Quick answer
CPA firms can find fraud and duplicate payments at a client by running a 30-minute review of 12 months of payments, then setting controls so the problems do not return. The review runs six checks in a spreadsheet: repeat amounts, invoice numbers written two ways, vendors listed twice, shared bank or address details, new vendors paid fast, and bank changes followed by payment. The controls are a call-back on every bank change, a PO for non-exempt purchases, and matching and duplicate checks before payment.
Payments fraud is common. The Association for Financial Professionals (AFP) reports that 76% of the U.S. organizations it surveyed experienced attempted or actual payments fraud in 2025, and 74% were affected by business email compromise.
Your clients feel that risk through their bills. A changed bank account, an invoice from a vendor nobody recognizes, or the same bill paid twice all end up in books you maintain, and by the time your team sees the entry the money has usually left.
Three patterns are worth watching: changed bank details, fake vendors and double-paid invoices. A 30-minute review of a client’s last 12 months of payments shows whether any of them has already happened, and seven controls keep them from happening again. ProcureDesk handles the PO matching and duplicate flags in software, and the rest comes from rules you agree on with the client.
Who this is for: CPA and CAS firms that keep the books, run AP or close the month for clients, and the client-side controllers and owners who approve vendor payments.
Free worksheet · Google Sheets
Get the AP exposure review worksheet
Paste in a client’s payment and vendor exports and it runs all six checks, from duplicate invoices to unverified bank changes. You get a Google Sheets link: make a copy and use it on any client.
Why are smaller clients especially exposed to AP fraud?
Two points from the AFP survey matter for your client list. AFP says smaller organizations face fraud less often than large ones, but they lack the recovery resources of larger firms and are much more likely to absorb the full loss. It also found that treasury is the department most likely to discover fraud, at 83% for attempted fraud and 55% for actual fraud. Many of your clients have no treasury team, so detection depends on whoever enters and approves the bills.
Email is the usual way in. Business email compromise reached 74% of organizations in 2025, up from 63% in 2024, and Nacha’s summary of the report notes that spoofed emails topped the list of attack types, reported by 85% of organizations. In AP, that looks like a message from a known vendor asking to change where the money goes.
Duplicate payments follow a different path. Most come from ordinary process gaps: a vendor emails an invoice and mails a copy, the same invoice gets keyed twice with the number written differently, or one vendor exists twice in the vendor list. The cash loss is the same, though the controls that stop it differ.
We hear this on calls. In December 2025, the corporate controller at a 350-person construction company told us his biggest worry was fake invoices landing in the central AP inbox, and that he wanted a firm rule: no PO, no pay, and no bank changes accepted by email.
How can a CPA firm review a client’s AP for fraud and duplicates in 30 minutes?
A payment export is enough to find most of what is wrong. The tests below follow routines that internal auditors run on vendor payment files, such as duplicate payments and employee-vendor matches, and they work in a spreadsheet. You need three exports from the client’s accounting system:
- Paid bills for the last 12 months: vendor, invoice number, invoice date, amount and paid date.
- The vendor list: name, tax ID, address, phone, a bank identifier, date added, first payment date, and whether a PO existed.
- The vendor change history, if the system keeps one.
Use only the last four digits of bank accounts in the spreadsheet, and never copy full account numbers. The AP exposure review worksheet runs all six checks below once you paste the exports in.
The six checks
- Same vendor, same amount, close dates. Flag a vendor paid the same amount twice within 90 days. Monthly service bills will appear here, so compare invoice numbers and dates before calling anything a duplicate.
- Same invoice number, written two ways. Clean each invoice number so “INV-001” and “001” match, then look for repeats within each vendor.
- Vendors listed twice. Sort the vendor list by name and by tax ID, and look for near-identical names or a tax ID that appears on two records.
- Shared details. Look for vendors that share a bank identifier, address or phone number with each other or with an employee.
- New vendors paid fast. List vendors added in the last 12 months, and flag any paid within days of being added with no PO behind the payment.
- Bank-detail changes followed by payment. If the system keeps a change history, list every bank-detail edit and the next payment to that vendor, with the call-back that verified it.
Two formulas that do most of the work
Checks 1 and 2 need a clean invoice key. In one helper column, strip “INV,” dashes, spaces, pound signs and periods. In a second, turn what remains into a plain number when it is one, which removes leading zeros:
FormulasClean invoice key
=SUBSTITUTE(SUBSTITUTE(SUBSTITUTE(SUBSTITUTE(SUBSTITUTE(SUBSTITUTE(UPPER(B2),”INVOICE”,””),”INV”,””),”-“,””),” “,””),”#”,””),”.”,””)
=IFERROR(TEXT(VALUE(G2),”0″),G2)
Column B holds the raw invoice number; column G holds the result of the first formula.
Then count repeats within each vendor and date window with COUNTIFS. The worksheet has both steps built in for every row.
How to read a hit
A hit is a question and not a verdict. Recurring bills explain many same-amount hits, and shared addresses often mean related companies. Three hits deserve a same-day call: a payment soon after a bank-detail change with no call-back, a vendor that matches an employee, and a new vendor paid within days with no PO. Keep a short findings list with the vendor, the amount and the follow-up, and tie each item to the control below that would have caught it.
| Vendor | Amount | Which check flagged it | Error, question or risk | Control that would have caught it | Follow-up and owner |
|---|---|---|---|---|---|
What should you do when you find a problem?
Open with the review and skip the accusation. A line such as “We ran a standard check on 12 months of payments and found a few items to look at together” works well. Show the list, label each item as an error, a question or a risk, and tie each one to a control from the seven below. Clients agree to controls faster once they have seen their own items.
A duplicate payment. Confirm both payments cleared, ask the vendor for a refund or credit memo, apply it in the books, and note which control would have prevented it.
A payment to changed bank details. Act the same day. Tell the client’s owner, ask the client’s bank about recalling the payment, report the incident to the FBI’s Internet Crime Complaint Center at ic3.gov, and keep the original emails. Do not reply on the suspicious thread or call a number from it. The sooner the bank hears about it, the better the chance of getting money back.
A vendor that shares details with an employee. Stop payments to that vendor, document what you found, and take it to the client’s owner. Check your engagement letter and ask your own counsel about any reporting duties before you go further.
What are the three patterns, and which control stops each?
Each pattern fails at a different point, so each needs its own control.
| Pattern | How it happens | Red flag | Control that stops it | Does a PO stop it? |
|---|---|---|---|---|
| Changed bank details | Someone posing as a known vendor emails new payment instructions | A request to change the account, often urgent or from a look-alike address | Call-back to a number already on file, plus a second approver | No. The invoice can be real and match a PO |
| Fake vendors | A made-up or insider-created vendor is added and starts invoicing | A vendor with no PO, no history, or details that match an employee | Vendor approval before the first payment, plus No PO, no pay | Mostly. No PO means the invoice goes back, but an insider can raise a PO, so vendor approval still matters |
| Double-paid invoices | The same invoice is entered or paid twice | Same vendor and amount, or one invoice number written two ways | Invoice-to-PO matching and duplicate checks before payment | Partly. A second invoice against a fully invoiced PO gets flagged |
Changed bank details
The invoice in this pattern can be genuine and the vendor can be genuine, so a PO match passes. The control sits on the vendor record. Nobody changes bank details on an emailed request alone. Someone calls the vendor at the number already on file, logs the call, and a second person approves the change. The first payment after a change waits until that log exists.
Fake vendors
A fake vendor can be an outside scam or an employee scheme, and in both cases the invoice reaches AP with no purchase request behind it. Under the PO-before-invoice rule, an invoice with no PO goes back to the sender. A yearly comparison of the vendor list against employee addresses and bank accounts catches the cases that slip through.
Double-paid invoices
Exact copies are the easy case. The harder ones differ slightly: “INV-001” and “001,” $1,000.50 and $1,000, or the same bill dated weeks apart. A second invoice against a PO that is already fully invoiced is a strong signal, and so is a payment made before the invoice was entered. ProcureDesk’s duplicate detection is built to catch those variations in amount, date and invoice format.
How do you set up fraud and duplicate payment controls at a client in seven steps?
Run the steps in order with one client first. Each step ends with something you can hand to the client.
Step 1: Send all invoices to one intake address
Pick one inbox or portal for vendor invoices and tell vendors to use only that. Anything that arrives elsewhere gets forwarded to the intake address and is never paid from the forward. One intake point stops the emailed-and-mailed duplicate and gives you a single list to search.
Output: an intake address and a short vendor notice.
Email templateVendor notice
Hello [vendor name],
From [date], please send all invoices for [client name] to [intake address] only. Invoices sent anywhere else will be forwarded there and will not be paid from the original email.
Please include our PO number on every invoice. We will never change your payment details based on an email; if your bank details change, we will call you at the number we already have on file to confirm.
Thank you,
[Name], [Title]
Send it once, from the client’s email, before the start date.
Step 2: Limit who can add or edit vendors
Give vendor creation and edits to one or two named people. Require a tax form such as a W-9 and a written request for every new vendor, and have someone else approve it. The person who adds vendors cannot approve or release payments to them.
Output: a vendor setup form with a named approver.
Step 3: Verify every bank-detail change by phone
Treat an emailed change request as unverified. Call the vendor at a number already on file, never one printed in the request. Log who called, who answered and when. A second person approves the change, and the first payment after the change waits until the log exists. Urgent wording or an unfamiliar sender address is a reason for extra care.
Output: a bank-change checklist with a call log.
TemplateBank-change call log
Vendor: [vendor name]
Request received: [date] by [email / letter / portal]
Number called (from the vendor file, not from the request): [phone]
Called by: [name] on [date and time]
Answered by at the vendor: [name, title]
Change confirmed: [yes / no]
Second approver: [name] on [date]
First payment after the change released on: [date]
Keep one log per change. No log, no first payment.
Step 4: Require a PO for non-exempt purchases
Set a dollar threshold and an exempt list, then return invoices with no PO to the sender. This step sends a fake vendor’s first invoice back before anyone has to judge it. The framework covers exceptions in detail.
For the full client setup, see the first article in this series: How CPA Firms Get Clients to Approve Spend Before the Invoice Arrives.
Output: a purchasing policy signed by the client.
Step 5: Match each invoice to its PO before payment
Compare vendor, price and quantity on the invoice with the PO, and for goods confirm receipt as well, which makes it a three-way match. Flag any second invoice against a PO that is already fully invoiced. Send anything outside the agreed tolerance to the requester.
Output: a matching rule with a tolerance and a named owner.
Step 6: Check for near-duplicates, not only exact ones
Before payment, search the vendor’s history for the same amount, a close amount, or the same invoice number with prefixes, leading zeros and punctuation removed. Look for vendors that appear twice in the vendor list, because a bill filed under the second record skips any check on the first. A spreadsheet works for a small client, and software can run the check on every invoice.
Output: a pre-payment duplicate check, manual or automated.
Step 7: Split entry, approval and payment
Different people should enter bills, approve them and release payments. At a client with one bookkeeper, the owner can approve payment releases for new vendors and for any invoice above a set amount. Review a short monthly report of new vendors, changed bank details and possible duplicates.
Output: an approval matrix and a monthly exceptions report.
Client controls checklist
ChecklistClient controls sign-off0 of 7 done
Tick each step off with the client before moving to the next.
See it working
See invoice matching and duplicate detection in a demo
Where does software fit in?
Software covers steps 4 to 7, where the controls depend on someone remembering to run them. ProcureDesk routes purchase requests for approval, matches invoices to POs and receipts, and flags likely duplicates before payment. Its AI capabilities page describes duplicate detection that catches differences in amount, date and invoice format, and approvers see spending alerts and past prices next to each request. Each vendor also has a supplier record that holds tax forms and contracts.
Bank-detail verification stays a process control. A call to a known number is still the safest check, so write it into the client’s policy whatever tool they use, and ask how the system logs vendor changes.
ProcureDesk integrates with QuickBooks Online, QuickBooks Enterprise, Xero, Sage Intacct, NetSuite, Microsoft Business Central and Bill.com, and implementation takes 2 to 3 weeks. Firms can recommend it to clients or offer it through the CPA partner program.
Frequently asked questions
How do fraudsters usually change a vendor’s payment details?
They use business email compromise: a spoofed or hijacked email posing as a known vendor asks for new bank details. AFP reports that 74% of the organizations it surveyed were affected by BEC in 2025.
How can a CPA firm verify a bank-detail change?
Call the vendor at a number already on file, log the call, and have a second person approve the change. The first payment after the change waits until the log exists.
Does a PO stop invoice fraud?
It stops some of it. A fake vendor’s invoice with no PO goes back to the sender, but a criminal posing as a real vendor can send a genuine-looking invoice that matches a PO. That case needs the bank-change control.
What causes duplicate payments?
Common causes are an invoice sent by email and again by mail, the same invoice keyed twice with different number formats, one vendor entered twice in the vendor list, and a payment made before the invoice was recorded.
How do you spot a near-duplicate invoice?
Strip prefixes, leading zeros and punctuation from invoice numbers, then compare them with amounts and dates within the same vendor. Check the vendor list for repeated names and tax IDs too.
What is a ghost vendor?
A ghost vendor is a vendor that does not exist or does not deliver, set up to collect payments. A vendor that shares a bank account, address or phone number with an employee deserves a closer look.
How often should a client’s AP be checked?
Run the 12-month check once to set a baseline, then review a short exceptions report each month covering new vendors, bank-detail changes and possible duplicates.
Can small clients afford these controls?
Most of the seven steps are policy changes that cost nothing in software. A spreadsheet handles the checks at low volume, and software becomes useful as invoice volume grows.
Does ProcureDesk detect duplicate invoices?
Yes. According to its AI capabilities page, it flags duplicates with differences in amount, date and invoice format.
How long does implementation take?
Implementation takes 2 to 3 weeks.
Resources
- How CPA Firms Get Clients to Approve Spend Before the Invoice Arrives: the first article in this series
- PO-Before-Invoice Rule framework: the full definition of No PO, no pay
- AI capabilities: duplicate detection and approver insights
- Invoice matching: matching invoices to POs and receipts
- Supplier management: one record per vendor
- Approval workflows: routing and limits
- Three-way match: PO, receipt and invoice matching explained
- Procurement fraud: a broader look at purchasing fraud schemes
- The Missing Layer in Your CAS Tech Stack: why a PO before the invoice matters for CAS firms
- Beyond AP Automation: A CAS Playbook: turning AP cleanup into advisory work
- CPA partner program: offering ProcureDesk to your clients
Sources
- AFP, 2026 Payments Fraud and Control Survey press release, April 14, 2026
- Nacha, Business Email Compromise Attempts Rose Sharply in 2025, May 13, 2026
- Orange County (CA) Auditor-Controller, audit of duplicate vendor payments and employee-vendor matches, March 2009, an example of auditors running these tests on vendor payment files
For CPA and CAS firms
Offer these controls to clients through the CPA partner program
Recommend ProcureDesk to clients or deliver it as part of your advisory work.
About the author
Sachin Sharma
Sachin Sharma is the CEO of ProcureDesk and has spent over 23 years in procurement and supply chain technology. He previously led procurement operations at a Fortune 500 company before founding ProcureDesk. Connect with him on LinkedIn.
