Article
Duplicate Payment Fraud: Risks and Controls
Duplicate payment fraud is when the same invoice is paid twice, once legitimately and once through error or manipulation, and the second payment is diverted or never recovered. It is a distinct risk category from ordinary duplicate payments because someone benefits from the second payment on purpose. This guide covers how it happens, what it costs, and the controls that catch it before the money leaves the account.
What is the difference between a duplicate payment and duplicate payment fraud?
A duplicate payment is any case where the same invoice gets paid more than once, whether the cause is a data-entry slip, a vendor resending an invoice, or a payment run that reprocesses something already paid. Duplicate payment fraud is a subset of that: someone, inside or outside the company, deliberately engineers the second payment and arranges for it to land somewhere it should not. The distinction matters for how you respond. An accidental duplicate is a process fix. A fraudulent one is an investigation, and possibly a police report.
How does duplicate payment fraud actually happen?
Three patterns show up again and again in AP teams:
- Vendor master duplication. The same supplier gets entered twice under slightly different names, addresses, or tax IDs. A fraudster (or an insider) points one of the duplicate records at a different bank account, then submits an invoice that matches one already paid under the other record.
- Resubmission with a twist. A vendor's second copy of an invoice, sent because the first payment seemed slow, gets approved again, sometimes with new remittance details attached that redirect the money.
- Split or recoded invoices. The same charge is coded against two different purchase orders or cost centers so it clears two separate approval paths without either approver seeing the full picture.
Duplicate payments most often start as an entry or process gap - a vendor set up twice, an invoice coded to two POs, a second copy of an invoice paid because the first didn't look reconciled yet. Fraud enters when someone exploits that gap on purpose, usually by changing where the second payment goes.
How much does duplicate payment fraud actually cost?
The numbers are bigger than most finance teams expect.
APQC's Open Standards Benchmarking research puts duplicate and erroneous payments at roughly 0.8% to 2% of total annual disbursements, with the low end representing top performers and the high end representing bottom performers. For a services firm paying out $10 million a year to vendors and subcontractors, that is $80,000 to $200,000 a year moving out the door twice or by mistake, before anyone tries to get it back.
Fraud losses run higher once intent is involved. In ACFE's Occupational Fraud 2026: A Report to the Nations, the median loss per case across all occupational fraud types was $104,000, the average loss was $1,457,000, and one in five cases topped $1 million. Cases that ran more than five years before detection produced median losses over $1.1 million. Duplicate payment fraud is not always caught quickly, either: it hides inside a normal-looking payment run, not a suspicious one.
How fraud actually gets caught matters too. Per ACFE's 2026 findings, 43% of occupational fraud cases were first detected through a tip, more than any other method, including internal audit and management review combined with several other categories. That is a sign that most AP controls are not catching this on their own. Someone has to notice and say something, which is a slow and unreliable way to find a problem that a payment control should have stopped before the money moved.
What controls actually catch duplicate payment fraud?
Different controls catch different things. None of them catch everything on its own.
| Control | What it catches | What it misses |
|---|---|---|
| Manual review (spot checks) | Obvious duplicates a reviewer happens to remember | Anything outside the reviewer's memory or workload capacity |
| Duplicate-invoice-number matching | Same invoice number, same vendor, paid twice | A renumbered invoice, or a vendor entered twice under different records |
| Vendor master file audits | Duplicate or near-duplicate vendor records | A vendor record that looks clean until the bank details change |
| 3-way matching (invoice, PO, receipt) | Invoices with no matching PO or receipt | An invoice that matches the PO but was already paid, or a legitimate-looking resubmission |
| Agreement-level matching (contract, SOW, rate card) | Rate-card violations, scope creep, and invoices that don't trace back to a real agreement, in addition to PO-level checks | Nothing structural, but it still depends on the underlying data being complete |
| Segregation of duties | One person unilaterally entering, approving, and releasing the same payment | Collusion between two people who split those roles |
Most AP teams run a mix of the first four. The gap they miss most often is the one between "this invoice looks fine" and "this invoice was already paid, or shouldn't be paid the way it's billed." That gap is exactly where duplicate payments and rate-card violations both hide, and it is why AP teams increasingly check invoices against the whole agreement rather than the purchase order alone.
Why do duplicate payments and fraud slip past a three-way match?
A three-way match confirms an invoice lines up with a purchase order and a receipt of goods or services. It does not check whether that exact invoice, or one very close to it, was paid last month under a slightly different vendor record or PO number. It also does not check the invoice against the underlying contract, SOW, or rate card, so a legitimate-looking invoice that bills the wrong rate, or bills for work already covered under a different line, sails through untouched. Fraud that rides in on a changed bank account or a resubmitted invoice looks, on paper, exactly like a normal one, which is why manual AP teams catch it less often than teams with better matching in place.
What should an AP team do this month to reduce the risk?
A few changes carry most of the weight:
- Run a vendor master file cleanup. Look for the same tax ID, address, or bank account attached to more than one vendor record.
- Treat every bank-detail change request as a verification event, not a data update. Call the vendor on a known number before changing anything.
- Check invoices against the agreement, not just the PO. A rate-card check or SOW comparison catches billing that a PO-only match cannot see.
- Separate entry, approval, and payment release so no single person can push a payment through end to end.
- Review the exception report, not just the clean invoices. The ones that get held up for a reason are the ones worth a second look.
None of this means adding headcount before you've tightened the process. The point is to absorb the extra checking into the workflow you already have, not to hire your way out of a control gap. A person should still approve every payment; the job is to make sure they are approving the right one.
What does this cost a services firm in practice?
An accounts payable specialist carries a national base salary of roughly $52,000 to $63,000 according to Robert Half's 2026 guide, and benefit costs add close to another 30% on top of wages in private industry, per the Bureau of Labor Statistics. That puts a fully loaded AP hire in the $65,000 to $80,000 range before a single invoice is reviewed. That cost line does not include what a firm loses to duplicate and erroneous payments in the first place, which APQC puts at 0.8% to 2% of disbursements regardless of headcount. The practical read: the fix is rarely just people or just software. It is tightening the controls in the workflow you have, and using both the review step and better matching to close the gap a three-way match leaves open.
FAQ
What is duplicate payment fraud?
Duplicate payment fraud is when the same invoice is paid twice and the second payment is deliberately diverted or kept, rather than being an honest processing mistake. It differs from an accidental duplicate payment because someone engineers the second payment on purpose, often by changing bank details or exploiting a duplicate vendor record.
How common are duplicate payments?
APQC's benchmarking research finds that organizations report 0.8% to 2% of total annual disbursements as duplicate or erroneous payments, with top performers at the low end and bottom performers at the high end.
Can a three-way match catch duplicate payment fraud?
A three-way match confirms an invoice lines up with a purchase order and a receipt, but it does not check whether that invoice, or a near-duplicate, was already paid under a different vendor record or PO number, and it does not check the invoice against the underlying contract or rate card. It catches missing documentation, not repeat or manipulated payments.
What is the fastest way to catch a duplicate payment before it's paid?
Matching on invoice number, vendor, and amount catches exact repeats. Catching near-duplicates requires cleaning up the vendor master file so the same supplier isn't hiding under two records, and treating every bank-detail change as something to verify by phone before it's applied.
Who usually catches duplicate payment fraud, and how?
Per ACFE's 2026 Report to the Nations, 43% of occupational fraud cases were first detected through a tip, more than any other single method. That points to a gap: most payment controls are not catching this kind of fraud on their own, which is one reason exception reporting and agreement-level checks matter.
Should we hire someone to stop duplicate payments, or fix the process first?
Tightening controls, cleaning up the vendor master file, and verifying bank-detail changes usually closes most of the gap before headcount does. The right frame is absorbing the extra checking into the workflow already in place rather than adding a person to catch what a control should catch.