Procurement Fraud: The Schemes That Start Before the Invoice, and How to Stop Them
Procurement fraud is dishonest conduct in how an organization chooses suppliers and approves purchases, usually to steer money to an insider or a favored supplier. It happens before an invoice reaches accounts payable, which is why invoice controls alone rarely catch it.
The schemes are costly when they happen. In the Association of Certified Fraud Examiners' 2026 study, purchasing department employees were the perpetrators in 118 cases (6%) with a median loss of $120,000, and corruption appeared in 83% of purchasing-department cases with scheme data, according to ACFE's Occupational Fraud 2026: A Report to the Nations.
That corruption share is the important part. Most purchasing fraud involves a deal between an insider and a supplier, so the invoice that eventually arrives in AP looks legitimate. It matches the PO, it matches the receipt, and the price is simply higher than it should be.
Key Takeaways
Procurement fraud happens at supplier selection, pricing, and approval, before an invoice exists. AP fraud happens at the invoice and payment stage.
The main pre-invoice schemes run from kickbacks and bid rigging to purchasing-card misuse, and each has a matching control.
A kickback-inflated price on a real supplier's invoice passes a three-way match, so controls have to sit where suppliers are chosen.
Red flags such as one supplier always winning are prompts to investigate, not proof of fraud.
Segregating who picks the supplier, who approves the purchase, and who pays is the foundation of every other control.
What is procurement fraud?
Procurement fraud is any scheme that corrupts the buying process itself, at the points where suppliers are chosen and purchases are approved. The goal is usually to pay a supplier more than the goods or services are worth, or to pay for something the company didn't need, with an insider sharing the gain.
It's different from AP fraud, though the two connect. Accounts payable fraud schemes target the invoice and payment stage, with schemes such as fake invoices and altered bank details. Procurement fraud happens earlier. By the time the invoice arrives, the damage is already priced in.
Some schemes are internal, run by one employee who controls a purchase from start to finish. Others are collusive, involving an employee and a supplier, or several suppliers working together. Collusive schemes are harder to catch, because every document can look correct. They also tend to last longer, since the people involved cover for each other when questions come up, and no single record looks out of place on its own.
What are the three types of fraud?
The ACFE groups occupational fraud into three categories. Asset misappropriation covers theft or misuse of company resources, such as cash or a purchasing card. Corruption covers schemes where an employee misuses influence in a business transaction for personal gain, including bribery, kickbacks, and conflicts of interest. Financial statement fraud covers deliberate misstatement of the company's financial results.
Procurement fraud sits mostly in the corruption category, with purchasing-card misuse and phantom suppliers on the asset-misappropriation side.
What are the most common procurement fraud schemes?
The most common procurement fraud schemes manipulate who gets chosen, what gets bought, or how purchases get approved. Here's how the main ones work and where they can be stopped:
Scheme | How it works | Red flag | Control |
Kickbacks | A supplier pays the buyer to win business or accept inflated prices | Prices above market from a favored supplier | Competitive quotes, price benchmarking, buyer rotation |
Conflict of interest | The buyer has an undisclosed tie to a supplier | A new supplier that wins quickly and often | Annual disclosure, vendor-to-employee data matching |
Bid splitting | One purchase is broken into smaller ones to stay under an approval limit | Clusters of purchases just under a threshold | Aggregated spend reports by supplier and requester |
Specification rigging | Requirements are written so only one supplier qualifies | Unusually narrow specs, sole-source requests | Independent review of specs above a set value |
Phantom or shell supplier | An insider creates a fake supplier and bills through it | Supplier with a residential address or PO box only | Vendor due diligence and onboarding by someone outside purchasing |
Purchasing-card misuse | A cardholder buys personal items or splits charges | Odd merchants, round amounts, weekend spending | Card controls and monthly manager review |
Documentation gaps make every one of these easier. In a 2017 report, GAO found that 22% of government-wide purchase card micropurchase transactions lacked complete documentation supporting the approval process. GAO estimated the rate at 23% for the Department of Defense, compared with 13% at Veterans Affairs. A purchase without a documented approval is a purchase nobody can check later.
How do kickback schemes work in purchasing?
A kickback scheme works when a supplier pays an employee, in cash, gifts, or favors, in return for steering business its way. The supplier recovers the payment by charging higher prices, delivering lower quality, or billing for more than it ships.
Nothing about the invoice that follows looks fake. Goods usually arrive, the PO matches, and the three-way match passes. Only the price is wrong, and nobody in AP is positioned to know that.
Federal law treats this seriously in government contracting. The Anti-Kickback Act, 41 U.S.C. 8702, prohibits providing, offering, soliciting, or accepting a kickback, or including one in a contract price, on federal contracts. It doesn't bind private buyers, but it shows how the scheme is defined.
What is bid splitting, and why does it cluster under approval limits?
Bid splitting is breaking one purchase into several smaller ones so each stays under an approval or competitive-quote threshold. It clusters just under the limit because that's where the extra scrutiny starts.
Public thresholds show where the pressure points sit. The Federal Acquisition Regulation, in FAR 2.101, defines the micro-purchase threshold as $15,000. Typical card purchases are far smaller. The average GSA SmartPay transaction in fiscal year 2025 was $480, according to GSA's program statistics. A run of purchases from one supplier, each a little under your own approval limit, deserves a closer look, especially when they share a date range and a requester.
What is bid rigging?
Bid rigging is collusion among suppliers to decide in advance who wins a competitive bid, while making the process look genuine. It defeats the whole purpose of asking for quotes. The OECD's 2009 Guidelines for Fighting Bid Rigging in Public Procurement describe four common forms:
Cover bidding, where some bids only give the appearance of genuine competition
Bid suppression, where competitors agree to refrain from bidding or to withdraw a bid
Bid rotation, where conspirators take turns being the winning bidder
Market allocation, where competitors carve up the market by customer or geography
The same guidelines note the stakes in the public sector, putting public procurement at approximately 15% of GDP in OECD countries, based on a 2007 OECD estimate. In the US, collusion on public contracts is prosecuted. The Justice Department's Procurement Collusion Strike Force, announced in November 2019, reports more than 200 investigations opened, more than 85 guilty pleas and trial convictions, and more than $70 million in fines and restitution as of April 30, 2026.
Private companies face the same patterns on a smaller scale. A three-quote rule looks strong on paper. It's easy to game when the same buyer chooses which suppliers to invite, and two of the three know they aren't meant to win. Watch for quotes that arrive in the same format, losing bids that are consistently just above the winner, and suppliers that subcontract to each other after the award.
How do you spot a buyer taking kickbacks from a supplier?
You spot a buyer taking kickbacks by looking for patterns in who wins, what they charge, and how the buyer behaves around that supplier. No single sign proves anything, but several together justify a closer look.
The patterns worth watching include:
One supplier wins far more often than its prices or quality would explain
Prices from a favored supplier drift above market or above other suppliers' quotes
Quotes come from suppliers that share addresses, owners, or contact details
Change orders or extras push a contract well above the original award
A buyer insists on handling one supplier personally and resists audits of that account
A buyer seems to avoid taking time off, so nobody else covers the work
In my experience, the strongest single signal is a supplier relationship nobody else is allowed to touch. Legitimate buyers are usually glad to hand a supplier to a colleague during vacation. Someone protecting a kickback arrangement isn't, because a fresh set of eyes would see the prices.
Red flags are prompts to look, not proof. A supplier can win often because it's genuinely the best option, and a buyer can skip vacation for ordinary reasons. Treat these signs as reasons to review the records, not as accusations.
What should happen when a red flag appears?
When a red flag appears, the first step is a quiet review of the records by someone outside the purchasing team. Pull the supplier's award history, compare its prices to other quotes and to market benchmarks, and check the supplier's address, owners, and bank details against employee records. Corpay issues single-use virtual cards, with each card number limited to one approved payment.
Keep the review confidential until the facts are clearer. Tipping off the buyer or the supplier gives them time to adjust records or coordinate a story. If the review supports the concern, escalate to internal audit or outside counsel, and preserve the emails and approval logs before anyone has a chance to tidy them. Investigators can rebuild a timeline from records, but only if the records still exist.
If the review finds nothing, close it and document why. A short written record protects the employee who was reviewed and gives the next reviewer a starting point if the pattern returns.
Which purchasing controls stop fraud before an invoice reaches AP?
The purchasing controls that stop fraud before an invoice reaches AP separate the key steps of a purchase and make each decision visible to someone else. The foundation is segregation of duties, so no one person can choose a supplier, approve the purchase, and release the payment.
On top of that foundation, most mid-size companies rely on five controls:
Competitive-quote rules above a set value, with someone other than the buyer choosing which suppliers to invite
Supplier onboarding outside purchasing, including tax-ID checks and vendor bank-detail verification
Approval workflows that route each requisition by amount and department, with a recorded audit trail
Annual conflict-of-interest disclosures, matched against supplier records
Management review and surprise audits of purchasing activity
The last control is cheap and measurably effective. With management review in place, the median fraud loss in ACFE's 2026 study was $84,000, against $186,000 without it, a 55% reduction. Surprise audits were associated with a 50% reduction. Reviews work partly because they catch fraud and partly because people know they're coming.
Controlling where people buy matters as well. The Hackett Group's Digital World Class procurement teams lose 60% less savings to maverick buying and contract noncompliance, according to a July 2025 Hackett release. Fewer off-contract purchases leave fewer places for a scheme to hide, which is why reducing maverick spend is a fraud control as much as a savings one.
Once the invoice arrives, AP controls take over. Teams asking how companies prevent AP fraud, such as check fraud and ACH fraud, will find the payment-side controls in the guide to accounts payable fraud. Those include positive pay, bank-detail verification by callback, and defenses against business email compromise.
How do small teams prevent procurement and AP fraud?
Small teams prevent procurement and AP fraud by splitting the few duties that matter most, even when there are only two or three people. The person who sets up suppliers shouldn't be the person who approves invoices, and neither should release payments alone.
Where splitting isn't possible, add review. An owner or outside accountant who reviews the supplier list, the payment register, and bank statements each month closes much of the gap. Automated checks for duplicate payments and changes to supplier bank details help a small team catch what nobody has time to look for manually.
How do single-use virtual cards limit purchasing fraud?
Single-use virtual cards limit purchasing fraud by tying each payment to one supplier, one approved amount, and one transaction. The card number can't be reused, so a stolen number or an inflated second charge has nowhere to go.
A kickback built into an approved price will still get paid. What the cards close are several payment-side openings, such as altered bank details and duplicate charges, and every transaction carries data that makes later review easier. The guide to single-use cards covers the mechanics in more detail.
Close the payment-side gaps with Corpay
Procurement fraud prevention starts with how purchases are approved and suppliers are chosen, and the payment step should keep those decisions intact. Corpay virtual cards pay approved suppliers with single-use virtual cards, so each payment matches one approved amount.
Corpay PO automation routes requisitions through automatic approval workflows with budget and policy checks, keeping approvals documented and separate from payment. Fully managed AP pays suppliers by virtual card, ACH, or check. Corpay offers 100+ ERP integrations, with NetSuite and Sage Intacct among them alongside Business Central and Acumatica, so approvals and payments stay in step with your ledger.
Frequently Asked Questions
What is an example of procurement fraud?
A common example is a buyer who accepts payments from a supplier in exchange for awarding it contracts at inflated prices. The supplier's invoices look normal and match their purchase orders, but the company overpays on every one.
What is a common red flag for procurement fraud?
A common red flag is one supplier winning far more often than its prices justify, especially when a single buyer handles that supplier exclusively. Clusters of purchases just under an approval limit are another frequent sign.
Is bid rigging illegal for private companies?
Collusion among competing bidders can violate antitrust law whether the buyer is public or private. Whether a specific situation is illegal depends on the facts, so consult counsel if you suspect suppliers are coordinating bids.
Who should investigate suspected procurement fraud?
Suspected procurement fraud should go to someone independent of the purchasing team, such as internal audit, the audit committee, or outside counsel and forensic accountants. Preserve records, and avoid confronting the suspected employee or supplier before the facts are gathered.
Switch to Corpay
Discover how making the move to Corpay streamlines payments and strengthens your business.
Talk to an ExpertSmarter payments. Stronger growth. Keep business moving.
Corpay powers payments for 800,000+ businesses worldwide. Let’s build what’s next for yours.