Expense Fraud: Detection & Prevention
Expense fraud is any intentional misstatement of a business expense claim for personal gain, from an inflated mileage log to a personal dinner coded as a client meeting. It rarely arrives as one dramatic theft. It shows up as small amounts, submitted repeatedly, by people who have learned that nobody checks.
That pattern is what makes it hard to manage. A $60 overstatement doesn't trip any threshold, doesn't feel worth a conversation, and doesn't show up in a variance report. Repeated monthly by a handful of employees across a few years, it becomes a real number with a real audit finding attached. PwC's Global Economic Crime Survey 2024 found that 41% of organizations had experienced economic crime in the prior 24 months, with procurement fraud among the three most disruptive types, so the broader category is common enough that most finance teams will meet some version of it. Getting the basics right starts with understanding what belongs on an expense report in the first place.
Key Takeaways
Expense fraud is intentional, which is what separates it from the honest coding errors and forgotten receipts that make up most submission problems.
It falls under asset misappropriation, which ACFE research identifies as the most frequent category of occupational fraud by a wide margin.
Small businesses see expense schemes more often than large ones, and the median scheme runs roughly two years before anyone catches it.
Detection works through patterns across submitters, not through reading individual line items more carefully.
Prevention beats detection. Card-level controls block out-of-policy spend at authorization, before a reimbursement claim ever exists.
What separates expense fraud from an honest mistake?
Expense fraud is the deliberate submission of a false, inflated, or misclassified expense claim to obtain money the employee isn't entitled to. The word doing the work is deliberate. An employee who submits a lunch receipt for a meal that never happened is committing fraud; an employee who codes a client dinner to the wrong department is making a mistake.
That line matters practically, because the two problems need different responses. Bad coding is a training and system problem, and it usually gets better when the submission tool makes the right answer easy. Fraud is a controls problem, and it gets better when the opportunity narrows.
The category it belongs to tells you how common it is. Expense schemes fall under asset misappropriation, which the Association of Certified Fraud Examiners found in 89% of occupational fraud cases in its 2024 Report to the Nations, with a median loss of $145,000 per case across all occupational fraud types. Asset misappropriation is the most frequent and least costly of the major fraud categories, and expense reimbursement sits squarely inside it.
How is expense fraud different from AP or payment fraud?
Expense fraud comes from inside, through the reimbursement process. Payment fraud comes at the company from outside, through the payables process. Both cost money, but the mechanisms, the perpetrators, and the controls that stop them have almost nothing in common.
Payment fraud is the bigger headline number. AFP's 2025 Payments Fraud and Control Survey found 79% of organizations were victims of attempted or actual payments fraud in 2024. Business email compromise alone drove $2.77 billion in reported losses across 21,442 complaints during 2024, according to the FBI's Internet Crime Complaint Center. Those attacks target vendor master files, banking details, and approval chains, which is why the defenses look like verification callbacks and dual approval rather than receipt review. The AP side has its own body of practice, covered in the overview of accounts payable fraud and the practical steps in how to defend your company from payment fraud.
Employee expense fraud is smaller per incident and much harder to see. There's no phishing email to trace and no altered bank account to catch. The perpetrator is an employee in good standing submitting a claim through the process you designed for them.
Why do small, repeated claims add up?
Because the individual amounts stay below every threshold that would trigger review. A Chrome River survey of business travelers back in 2018 found that about 5% admitted to committing expense fraud and fewer than 15% were caught, putting the potential cost to US organizations at roughly $1.9 billion a year. The survey is dated at this point and I'd treat the dollar figure as directional rather than precise, but the detection-rate finding tracks with what most controllers see: the people doing this generally aren't caught, and so they keep doing it.
The arithmetic is unforgiving. An employee padding $200 a month across a five-person group is $12,000 a year that never appears as a line item anyone questions. It surfaces during an audit, or when someone leaves and their replacement submits half as much, or when a manager finally reads a report closely for an unrelated reason.
How do the recurring expense fraud schemes work?
Five schemes account for most of what finance teams actually find. None of them are clever, which is the point.
Inflated claims: real expenses submitted at a higher amount than actually paid, most often mileage, tips, and cash items with weak documentation.
Personal purchases as business: genuine receipts for genuinely personal spending, submitted under a plausible business category.
Duplicate submissions: the same expense claimed twice, sometimes across different reporting periods or through both a card and a reimbursement claim.
Mischaracterized expenses: real business-adjacent spending recoded into a category that's reimbursable when the actual category wasn't.
Fictitious claims: expenses that never happened, supported by altered, fabricated, or reused receipts.
The surface area for all five keeps growing. Global business-travel spending reached a record $1.48 trillion in 2024, according to the Global Business Travel Association, and travel and entertainment remains the category where documentation is weakest and judgment calls are most common. The dynamics specific to that category are worth reading on their own in the discussion of fraud and the T&E process.
Which schemes cost the most versus happen the most?
Frequency and severity run in opposite directions here. Inflated mileage and small personal purchases are by far the most common and individually trivial. Fictitious claims and systematic duplicate submission are rarer but produce the losses that end up in an audit finding, because they require sustained intent and therefore tend to run longer before discovery.
That's why sorting your response by dollar exposure alone gets it wrong. Routine mileage padding isn't worth a formal investigation, but the pattern it reveals about your control environment is worth acting on, since the same gap that allows it allows the larger scheme.
How do you detect expense fraud?
You detect it by analyzing patterns across submitters and time, not by scrutinizing individual reports harder. A reviewer reading one expense report cannot tell whether a $48 lunch happened. A system comparing that submitter's claims against their own history, their peers, and policy thresholds can flag the person whose meal claims cluster suspiciously close to the receipt-free limit.
Effective detection programs generally run four kinds of checks:
Threshold analysis: claims that repeatedly land just under a documentation or approval limit.
Duplicate matching: the same amount, date, and merchant appearing more than once across reports, cards, and periods.
Peer comparison: one submitter's category spending against colleagues in comparable roles and territories.
Sequence and timing checks: receipts with consecutive numbers, weekend dates on weekday travel, or claims submitted after a resignation notice.
None of this requires a data science team. Most of it is available in any competent expense platform, and the harder problem is usually organizational rather than technical, since somebody has to be willing to act on a flag about a well-liked colleague. The general hygiene around employee expense reimbursement does more preventive work than most audit programs.
How do teams catch fake or altered receipts?
Mostly through automated comparison rather than visual inspection. Optical character recognition pulls the merchant, date, and amount off the receipt image, and the system checks those against the claimed values, against the card transaction if one exists, and against every other receipt already in the database. A reused receipt fails the duplicate check instantly. An altered amount fails the match against the card record.
Image forensics catches some of the rest. Editing software leaves artifacts, and a receipt whose file metadata says it was created three weeks after the claimed purchase date is worth a question. Digital receipts fed directly from the merchant sidestep the problem entirely, which is one reason card-based capture beats photograph-based capture whenever it's available.
The honest limitation: none of this catches a cash expense with a real receipt for a personal purchase. That's a policy and category problem, not a detection problem, and the answer is to reduce how much cash spending your process permits at all.
How long does expense fraud usually go undetected?
Roughly two years, which is the uncomfortable finding buried in the ACFE data. Its 2024 Report to the Nations put the median duration of expense reimbursement schemes at about 24 months before detection, and found expense fraud in about 20% of cases at small businesses against roughly 12% at larger firms. Smaller organizations have fewer segregation-of-duties controls and more trust-based review, which is exactly the environment these schemes need.
Two years of undetected activity is the strongest argument for continuous automated review over periodic audit. An annual sample-based audit will find the outlier; it won't find the person who has been careful and consistent since the last one.
Which controls prevent expense fraud, and which only detect it?
You prevent it by removing the opportunity, which almost always means moving spending off reimbursement and onto controlled payment instruments. A reimbursement claim is a request for money based on an assertion. A card transaction is a record of what actually happened, captured by the network at the moment of purchase, with no gap for an assertion to live in.
Three layers do the work, in ascending order of effectiveness:
Policy: written, specific, and current, with dollar limits by category and a stated consequence for violations. Necessary but weak on its own, since policy only constrains people who read it.
Approval and review: manager sign-off plus the systematic checks described above. Catches things, but always after the money moved.
Point-of-spend controls: merchant category restrictions, per-transaction limits, and single-use card numbers that decline out-of-policy purchases at authorization. The only layer that prevents rather than detects.
That third layer is where the actual leverage sits, and it's the one most organizations underuse. The design questions behind it are covered in the guide to card controls and spend policies.
What role do corporate and virtual cards play?
They collapse the gap between spending and reporting. When an employee pays with a controlled corporate card, the transaction data arrives from the network with the merchant, amount, and timestamp already verified, so there's nothing to inflate and no receipt to fabricate. The employee's only remaining job is to explain the business purpose, which is a much smaller surface for dishonesty than constructing a claim from scratch.
Virtual cards tighten it further. A single-use number issued for a specific vendor and amount simply won't authorize anything else, which turns policy into a technical constraint rather than a rule someone chooses to follow. The T&E applications are laid out in the piece on how virtual cards improve T&E management, and consolidating categories onto a single multi-card program removes the coverage gaps where reimbursement creeps back in.
One caveat worth stating plainly. Cards don't eliminate expense fraud; they eliminate the schemes that depend on unverifiable claims. Mischaracterization survives, because an employee can still use a company card for a personal purchase and describe it as business. Category controls narrow that considerably, but they don't close it, and any vendor telling you otherwise is selling.
How does automation reduce the review burden?
By cutting the volume of submissions that need human judgment. When the majority of spend arrives as coded card transactions with verified data attached, the review queue holds exceptions instead of everything. A finance team that was reading 400 expense reports a month ends up reviewing 40 flagged items, which is the difference between a process nobody has time to do well and one that gets real attention.
The knock-on effect matters as much as the time saved. Reviewers who see only exceptions get better at recognizing them, while reviewers drowning in routine submissions develop the rubber-stamp habit that expense fraud depends on. Fitting expense controls into the wider picture of spend management is what keeps this from becoming another isolated tool, and the fundamentals of expense management are the foundation the controls sit on.
Stop expense fraud at the point of spend
The schemes above share one dependency: they need a gap between what an employee spent and what the company can verify. Corpay's expense management and card programs close that gap by making the payment itself the record.
Set merchant category restrictions, per-transaction limits, and cardholder-level rules so out-of-policy purchases decline at authorization rather than surfacing in a review queue three weeks later. Issue virtual card numbers locked to a vendor and an amount when a purchase needs tighter control than a standing card allows. Card transactions post with merchant, amount, and coding data attached, so the expense record builds itself and the review queue holds exceptions rather than routine claims. Corpay's managed service handles the supplier and program work that otherwise falls to your AP team.
See how Corpay Expense Management handles policy enforcement and receipt capture, how corporate cards apply controls across employee and departmental spend, or review the full commercial cards program to see how the pieces fit together. If you're evaluating, bring your three most common policy violations to the conversation and ask specifically how each one gets blocked.
Frequently Asked Questions
What is expense fraud?
Expense fraud is the intentional submission of a false, inflated, or misclassified expense claim to obtain reimbursement an employee isn't entitled to. Common forms include padded mileage, personal purchases claimed as business expenses, duplicate submissions, and fabricated receipts. Intent is what separates it from ordinary coding errors.
How can businesses reduce employee expense fraud?
Move spending from reimbursement onto controlled corporate or virtual cards, where merchant category restrictions and transaction limits block out-of-policy purchases at authorization. Pair that with a specific written policy, automated duplicate and threshold checks, and consistent enforcement. Prevention at the point of spend works better than review after the fact.
How do companies detect fake or altered receipts?
Automated systems extract the merchant, date, and amount from receipt images and compare them against the claimed values, the matching card transaction, and every receipt already submitted. Duplicates and altered amounts fail those checks immediately. File metadata inconsistencies and sequential receipt numbers flag additional cases for review.
How long does expense fraud usually go undetected?
The median expense reimbursement scheme runs about 24 months before discovery, according to ACFE research. Because individual claims stay below review thresholds, periodic audits often miss them entirely. Continuous automated pattern analysis shortens the window substantially.
What are the most common types of expense report fraud?
Inflated claims, personal purchases submitted as business expenses, duplicate submissions, mischaracterized categories, and entirely fictitious claims. Inflated mileage and small personal purchases occur most often, while fabricated and systematically duplicated claims produce the largest individual losses.
Switch to Corpay
Discover how making the move to Corpay streamlines payments and strengthens your business.
Talk to an ExpertSmarter payments. Stronger growth. Keep business moving.
Corpay powers payments for 800,000+ businesses worldwide. Let’s build what’s next for yours.