2.3 Fraudulent disbursements (billing, payroll, expense, check tampering, register)

Fraudulent disbursement schemes

Where cash-receipt schemes steal incoming money, fraudulent disbursement schemes cause the organization to pay out money for an illegitimate purpose. The perpetrator makes a distribution of company funds look like an authorized, legitimate payment. The ACFE recognizes five major categories: billing, payroll, expense reimbursement, check tampering, and register disbursements.

Billing schemes

Billing schemes are the most common and costly disbursement fraud. The fraudster causes the employer to issue a payment by submitting or manipulating an invoice.

• Shell company schemes. The employee forms a fictitious vendor and submits invoices for goods or services never provided; payments flow to a company the fraudster controls.
• Pass-through and pay-and-return schemes. A real vendor exists, but the fraudster inserts a shell in between to mark up goods actually delivered, or a legitimate vendor is deliberately overpaid and the excess is returned to the employee.
• Personal-purchases schemes. The employee buys personal items with company funds by running them through accounts payable or a company card, disguised as business expenses.

Payroll schemes

Payroll schemes cause false payments to be issued through the payroll system.

• Ghost employees. A person who does not work for the company — fictitious or a real ex-employee left on the roster — is kept on payroll, and the fraudster collects the paycheck.
• Falsified hours and salary. An hourly employee overstates hours worked or the pay rate is inflated.
• Commission schemes. A salesperson falsifies the sales on which commissions are based or alters the commission rate.

Expense reimbursement schemes

Employees seek reimbursement for fictitious or inflated business expenses.

• Mischaracterized expenses. Personal costs are claimed as business (a weekend trip billed as a client visit).
• Overstated expenses. A genuine expense is inflated by altering a receipt or claiming more than was actually spent.
• Fictitious expenses. Reimbursement is claimed for costs never incurred, using fabricated or borrowed receipts.
• Multiple (duplicate) reimbursements. The same expense is submitted and claimed more than once.

Check tampering

Unlike other disbursement frauds, where the fraudster fools someone else into signing a check, in check tampering the perpetrator physically prepares or intercepts the check itself.

• Forged maker. The fraudster signs the check without authority.
• Forged endorsement. A check intended for another payee is intercepted and its endorsement forged.
• Altered payee. The payee designation is changed on a check the fraudster prepared or intercepted.
• Authorized-maker schemes. A signer who has authority writes fraudulent checks to himself or an accomplice.
• Concealed checks. Fraudulent checks are slipped in among legitimate ones for an unwary signer's signature.

Register disbursement schemes

These frauds create a false entry at the point of sale so that cash can be removed from the register while the books still balance.

• False refunds. A fictitious refund is entered; no merchandise is actually returned, but cash is removed and inventory records are overstated.
• False voids. A completed sale is voided after the customer leaves, and the employee pockets the corresponding cash.

Register disbursement schemes differ from cash larceny and skimming at the register: here the theft is concealed by a fraudulent transaction on the register (a refund or void) that produces a disbursement record, rather than by simply removing recorded or unrecorded cash.

Classifying the schemes

Billing schemes deserve special attention because they typically produce the largest losses among disbursement frauds and can run for a long time before detection, since a well-formed invoice moves through accounts payable looking entirely routine. The common thread across all five categories is that the fraudster manufactures the appearance of a legitimate obligation — a real-looking invoice, a name on the payroll register, an approved expense report, a signed check, or a register transaction — so that the disbursement passes normal review. This is why detection depends less on catching the payment itself and more on independently verifying that the underlying event actually occurred: that goods were delivered, that the employee exists, that the expense was incurred, that the payee was intended, and that a genuine return took place.

Detection and prevention

Segregation of duties across purchasing, receiving, invoice approval, and payment is the core defense against billing schemes. Vendor master-file reviews flag addresses matching employees, P.O.-box-only vendors, and suppliers with sequential invoice numbers. Payroll controls include independent headcount verification and matching payroll to HR records to expose ghost employees. Expense-report frauds surface through receipt scrutiny, comparison of claims to policy, and duplicate-detection analytics. Check tampering is countered by positive pay, bank reconciliation performed by someone who cannot sign checks, and inspection of endorsements and altered instruments. Register schemes are detected by monitoring refund and void rates by employee and by requiring supervisor approval for every reversal. Across every category, trending each disbursement type against prior periods and against peer employees is one of the most efficient ways to surface an emerging scheme before the losses compound, because fraudulent payments almost always leave a statistical footprint even when each individual transaction looks defensible.