Risk · July 7, 2026
Expense fraud: 12 red flags finance teams should watch for
Expense fraud is the abuse of company cards or reimbursements for personal gain, and it rarely announces itself. It shows up as patterns: duplicates, splits, round numbers, odd hours. Here are the twelve red flags finance teams should watch for, with a detection tip for each, and a severity table for triaging what you find.
Why expense fraud hides in plain sight
Occupational fraud research, most prominently the ACFE's recurring global studies, has long estimated that organizations lose on the order of 5 percent of revenue to fraud each year, and that expense reimbursement schemes run for many months before detection, with median losses per case in the five figures. Treat those as category knowledge rather than a prediction about your company; the operational lesson is the same either way. Individual fraudulent charges are usually small and individually defensible. What gives them away is repetition, and repetition is only visible if someone, or something, is looking at the whole transaction stream rather than one expense report at a time.
No single charge looks like fraud. The pattern does.
The 12 expense fraud red flags
1. Duplicate receipts and charges
The same expense claimed twice: once on the card, once as a reimbursement, or the same receipt submitted in two different months. Detection tip: match on merchant plus amount within a 48-hour window across both card feeds and expense reports, not within a single report.
2. Split transactions
One purchase broken into several charges to stay under a per-transaction limit: $980 twice instead of $1,960 once. Detection tip: flag multiple same-merchant charges from one cardholder inside a single day, especially when each sits just below a policy cap.
3. Round-number amounts
Real invoices carry taxes and odd cents. A run of expenses at exactly $50.00, $100.00, or $200.00 suggests estimates or fabricated receipts. Detection tip: report on the share of a cardholder's charges ending in .00; an outlier versus peers deserves a look.
4. Off-hours and weekend activity
Charges posting at 2 a.m. or on weekends from roles with no travel or on-call duty. Detection tip: baseline each employee's normal transaction hours and flag departures, rather than applying one blanket rule to field staff and accountants alike.
5. New or unusual merchants
A first-ever merchant for that employee, particularly one with a generic name or a merchant category that does not match their job. Detection tip: keep a per-employee merchant history; the first charge at any new merchant gets a lightweight review, not an interrogation.
6. Personal-adjacent categories
Groceries, rideshares on Saturday night, streaming services, gas stations near home rather than the office. Each is defensible once; a pattern is a lifestyle subsidy. Detection tip: tag merchant categories that are dual-use and review them monthly as a set.
7. Amounts just under approval thresholds
If approvals kick in at $500, watch the $480 to $499 band. Fraud clusters just below whatever line you draw. Detection tip: histogram charges by amount; a spike immediately below a threshold is one of the most reliable signals in expense analytics.
8. Velocity spikes
A cardholder whose transaction count doubles with no corresponding project, trip, or seasonal reason. Detection tip: alert when a card exceeds roughly three times its trailing 90-day weekly average, then ask about the cause while it is current.
9. Ghost vendors and ghost subscriptions
Recurring payments to a vendor nobody can name, sometimes a shell set up by an insider, sometimes just a subscription whose owner left. Detection tip: require every recurring merchant to map to a named internal owner; anything unmapped is investigated by default.
10. Refund and credit abuse
Buying on the company card and refunding to a personal card, or expensing a purchase that was later refunded. Detection tip: match refunds to their original charges and flag refunds with no matching company-card credit within 30 days.
11. Weekend and personal travel padding
Business trips that always bridge a weekend, upgraded rooms, extra nights, meals for unnamed guests. Detection tip: compare trip cost per day against the team median for the same city; consistent outliers merit a policy conversation.
12. Category mismatch
The expense says "client dinner", the merchant is an electronics store. Miscoding hides both fraud and honest overspend. Detection tip: validate the claimed category against the merchant's network category code and flag disagreements automatically.
Red flag severity: a triage table
Not every flag deserves the same response. A practical triage, assuming a single occurrence; repetition moves anything up a tier:
Swipe the table sideways to compare all columns.
| Severity | Red flags | Response |
|---|---|---|
| High | Ghost vendors (9), refund abuse (10), split transactions (2) | Investigate before the next billing cycle; suspend the card if unexplained |
| Medium | Duplicates (1), just-under-threshold (7), velocity spikes (8), category mismatch (12) | Same-week review with the cardholder's manager |
| Watch | Round numbers (3), off-hours (4), new merchants (5), personal-adjacent (6), travel padding (11) | Log it; escalate on the second occurrence |
Handling a flag without poisoning the culture
Most flagged transactions have innocent explanations: a real conference on a weekend, a legitimate new vendor, a genuine duplicate the merchant caused. Treat the first conversation as data collection, not accusation. Ask the cardholder to walk you through the charge, write the answer down, and close the flag. Two things follow from this posture. First, employees stop fearing the process, which means they keep using the card properly instead of routing spend through reimbursements where you have even less visibility. Second, the person who does have something to hide now knows charges get looked at within days, and deterrence does more work than detection ever will. Document every review, apply the same process to executives as to everyone else, and escalate to a formal investigation only when the explanation contradicts the records.
Catching the pattern in real time
Every tip above can be run by hand against a card statement, and once a quarter you probably should. But the flags that matter most, splits, velocity, duplicates, new merchants, are time-sensitive: the useful conversation happens the day of the charge, not three weeks later at close. That is the case for automated expense fraud detection running continuously on the card feeds you already have, scoring every transaction against these patterns and alerting someone while the trail is fresh.
Prevention starts upstream too. Clear limits remove ambiguity about what is allowed; our corporate card policy template covers limits by role and the graduated response to violations. And since ghost subscriptions are one of the quietest leaks, a periodic subscription audit closes the recurring-charge blind spot that per-transaction review never sees.