Fake Invoice Fraud: How to Detect Ghost Vendors and AI-Generated Documents

Fake invoice fraud occurs when a vendor record or payment request is fabricated to divert company funds. To detect it, finance teams must cross-reference every vendor against a verified master file, enforce three-way match before releasing payment, and treat any out-of-cycle bank account change as a red flag requiring independent telephone verification. AI has made the forgeries look perfect, so detection now depends on process controls, not document inspection.

Why Fake Invoice Fraud Is Getting Harder to Catch

Accounts payable has always attracted fraud, but the playbook shifted in 2025 and 2026. Fraudsters are no longer printing crude receipts on home inkjet printers. They are using large language models and AI image-generation tools to produce invoices, W-9 forms, corporate registration documents, and even fake vendor websites that pass every surface-level review.

The numbers are sobering. By May 2026, AppZen’s platform data showed that 71% of flagged fraudulent expense receipts were AI-generated, up from essentially zero in early 2025. SAP Concur’s head of expense management summarized the shift bluntly: “These receipts have become so good, we tell our customers, ‘Do not trust your eyes.'” A 2026 Emburse survey of 2,000 U.S. and UK workers found that 40% of U.S. respondents admitted to generating a fake receipt with AI, and 40% of those used company-funded AI tools to do it.

The threat is not limited to small-dollar expense reimbursements. Trustmi analysts recorded a fivefold year-over-year increase in payment fraud attempts, from 119 incidents in the first half of 2025 to 597 in the first half of 2026. The 2026 AFP Payments Fraud and Control Survey found that 76% of organizations experienced attempted or actual payments fraud, with the average loss per incident reaching $133,000.

What Ghost Vendor Fraud Actually Looks Like

Ghost vendor fraud is a billing-scheme variant in which someone inserts a fictitious supplier into the vendor master file and then submits invoices for goods or services that were never provided. The fraud typically requires internal access, a corrupted segregation of duties environment, or both.

The Classic Setup

In the traditional version, a dishonest employee creates a vendor with a plausible name, a P.O. box address, and a bank account they control. Invoices arrive on a regular cycle, under approval thresholds, and are processed without suspicion. The ACFE’s *2026 Occupational Fraud Report* studied 2,402 cases across 143 countries and found a median fraud duration of 12 months before detection. Asset misappropriation, the category that includes billing schemes and ghost vendors, accounted for 90% of cases.

The AI-Upgraded Version

AI has raised the sophistication significantly. A modern ghost vendor may have a real-looking business website, AI-generated employee LinkedIn profiles, and a convincing paper trail of prior transactions. Fraudsters can supply a ghost vendor with a long paper trail, complete with plausible invoicing history and fabricated references, because large language models make document generation trivial.

AI also enables vendor impersonation at scale, where criminals pose as a legitimate existing supplier and request a bank account change. The 2025 AFP survey found that 45% of companies were targets of vendor imposter fraud in 2024, up from 34% the prior year. Business email compromise, a common delivery mechanism for these requests, hit 74% of organizations in 2025.

The Four Most Common Fake Invoice Fraud Schemes

Understanding the specific mechanics helps you design controls that match the actual threat.

1. Phantom Billing

A vendor record is created for a company that does not exist, or a real vendor’s name is cloned. Invoices are submitted and approved for services that were never rendered. This scheme requires either access to the vendor master file or a purchasing approver who is complicit.

2. Duplicate Invoicing

The same legitimate invoice is submitted twice, often with a slight alteration to the invoice number or date to avoid automated duplicate detection. In organizations with manual AP processes, this scheme can run for months.

3. Vendor Bank Account Fraud

A legitimate vendor exists and has a genuine relationship with your company. A fraudster intercepts communication or impersonates the vendor via email, then requests a banking update. The next payment goes to an account the fraudster controls. AI-generated emails now eliminate the grammatical errors and awkward phrasing that once served as warning signs.

4. AI-Generated Receipt Fraud (Expense Side)

Employees or external contractors submit expense reports with AI-fabricated receipts. The AppZen data shows the most common subtypes are fabricated purchases that never occurred (19% of AI-generated fraud cases), inflated legitimate expenses (15%), and AI-reconstructed receipts for items purchased for personal use (6%).

How to Detect Fake Invoice and Vendor Fraud

Detection depends almost entirely on process controls, because document inspection is no longer reliable. Finance teams need controls that create friction before payment is approved, not after.

Maintain a Clean, Controlled Vendor Master File

The vendor master is the foundation of AP integrity. Every new vendor should require a completed W-9 with a real-time IRS TIN match before entry. Every entry should record the requestor, an approval from a manager who does not also process payments, and documentation of the business need. Restrict who can add or modify vendor records and log every change.

Run a periodic exception report to identify vendors sharing a bank account number with another vendor, vendors with only P.O. box addresses and no verifiable physical presence, vendors added within 30 days of a significant invoice, and vendors whose address or bank account matches an employee record. These patterns do not prove fraud on their own, but they warrant investigation.

Enforce Three-Way Match Before Payment

Three-way match compares the purchase order, the receiving report, and the vendor invoice before payment is approved. A match on all three eliminates payment for goods not received and exposes pricing or quantity discrepancies. Organizations with mature three-way match processes regularly achieve 80-90% straight-through match rates, with tolerances for minor variances, and flag the remainder for manual review.

Ghost vendor fraud frequently cannot survive three-way match because there is no purchase order and no receiving report. If your AP function processes invoices that arrive outside the PO-based workflow, that is a gap that needs to be closed.

Verify Banking Changes Out of Band

No bank account change should ever be processed based solely on an email or a form submitted through normal channels. The verification call must go to a phone number already on file in your vendor master, not a number provided in the change request itself. This single control stops the majority of vendor impersonation payment fraud.

Many organizations now implement a formal dual-approval policy for any vendor banking update, with one approver from AP and a second from Finance leadership. Some are also using automated vendor credentialing platforms that verify banking details against financial institution records before the change is accepted.

Use AI-Based Document Analysis Tools

Since AI is being used to commit fraud, AI can also be used to detect it. Several AP automation and expense management platforms now scan documents for metadata anomalies, generation watermarks, and structural patterns that indicate fabrication. Ramp reported that its AI flagging tool identified over $1 million in fraudulent invoices within 90 days of deployment. These tools are not a substitute for process controls, but they add a detection layer that catches what human reviewers miss.

Build a Continuous Monitoring Program

Rather than relying on periodic audits, continuous monitoring runs data analytics against every transaction in near-real time. Useful tests include flagging invoices just below approval thresholds (a behavioral pattern common in billing schemes), identifying vendors with no payment history for more than 12 months that suddenly submit large invoices, and comparing vendor address data against employee address records across your HR and AP systems.

The Journal of Accountancy’s July 2026 guide to AI-fueled AP/AR fraud recommends treating AI-based automation itself as a new risk surface, noting that prompt injection and data poisoning attacks against AI agents managing payment workflows are an emerging threat category that finance teams should include in their risk assessments.

What Internal Audit Should Be Testing

Finance leaders who have engaged audit and assurance services as part of their internal controls program should expect vendor fraud risk to be covered in the audit plan. Specific procedures include:

• Selecting a sample of new vendors added during the period and tracing each to supporting documentation, including the W-9, approval evidence, and a confirmed business relationship
• Testing the segregation of duties between the employee who can add vendors and the employee who approves or releases payments
• Confirming that vendor bank account changes during the period were verified using an out-of-band process with documented evidence
• Analytically reviewing invoice volume and dollar amounts per vendor, comparing patterns to prior periods and to known industry norms
• Sampling expense reports from employees with access to AI tools and applying document-metadata analysis to identify AI-generated receipts

The ACFE’s 2026 data shows that organizations providing fraud awareness training to staff and management experienced median losses of $84,000 per case, while those without training faced $150,000 per case. The investment in a structured fraud awareness program pays for itself.

Building the Right Control Environment

Preventing fake invoice fraud is not primarily a technology problem. It is a controls design problem. The right starting point is mapping who can do what in your financial systems and where single points of failure exist.

A practical checklist for CFOs and controllers:

• Vendor master access: Is adding a vendor and approving a payment the job of two different people?
• W-9 and TIN match: Is every new vendor verified with the IRS before invoices can be processed?
• Three-way match: Does every invoice require a matching PO and receiving report, or can invoices arrive outside that workflow?
• Banking change protocol: Do you have a written policy requiring out-of-band verification, and is it actually followed?
• Threshold monitoring: Are you running analytics to catch invoices just below approval limits, a pattern that flags potential threshold-manipulation?
• AI-receipt detection: Has your expense platform enabled document-authenticity scanning?

Organizations that want outside help designing these controls or conducting a fraud risk assessment can work with a firm that provides accounting and advisory services beyond the annual audit, including process assessments focused on AP integrity.

The ACFE’s Occupational Fraud 2026: A Report to the Nations shows that the most effective fraud detection mechanism is tips, accounting for 43% of case discoveries. That means creating a culture and a mechanism where employees can report suspicious vendor activity without fear of retaliation.

Related reading: Deepfake CFO Fraud: How Voice-Cloning Scams Work

Frequently Asked Questions

What is ghost vendor fraud?

Ghost vendor fraud is a billing scheme in which a fraudulent supplier record is created in a company’s vendor master file and invoices are submitted for goods or services that were never delivered. The scheme typically requires either internal system access or a gap in segregation of duties that allows one person to both add vendors and approve payments.

How can I tell if an invoice is AI-generated?

Visual inspection alone is no longer reliable. AI tools now produce invoices, receipts, and supporting documents that look indistinguishable from real ones. Detection requires metadata analysis (checking when and how the file was created), three-way match controls (confirming a purchase order and receiving report exist), and behavioral pattern testing (flagging vendors with unusual invoice timing or amounts just below approval thresholds).

What is the most effective control against fake invoice fraud?

Three-way match, which compares the purchase order, the receiving report, and the vendor invoice before releasing payment, is the single most effective control for stopping phantom billing and ghost vendor schemes. Pairing three-way match with a rigorous out-of-band verification process for any banking change closes most of the remaining exposure.

How do fraudsters change a vendor’s bank account to steal payments?

Vendor bank account fraud typically involves impersonating a legitimate vendor by email or phone, claiming an account change is needed, and requesting the update through normal AP channels. AI-generated emails now remove the grammatical errors that once made these attempts easy to spot. The defense is a written policy requiring that any bank account change be confirmed by calling a phone number already on file, not one provided in the change request.

What percentage of expense fraud now involves AI-generated receipts?

As of mid-2026, AppZen’s platform data showed that 71% of flagged fraudulent expense receipts were AI-generated, up from effectively zero in early 2025. A separate survey found that 40% of U.S. workers admitted to using AI to create a fake expense receipt.

Should small and mid-market companies worry about ghost vendor fraud?

Yes. The ACFE’s research shows that smaller organizations consistently suffer higher fraud losses as a percentage of revenue, in part because they have fewer dedicated controls and smaller finance teams where one person often handles multiple AP functions. Ghost vendor schemes do not require large organizations to succeed; they require gaps in segregation of duties, which are common in mid-market environments.