July 19, 2018

How to spot (and stop) fake receipts

Josh Anish

During a recent edition of our popular webinar series, KPMG partner and occupational fraud investigator Guido van Drunen made a comment in passing about fake receipt websites.

Before he could move on to his next slide, the question field in the webinar software lit up like a Christmas tree.

Almost a dozen corporate finance and accounts payable pros had questions – and wanted to commiserate – about fake receipts.

A quick, topical Google Search shows the breadth and scope of the problem. There are literally dozens of “high-quality” fake receipt sites across the web, on which underhanded employees can conjure up receipts out of thin air.

This problem is especially thorny because auditors (both human and AI-based) are trained to spot issues like duplicate expenses, gift card misconduct, illicit upgrades, bogus mileage claims, and other underhanded methods of defrauding the company.

Much of this auditing work is done by cross-checking against historical databases; for example, the AppZen system has taught itself that “K-Kel, Inc” is actually just a shell name that appears on credit card statements as a proxy for Spearmint Rhino gentlemen's club in Las Vegas. Now it’s a rule: whenever the system sees “K-Kel, Inc” on an expense report, it’s flagged for potential misconduct.

But the challenge with fake receipts is similar to Batman’s problem thwarting Heath Ledger’s Joker: What can you do when the villain doesn’t play by any rules?

Fake receipts simply don’t exhibit the hallmarks of traditional employee expense misconduct. Auditing expertise and technology doesn’t help much when you’re trying to figure out whether you should reimburse someone for a $50 steak when in fact he stayed at the hotel and ate a $7 burrito just because he wanted to pocket the difference at the company’s expense.

Here is a fake receipt from one of the sites listed in the search mentioned above. Visually, it appears real. The Aroma Cafe is real; it’s really at 1211 Green Street in NYC. And nothing the person claims to have ordered is outside most corporate policies. The problem is, of course, that the receipt is a record of something that never took place.

So how can companies identify and thwart minor frauds like these? As pointed out earlier in the Batman analogy, it isn’t easy.

AppZen’s AI has been able to develop a few tactics to begin tackling the problem. The first is reading for human error. For example, maybe the employee typed in the wrong state sales tax in the receipt, or perhaps totalled the dollar amounts incorrectly. Sometimes, these “enterprising” folks also can’t keep their stories or timelines straight, fake-invoicing for dinners in a city at a certain time in which the airplane tickets prove they were in the air. Haste makes waste, and now we can catch these missteps.

Another method is anomalous spend detection at a specific vendor. In other words, our system keeps records of mean and median spends at a given restaurant. For example, if the average dinner for one person with a drink and a dessert at Aroma Cafe is only $50 historically, our system would flag this $90 receipt which is 80% above average.

Finally, our system often learns what certain receipts simply look like. If a sneaky employee wants to create a fake receipt for, say, a Jet Blue bag he allegedly had to pay to carry on to a work flight, our AI knows the patterns and fonts of the airline’s authentic receipts.

Fake receipts aren’t usually masterpieces in the annals of forgery. They usually have different intensity distributions; real receipts often feature imperfections like inconsistent lighting, crinkles, shearing, and fading. We train our receipts to model what real receipts look like, visually.

Like the Joker, fake receipts are a problem no one in Gotham asked for. They’re a nagging challenge both to human bandwidth and computer learning, The good news is that the solution is getting stronger, and the bad guys’ days are numbered.