Purchase-to-pay checks that stop fake invoices

The purchase-to-pay checks that stop a fake supplier invoice being paid, from vetting suppliers to matching and duplicates, and which Achekam applies.

By Achekam · 11 October 2026 · 5 min read · For Running a business businesses in South Africa, Nigeria, Kenya

A fake invoice does not need to be clever. It needs to look roughly like the ones your business pays every week, arrive at a busy moment, and land on the desk of someone who does not have the time or the authority to question it. If the person who receives it can also load the supplier, approve the bill and release the payment, one tired afternoon is enough.

ICAEW describes invoice fraud as criminals sending a fraudulent invoice or bill to a company requesting payment for goods or services. Sometimes the criminal is outside the business, posing as a supplier. Sometimes they are inside it. Either way, the defence is the same: a purchase-to-pay process with several independent checks, so that a fake invoice has to get past more than one person and more than one comparison.

Where a fake invoice gets in

Most fake invoices enter through one of three doors:

• A new supplier. A name nobody has dealt with before, set up quickly because "the manager said so".
• Changed details. An e-mail from a real supplier, or what looks like one, announcing new bank details. The next genuine invoice is paid to the fraudster.
• A rushed approval. An invoice marked urgent, with pressure to pay today and skip the usual checks.

ICAEW lists the warning signs: mismatches between the invoice and the purchase order, delivery note or contract terms (including prices, quantities or VAT treatment), and invoices labelled "urgent" or accompanied by pressure to bypass controls. Each door has its own check.

Vetting suppliers and checking against what is on record

ICAEW recommends tightening supplier onboarding and verification, and independently checking any change to a supplier's bank details. In practice:

1. Before a new supplier is loaded, confirm it exists: registration documents, a VAT or tax number where relevant, a physical address and a phone number you find yourself.
2. Load the supplier once, in one list, and do not allow a second record for the same business.
3. Treat any request to change bank details as suspicious until proven otherwise. Call the supplier on a number you already had, not one in the e-mail.

ICAEW also advises that when an invoice raises concerns, the finance team should pause and verify the supplier independently, using contact details already on record rather than those on the invoice. A fraudster controls everything printed on the invoice; they do not control your own records.

Three people, three jobs

ICAEW recommends separating who sets up suppliers, who approves invoices and who makes payments. AccountingTools makes the same point about the second and third roles: the employee who enters supplier invoices should not be the person who authorises or processes payments, so that nobody can create a fake invoice and approve it themselves.

In a small business, the owner often takes the third job. That works, provided the owner looks at what they are releasing rather than approving a total.

Matching and duplicate checks

ICAEW recommends three-way matching, duplicate invoice checks and limits on manual overrides. Three-way matching compares the invoice with the purchase order and with the record of what was actually delivered. A fake invoice has no genuine order behind it and no delivery to match. A real supplier's inflated invoice fails the price or quantity comparison.

Duplicate checks catch the other common loss: the same invoice paid twice, once from the e-mailed copy and once from the paper one, or once by the original supplier and once by a fraudster who copied it.

Limits on overrides and urgent exceptions

Every process needs an exception route, and every fraudster looks for it. Write the rules down:

• An override needs a written reason and a second, senior approver.
• "Urgent" is never a reason on its own.
• Overrides are listed and reviewed each month by someone who did not approve them.
• Any supplier with repeated overrides is reviewed as a supplier, not invoice by invoice.

What Achekam applies

Achekam's procurement and payables build several of these checks into the process:

• One supplier list. A business keeps one supplier list with duplicate checks by name or VAT number, and quotations, orders and bills pick suppliers from it. One limit: at the time of writing, a supplier's VAT number must be in the South African format, so Nigerian and Kenyan VAT numbers are refused; rely on the name check and your own vetting there.
• Orders that someone else approves. Staff raise a requisition that someone other than the requester approves, a purchase order is raised from the selected quotation, and the person who raised the order cannot approve it.
• Deliveries recorded. Deliveries are recorded against the order line by line, including part deliveries, and a goods-received record is kept.
• The match hold. A supplier invoice recorded against an order is matched with what was ordered and what arrived. If price or quantity differ, it is held until someone writes a resolution note.
• Supplier invoice numbers. Posting a matched supplier invoice puts it in the ledger as expense, input VAT and trade payables, and the supplier's invoice number stops it being posted twice.
• Bills without an order. A supplier bill recorded without a purchase order waits for approval before it posts.

Release of the money stays outside Achekam: paying a supplier in Achekam only records the payment, and no bank payment file is produced for suppliers. The third job, releasing payment at the bank, therefore sits naturally with a different person from the one who loads and approves bills.

For worked examples, see catching duplicate supplier invoices in retail and a supplier invoice paid twice.

A starting point

ICAEW's guide on how to identify and deal with fake invoices sets out the warning signs and the preventive controls behind them. Write down who sets up suppliers, who approves invoices and who releases payments in your business; if one name appears twice, change that before anything else.

General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.