Controls · July 19, 2026

How to prevent expense fraud

You prevent expense fraud with four layers working together: a written policy with clear per-category limits, separation of duties so nobody signs off on their own spending, receipt and approval rules above a dollar threshold, and real-time monitoring that flags duplicates, outliers, and new merchants the day a charge posts. No single control catches everything. Fraud slips through the gap between them, so the win is closing the gaps, not buying one silver-bullet tool.

Last updated July 2026. Loss figures below are drawn from the Association of Certified Fraud Examiners (ACFE) Report to the Nations, the most widely cited occupational-fraud study. Treat them as directional benchmarks, not a measurement of your own exposure.

What are the most common types of expense fraud?

The most common types are duplicate claims, inflated amounts, personal spending on a company card, fictitious or altered receipts, mischaracterized expenses, and unauthorized recurring charges. Prevention starts with knowing which pattern you are actually trying to catch, because each one leaves a different fingerprint in the data.

The four-layer prevention stack

Every serious anti-fraud program stacks controls so that spend has to pass more than one gate. Think of it as defense in depth: a determined insider might defeat one layer, but defeating all four at once is far harder and leaves a trail.

Layer 1: A written expense policy with real limits

Most fraud thrives in ambiguity. A policy that names per-category limits, what needs a receipt, what needs pre-approval, and what is never reimbursable removes the "I didn't know" defense and gives every later control something to enforce. Keep it short enough that people read it. A reusable structure is in our corporate card policy template.

Layer 2: Separation of duties

Nobody should approve their own spend, and the person who books an expense should not also reconcile it. This is the single control the ACFE consistently links to lower losses, because most schemes need one person to control both sides. Even in a small team, route approvals so the requester and the approver are never the same human.

Layer 3: Receipts and approvals above a threshold

Require an itemized receipt and a manager sign-off above a sensible dollar line, say $75 or $100, so review effort lands where the risk is. Below that, spot-check. The threshold matters: set it too low and approvers rubber-stamp everything; set it too high and padding hides underneath it. Duplicate payments and fake vendor invoices are their own attack surface on the accounts-payable side, which is why many teams pair card controls with accounts payable automation that flags duplicate and suspicious invoices before a payment ever goes out.

Layer 4: Real-time transaction monitoring

The first three layers are policy and process; they work at approval time and month-end. The gap they leave is time. The ACFE reports that occupational fraud often runs for a year or more before anyone catches it, precisely because reconciliation happens once a month and a clever scheme stays under the review threshold. Monitoring closes that gap by watching the card and bank feed continuously and alerting on the patterns fraud leaves behind.

Can software detect expense fraud automatically?

Yes. Monitoring software watches the transaction feed and flags what a manual review misses: the same amount charged twice, a charge well above an employee's normal range, a brand-new merchant, a weekend or off-hours transaction, or spend that crosses a budget threshold. It surfaces these as alerts within hours instead of at month-end. That speed is the whole point: a duplicate caught the day it posts is a two-minute reversal, while the same duplicate found ninety days later is a write-off and an awkward conversation.

The important honesty here is that monitoring detects; it does not block. A read-only expense anomaly detection layer cannot decline a transaction, and any tool that promises to "stop" fraud at the point of sale is really asking you to move all your spending onto its own issued card. Detection plus a fast human response catches the same fraud without surrendering the cards and banking relationships you already have. For company cards specifically, that means continuous corporate card monitoring across every card at once, not a per-card spreadsheet.

How much does expense fraud cost businesses?

The ACFE's Report to the Nations commonly cites organizational fraud losses of roughly 5 percent of annual revenue, with expense-reimbursement schemes carrying a median loss near $40,000 and frequently running a year or more before detection. Smaller companies are hit hardest per dollar of revenue, because they run the fewest controls and often trust rather than verify. The cost is not only the stolen money; it is the reconciliation time, the legal exposure, and the culture damage when honest employees see that padding goes unnoticed.

A prevention checklist you can run this quarter

None of this requires a fraud department. Work down the list; each item closes a specific gap and none of it depends on trusting people less, only on making the honest path the easy one.

• Publish a one-page expense policy with per-category limits and a receipt threshold.
• Confirm no employee can approve their own spend, cards included.
• Reconcile every company card monthly against posted transactions, not just submitted claims.
• Turn on alerts for duplicates, amount outliers, new merchants, and off-hours charges.
• Review budget vs actual by category so mischaracterized spend surfaces as a variance.
• Audit recurring charges quarterly and kill the ones nobody owns.
• Rotate who reviews expenses, and spot-check below the approval threshold.

Two of these lines, the alerts and the recurring-charge audit, overlap with the warning signs in our expense fraud red flags rundown, which is the detection companion to this prevention playbook.