Expense Report Fraud: Detection and Key Controls

Expense report fraud is often treated as a minor nuisance: a meal claimed twice, a slightly altered receipt, a personal taxi ride presented as a client visit. That picture is incomplete. The same process can also be used, deliberately and over several years, to extract significant amounts of cash from a company. The first kind of fraud erodes control culture; the second can turn into a material loss and a reputational crisis.

This article is part of a series that grew out of discussions with members of our User Club: finance, internal control and audit leaders from international groups operating across many countries and entities. Fraud and abusive behaviour came up as the most critical family of expense report risks, and the distinction between these two forms of fraud shaped much of the discussion.

Opportunistic fraud is the everyday kind. An employee inflates an amount, claims a personal expense or submits the same receipt twice. Each instance is small, but the practice can be widespread and recurring. Technology has made it easier. In a survey conducted for Emburse in May 2026 among 1,000 employees in the UK and 1,000 in the US, 34% admitted having used AI to generate a fake business receipt, rising to 40% among US respondents. Among US respondents, the uses map directly onto the schemes described below: 19% fabricated a purchase that never happened, 15% inflated a genuine expense and 6% replaced a receipt they had genuinely lost. And 36% of those who did so used AI tools funded by their own employer.

Organised fraud is a different matter. Here, fictitious expense reports become a channel for diverting cash, sometimes to enrich the perpetrator, sometimes to build an off-book fund that can finance undue payments. These schemes are structured, often involve an accomplice in the approval chain or among suppliers, and are designed to last. Their impact is cumulative: amounts below review thresholds, repeated month after month, across several years.

Duration is precisely what makes them costly. According to the ACFE’s 2026 Report to the Nations, expense reimbursement schemes account for 13% of the cases studied and typically run for 18 months before being detected, longer than most other forms of occupational fraud. They are also among the slowest: a median of $1,900 of losses per month, against $9,400 for occupational fraud overall. Slow and long is exactly the profile of a scheme designed to stay below the radar. And losses grow with time: across all frauds studied, median losses rise from $40,000 for schemes caught within six months to $100,000 for those detected within the following six months.

The two forms call for different responses. Opportunistic fraud is mostly a matter of prevention and deterrence. Organised fraud requires detection capable of seeing patterns that each individual claim is built to hide.

Six forms of fraud and abusive behaviour were identified. They operate through three mechanisms, each of which can serve both opportunistic and organised fraud.

Manipulating the evidence. Altering a genuine receipt, assembling a fake PDF, or now generating one from a simple text prompt. The receipt has long been treated as proof that a transaction took place. That assumption no longer holds. Across all occupational frauds, the ACFE finds that creating or altering documents, physical or electronic, is the most common way fraudsters conceal their schemes; only 11% of frauds involve no concealment at all.

Manipulating the claim. Submitting the same expense twice, declaring personal spending as professional, inflating amounts. In organised schemes, this becomes systematic: entirely fictitious expenses, split into amounts that stay below approval thresholds and spread over time to avoid attracting attention.

Manipulating the approval. Collusion between a claimant and an approver or supplier, and the deliberate approval of fraudulent spend. This is the hallmark of organised fraud: the person meant to detect the anomaly is part of it. Reimbursements made outside the standard circuit, for instance through cash accounts, are a frequent warning sign. Collusion also multiplies the damage: across all types of occupational fraud, the ACFE finds that schemes involving two perpetrators cause median losses more than twice those of a lone fraudster ($125,000 against $55,000).

What these mechanisms share is that they exploit the transactional nature of most reviews. A reviewer reading a single claim cannot know that the same supplier appears every week, that amounts are suspiciously round, or that a colleague in a similar role spends a third as much.

For each risk, a key control applies:

• Falsified receipts: automated detection tools (OCR, image analysis) combined with reinforced random checks.
• Duplicates: automated duplicate detection on amount, date and supplier, extended to similar descriptions and across employees.
• Personal expenses: a clear policy and managerial approval with mandatory justification.
• Inflated amounts: automatic caps and comparison with benchmarks for meals and hotels.
• Collusion: segregation of duties and an independent review by finance or audit.
• Fraudulent approval: periodic review by internal control and a complete audit trail of approvals.

Automated, preventive controls are effective against opportunistic fraud. Organised schemes, however, are designed to pass them. Detective controls performed after payment, over long periods, remain essential

Intelligent targeting. Rather than spreading review effort evenly, some groups analyse spending volume and frequency per employee and compare it with the relevant function or peer population. Particular attention goes to unexpected top contributors: employees in roles that should generate little spending but show high volumes. Behaviour matters as much as transactions: the ACFE reports that 84% of fraudsters displayed at least one behavioural red flag, most often living beyond their means.

Compensating controls. Periodic reviews focus on monthly totals, recurring cap overruns and atypical patterns in meals, travel and fuel, compensating for claims approved quickly or automatically.

Preventing simple collusion. Some groups explicitly prohibit reciprocal approval between managers and circular delegation, and review self-approvals, approvals outside the standard circuit and reimbursements made through cash accounts.

Detecting fraud patterns. Round amounts, identical expenses repeated over time and the recurrent use of the same supplier are treated as weak signals worth investigating.

An illustrative case shows how these practices combine. An employee in a support function regularly claims client meals of similar amounts, always at the same restaurant, each below the approval threshold, and always approved by the same manager. No single claim triggers an alert. But a peer comparison places this employee among the top contributors of the business unit, a pattern analysis over eighteen months reveals the repetition, and the approval data shows that no one else has ever reviewed these claims. Each signal is weak; together, they justify an investigation.