How to Detect Expense Report Fraud: Red Flags and Controls That Work

Expense report fraud is detected by comparing every claim against three things: the receipt itself, the same employee's history, and everyone else's claims for the same period. Most schemes are small, repeated and boring, not dramatic. Duplicate submissions, inflated amounts, personal purchases coded as business, and mileage or per diem claims that do not match the calendar account for the bulk of losses. The controls that catch them are unglamorous and mostly automatable: require the original receipt, match it line by line to the claim, and look for patterns no single reviewer would ever notice.

What expense report fraud actually looks like

Forget the story about the executive expensing a boat. The typical case is an employee claiming $40 to $200 more per month than they should, for years, in ways each individual approver considers too small to challenge. Fraud examiners have long grouped it into four families, and they show up in roughly this order of frequency.

• Mischaracterized expenses. A real receipt for a real purchase that was personal. Dinner with a spouse booked as a client meal. A flight extended into a weekend. The receipt is authentic, which is exactly why it clears review.
• Overstated expenses. A genuine expense claimed at a higher amount, usually by altering the document or claiming the pre-discount price. Receipt images edited on a phone are now trivially easy to produce and hard to spot by eye.
• Fictitious expenses. A claim for something that never happened, backed by a fabricated or downloaded receipt. Less common because it takes more effort, and the most likely to be caught by a vendor check.
• Multiple reimbursements. The same expense claimed twice, often once from the card statement and once from the receipt, or once by each of two employees who attended the same dinner. This is the single easiest category to catch automatically and the one most companies still miss.

The red flags worth actually watching

A long checklist nobody uses is worse than a short list someone reviews weekly. These are the ones that repay attention.

1. Amounts sitting just below an approval threshold. If anything over $500 needs a second signature and an employee's claims cluster at $460 to $495, that pattern is the finding. Threshold-hugging is deliberate behavior and shows up clearly once you plot it.
2. Round numbers. Real receipts have odd cents. A run of claims at exactly $80.00 or $150.00, especially for taxis, tips and meals, is worth pulling.
3. Missing or illegible receipts, repeatedly. Everyone loses one occasionally. One person losing them consistently, and always above the amount that requires documentation, is a pattern.
4. Weekend and holiday dates on business expenses. Easy to check, easy to explain if legitimate, and revealing when the explanation does not come.
5. Same vendor, same amount, different weeks. Duplicates and fabricated recurring claims both look like this.
6. Claims filed late and in bulk. Reconstructed expenses are more likely to be wrong, whether or not anyone intended fraud.
7. Mileage that does not survive a map check. Inflated distance is one of the most common and least investigated categories, because verifying it manually is tedious.

None of these is proof on its own. Every one of them has an innocent explanation, and treating a red flag as an accusation is how you damage a team. They are prompts to ask a question, nothing more.

Which controls actually stop it

Detection after the fact recovers some money and a lot of goodwill loss. Prevention is cheaper. Four controls do most of the work.

Require the itemized receipt, not the total. A credit card slip proves an amount. An itemized receipt proves what was bought. The gap between the two is where mischaracterized expenses live, and closing it removes an entire fraud family without a single accusation.

Write a policy that decides things. Most expense policies are aspirational paragraphs. A usable one states dollar limits by category, what documentation each requires, what is never reimbursable, and who approves at each threshold. If your policy cannot resolve a real question in under a minute, it is not a control. Our guide on what to include in a company expense policy covers the specifics, and expense policy software is what turns the document into something that actually gets applied.

Separate the approver from the beneficiary. Nobody approves their own expenses, nobody approves their manager's, and executive expenses get reviewed by someone with standing to say no. This is the control most often missing at the top of an organization, which is also where the largest individual amounts sit.

Audit a random sample, visibly. Auditing everything is not affordable. Auditing five percent at random, and letting people know it happens, changes behavior far more than the sample size suggests. Regulated teams often formalize this alongside their other internal control obligations, which has the useful side effect of making the expense review defensible in an audit.

How software finds what a reviewer cannot

An approver sees one report at a time and has about ninety seconds of attention for it. They cannot hold six months of one employee's history in their head, and they certainly cannot compare it against the rest of the company. Software can, and that asymmetry is the whole argument for automating this.

Reading the receipt at line-item level means the claim is checked against the document rather than against a typed total, so an altered amount or an inflated line does not simply pass through. Matching claims against card transactions catches the duplicate-reimbursement family outright, because the same charge cannot be claimed twice without the second attempt colliding with the first. Checking each expense against the written policy before it reaches an approver means the threshold rule is applied identically at 9am on a Monday and at 6pm on the last day of the quarter. And AI expense management that codes from the actual document removes the copy-the-last-one habit that hides so much miscoding.

Pattern detection across employees is the part no manual process reaches. Two people expensing the same dinner, a vendor that appears on one person's claims and nobody else's, a run of amounts hugging a threshold: these are visible in aggregate and invisible one report at a time. The same machinery that spots a duplicate subscription across departments spots a duplicate claim across employees, because it is structurally the same problem.

What to do when you find something

Slow down. The most common expensive mistake here is confronting an employee on the strength of a pattern that turns out to have a clean explanation.

1. Document before you talk. Pull the full history, not the one report that triggered the review. Establish whether this is an isolated item or a pattern, and over what period.
2. Quantify it. Total exposure changes what happens next, and you want the number before anyone else in the conversation does.
3. Involve HR and counsel early. Investigation, employment and legal exposure are their expertise, not finance's. Do not conduct an accusatory interview alone.
4. Assume error first. A meaningful share of what looks like fraud is a misunderstood policy, a genuine duplicate submission, or a receipt attached to the wrong line. Start with the question, not the conclusion.
5. Fix the control, not just the case. If one person found the gap, the gap is what to close. Terminating an employee and leaving the process unchanged buys you the same problem with a different name.

How much does expense fraud actually cost?

Be careful with the numbers that circulate on this topic. Widely quoted figures about the share of revenue lost to occupational fraud come from surveys of investigated cases, not from a census of all companies, and expense reimbursement is only one category within them. The honest version is that expense fraud is typically small per instance, long-running before discovery, and concentrated in organizations where receipts are not itemized and nobody reviews patterns. Rather than quoting a national statistic at your leadership team, measure your own: sample thirty reports at random, check them properly, and report what you find. That number will be more persuasive than any study, and it is defensible because you produced it.

The short version

Detect expense report fraud by requiring itemized receipts, matching every claim to the underlying document and to card transactions, applying a policy specific enough to decide questions, separating approvers from beneficiaries, and reviewing patterns across employees rather than one report at a time. The four schemes to look for are mischaracterized, overstated, fictitious and doubly-reimbursed expenses, and the signals worth watching are threshold-hugging amounts, round numbers, repeatedly missing receipts, weekend dates and unverified mileage. Most of this is automatable, which matters because the patterns that reveal fraud are exactly the ones a human reviewer looking at one report cannot see. Expenditure is software and insight, not legal, accounting or tax advice, and it never moves or holds your money.