AI Fraud Detection in Corporate Finance: Payment Fraud and Duplicate Invoices

By Jane Ha · Updated Oct 11, 2026

AI fraud detection in corporate finance is the use of machine learning to compare every invoice, vendor record and outgoing payment against normal behavior, then score the ones that look wrong so a person can hold, verify or release them. It's strongest on volume and pattern: spotting a changed bank account, a near-duplicate invoice or an unusual amount across thousands of payments no team could read by hand. It isn't the control itself. The control is still a human verification step that the model triggers.

This guide is for controllers, AP managers, treasurers and CFOs who want to know where AI fits against the three fraud types finance teams meet most often: vendor fraud, payment fraud driven by business email compromise (BEC), and duplicate or erroneous invoices. For the process view, read AI in accounts payable. For the cash side, read AI in treasury management.

Key Facts

• In the 2026 AFP Payments Fraud and Control Survey (465 treasury practitioners at U.S. organizations, fielded January 2026), 76% of organizations experienced attempted or actual payments fraud in 2025 and 74% were affected by business email compromise (AFP).
• In that survey, checks were the payment method most subject to fraud (58%), ahead of ACH debits (30%) and wire transfers (25%) (AFP).
• Only 17% of those organizations used AI to combat payments fraud. Among the ones that did, 49% reported better fraud reporting efficiency and 43% better real-time identification (AFP).
• 48% of organizations with revenue under $1 billion and 66% of those above $1 billion reported financial losses from payments fraud in 2025 (AFP).
• The FBI's 2025 Internet Crime Report logged 24,768 BEC complaints with reported losses of $3,046,598,558, up from $2,770,151,146 in 2024 (FBI IC3).
• The ACFE's Occupational Fraud 2026: A Report to the Nations analyzed 2,402 occupational fraud cases from 143 countries and territories. The median loss was $104,000 per case, and the median case ran 12 months before detection (ACFE).
• In the same study, cases caught within six months had a median loss of $40,000, while cases lasting more than five years had a median loss above $1.1 million (ACFE).

Three Fraud Problems, Three Different Fixes

Finance teams tend to say "fraud" as one thing. It's at least three, and AI helps each differently.

The reason to separate them is that the response differs. A duplicate is a data problem, so you fix it with matching and a clean vendor master. BEC is a verification problem, so you fix it with process. Insider vendor fraud is an investigation problem, so a flag is the start of the work, not the end.

Vendor Fraud: What the Data Can Show

Occupational fraud is the category ACFE studies, and its 2026 findings explain why continuous monitoring matters. The median case ran 12 months before anyone caught it. Cases found within six months had a median loss of $40,000, and the long-running ones cost many times more. Time is the cost driver, and a model that reviews every transaction shortens it.

Tips were still the most common way fraud came to light, at 43% of cases in the study, and more than half of cases involved a lack of internal controls or an override of existing controls (ACFE). Read that honestly. AI doesn't replace a hotline or a culture where people speak up. It adds a second way to find the problem that doesn't depend on someone noticing.

Patterns a model can score in the vendor master and payment history:

• A vendor whose bank account, address or phone number matches an employee record.
• A vendor created and paid within days, with no purchase order or contract.
• Invoices that sit just under an approval threshold, or the same vendor billing repeatedly at the same amount.
• Round-number invoices, sequential invoice numbers, or a vendor that bills only one approver.
• Changes to vendor details made by someone outside the normal master-data team.

None of these proves anything. Each one earns a look. For the broader picture of how the controls fit around them, see AI and internal controls and AI in internal audit.

BEC Payment Fraud: The Bank-Detail-Change Problem

Business email compromise is the fraud finance teams see most. A message that looks like it's from a real supplier or executive asks for money to go to a new account. The scale is large: the FBI's complaint data for 2025 records 24,768 BEC complaints and over $3 billion in reported losses, and those are complaints actually filed (FBI IC3).

FinCEN's advisory on email compromise describes the supplier version plainly: a criminal impersonates a supplier, says future invoices should go to a new account number and location, the company updates its vendor record and then sends the next payment to the criminal's account (FinCEN). The same advisory lists red flags, including payment instructions to a known beneficiary but with account details different from before, an email address slightly altered by adding, changing or deleting characters, a payee with no payment history, requests marked urgent or confidential, and a request for more payments immediately after a successful one to an account not used before (FinCEN).

Those are exactly the kind of signals a model can check on every payment. Here's how each maps to a detection rule or score:

The weak spot in all of this is the human. AFP's survey found that 74% of organizations were affected by BEC in 2025, and checks were the most targeted payment method at 58% (AFP). A model can raise the flag. The defense that works is calling a number you held before the request arrived, and having a second person approve the bank-detail change. Never use the contact details in the email asking for the change.

Duplicate Invoices: Quiet Leakage

Duplicates aren't usually fraud, but they behave like it in the ledger: money leaves and doesn't come back unless someone asks. Exact-match rules catch the same vendor, number and amount. They miss the real world:

• The invoice number re-keyed with a leading zero, a dash or a "-A" suffix.
• The same bill sent once by email and again by post.
• One supplier set up twice under slightly different names or tax IDs.
• An amount that moves by a few cents after currency conversion.
• A credit note and a re-issued invoice that net to zero but get paid separately.

AI-based matching scores similarity across several fields together (vendor, amount, date, line items, PO reference, bank account) and returns probable pairs with a confidence. You set the threshold. Too tight and real duplicates slip through. Too loose and the team spends its week clearing false alarms, then stops reading the alerts. Start loose in a parallel run, measure the false-alarm rate, and tighten.

Run the check before payment, not after. Recovering a duplicate means asking a supplier for a refund or a credit note, and some of those requests never resolve. The related checks on employee spend work the same way; see AI expense management.

How to Implement AI Fraud Detection, Step by Step

1. Pick the loss you're trying to stop. Duplicates, BEC and insider vendor fraud need different data and different owners. Choose one to start, usually BEC and duplicates because AP already holds the data.
2. Baseline today. Count duplicate payments found in the last 12 months, attempted bank-detail changes, payments held for callback and the hours spent on manual review. You can't prove improvement without it.
3. Clean the vendor master. Merge duplicate vendors, remove inactive records, confirm bank details against a trusted source and name an owner for changes. This is the highest-return step. Finance data readiness for AI lists what to check.
4. Log every master-data change. The model needs to know who changed a bank account, when and who approved it. If that history doesn't exist, build it first.
5. Run in shadow mode. Let the model score payments for one or two cycles without blocking anything. Compare its flags with what your team found and with what turned out to be real.
6. Write the response playbook. For each score band, who looks at it, in what time, with what evidence on screen, and what the callback rule is. Get internal audit to read it.
7. Turn on holds for the highest-risk class first. For example, any payment to an account changed in the last 30 days. Keep everything else advisory.
8. Keep segregation of duties. The model's service account should never create a vendor, change its bank details and release the payment. Split those permissions as you would for people.
9. Review monthly. Track alerts raised, confirmed cases, false positives, time to resolve and any fraud the model missed. Retune on that evidence.

Common Pitfalls

• Treating the score as the decision. A model gives a probability. A person with the facts decides. An approver who sees only a red or green light learns to click through it.
• Alert fatigue. If a large share of payments are flagged, reviewers stop reading. Tune with them, not around them.
• A dirty vendor master. Duplicate vendors and stale bank details turn into confident false positives and missed matches.
• No verification step behind the flag. Detecting a changed account is pointless if nobody makes the callback. Log the call before the payment can release.
• Training only on your own history. If past fraud was never recorded, the model has little to learn from. Combine rules from sources like the FinCEN red flags with learned patterns.
• Ignoring the people layer. ACFE found that organizations training both staff and management had a median loss of $84,000, against $150,000 with no training for either group (ACFE). Tools and training work together.
• Treating AI as a script. A rules bot that matches exact fields isn't the same as a model that scores similarity. AI vs RPA in finance explains which fits which task.

What to Measure

• Detection: confirmed fraud and duplicates caught before payment, and the amount prevented.
• Precision: the share of flags that turned out to be real, and the false-positive rate by score band.
• Speed: time from flag to resolution, and time from a suspicious change to a logged callback.
• Leakage: duplicates and misdirected payments found after payment, which tells you what the model missed.
• Process: hours of manual review saved and the share of holds cleared the same day.

Where to Go Next

If you do one thing this quarter, clean the vendor master and require a logged callback before any bank-detail change can take effect. Then add a scoring model in shadow mode. The AI in accounts payable guide covers the wider AP workflow, and AI in treasury management covers payment release controls on the cash side.