reduce mailed check fraud risk

A paper check in the mail is vulnerable in ways electronic payments aren’t. It can be stolen from the mail, have the payee washed off and rewritten, or be photographed and used for duplicate payments before the business even realizes what happened. Electronic payments, on the other hand, create a digital audit trail. ACH payments leave a bank record, but reversing them can be difficult. Wire transfers may be recalled in some cases. Checks, once cashed, can also be difficult to recover.

Reduce payment risk by following these steps:

Pay approved bills by ACH wherever the vendor accepts it
If checks must be written by hand, ask the bank about positive pay (the bank blocks checks that don’t match an approved list)
Confirm a vendor’s new bank details by phone, using a number already on file rather than one from an email, since the email could be fake
Reconcile payments against the bank statement every week

That last step is crucial. Weekly reconciliation can help catch payment fraud early, before it happens again.

5. Keep organized vendor records

A vendor disputes a payment from two years ago. Without the original bill, there’s no proof of what was owed. Records also help trace duplicate and fake bills after the fact and reveal patterns that can surface before fraud occurs. Beyond compliance, keeping organized records can prevent fraud in the first place. A clean vendor list makes Q4 reconciliation faster and helps catch patterns, such as a vendor suddenly requesting payment to a new bank account.

IRS guidance recommends keeping tax records for at least three years. Some owners keep records for five or seven years, often on the recommendation of accountants. Either way, the real protection comes from organizing what you keep:

Store the original bill with each payment record.
Keep each vendor’s W-9 in the vendor master file.
Note who approved each bill to complete the audit trail.
Set a yearly purge date for records past their retention period.

When approval notes are linked to the bill and payment record, a dispute takes one lookup instead of hours of searching.

Making it work with a small team

Splitting duties sounds like a big-company thing. But it works with a two-person team. For example, a bookkeeper enters the bills and the owner approves them. Nobody both adds a vendor and pays them. That’s the key.

To keep things moving, set a 48-hour approval window. This can fit within vendor payment terms, whether they’re Net 10 or Net 30. But the real safeguard is that the owner personally reviews every large bill and every request to change a vendor’s bank details. Those are areas where fraud can slip through.

Before the Form 1099-NEC deadline on Feb. 1, 2027, run all five checks against this year’s vendor list. Start with vendors whose bank details changed. Flag any vendors with duplicate invoice numbers or duplicate amounts paid. Look for bills that were approved but don’t match a purchase order.

For bills that pass all five checks, switching to ACH payments removes the mailed check from the process entirely.

Most fraud is preventable. These five checks are how.

This story was produced by Xero and reviewed and distributed by Stacker.