Billing Schemes

1. Why Billing Schemes Matter
Billing schemes are the most common and among the most costly form of fraudulent disbursement identified in the ACFE Report to the Nations. They appear in roughly one in five asset misappropriation cases and carry a median loss that is consistently higher than most other asset misappropriation categories. For the CFE exam, the Financial Transactions and Fraud Schemes section leans heavily on the ACFE Fraud Tree, and billing schemes sit at a key branch: Asset Misappropriation → Cash → Fraudulent Disbursements → Billing Schemes. Expect several questions that test whether you can identify a billing scheme, distinguish its three sub-types, recognize red flags, and recommend controls.

2. What Is a Billing Scheme?
A billing scheme is a fraudulent disbursement scheme in which the perpetrator causes the victim organization to issue a payment by submitting invoices for fictitious goods or services, inflated invoices, or invoices for personal purchases. The defining feature is that the organization's own accounts payable system generates the payment. Unlike cash larceny or skimming, the fraudster does not physically take cash; instead, the company willingly cuts a check or sends a wire because it believes it owes the money. Because the payment travels through normal channels, it is recorded on the books and can go undetected for years.

The ACFE classifies billing schemes into three sub-types:
• Shell company schemes
• Non-accomplice vendor schemes
• Personal purchases with company funds

3. How Billing Schemes Work

A. Shell Company Schemes
A shell company is a fictitious entity created for the sole purpose of committing fraud. It typically has no physical operations and often consists of nothing more than a name, a mailing address (frequently a P.O. box or the employee's home), and a bank account. The process generally follows these steps:
1. Forming the shell – The fraudster files a certificate of incorporation or a DBA (doing business as) and opens a bank account, often in the shell's name. Some use a relative's name or a slightly altered version of a legitimate vendor's name.
2. Submitting false invoices – The fraudster prepares invoices (often using inexpensive software or templates) and submits them to accounts payable.
3. Getting the invoice approved – This is the critical step. Common methods include: the fraudster being in a position to approve purchases personally; forging a supervisor's signature; exploiting rubber-stamp approval practices; or colluding with someone in purchasing or receiving.
4. Collecting the payment – The check or electronic payment is sent to the shell's address and deposited into the shell's account.

Two important variations: Services vs. goods – shell companies most often bill for services (consulting, maintenance, advertising) because there is no tangible item to receive, no receiving report to match, and inventory counts will not reveal a shortage. Pass-through schemes – rather than billing for nothing, the fraudster's shell actually purchases real goods from a legitimate supplier and resells them to the employer at a marked-up price, pocketing the difference. Pass-through schemes are usually run by employees with purchasing authority.

B. Non-Accomplice Vendor Schemes
Here the fraudster manipulates payments to a legitimate vendor who is unaware of the fraud. The two main methods are:
• Pay-and-return schemes – The employee intentionally causes an overpayment, double payment, or payment to the wrong vendor. When the vendor refunds the excess, the employee intercepts the refund check and converts it. Alternatively, the employee may deliberately pay the wrong vendor, then request the money be returned and steal the returned check.
• Overbilling with a non-accomplice vendor's invoices – The employee alters or re-submits a legitimate vendor's invoice (e.g., changing the amount, re-running a paid invoice) and diverts the payment, often by changing the vendor's remittance address in the master file temporarily.

C. Personal Purchases with Company Funds
The employee buys goods or services for personal benefit and has the organization pay for them. Methods include:
• Running the purchase through accounts payable – The employee submits an invoice or purchase requisition for a personal item (electronics, home improvements, vacations) disguised as a business expense. Those with approval authority simply approve their own requests; others forge approvals or exploit weak review.
• Falsifying or altering purchase orders after approval to add personal items.
• Having items shipped to the office and taking them home, or shipping directly to a home address.
• Purchasing card (P-card) and company credit card abuse – using cards for personal expenses, often relying on managers who do not scrutinize statements.
• Returning legitimately purchased items for cash or credit after the company has paid.
Note the overlap: when the item purchased is inventory that the employee then steals, the ACFE still classifies it as a billing scheme because the fraud occurred through the purchasing/disbursement process, not through physical theft of existing inventory.

4. Red Flags of Billing Schemes
Vendor-related red flags:
• Vendor address matches an employee's home address or a P.O. box / mail drop.
• Vendor has no physical address, no phone listing, no website, or no tax ID.
• Vendor name is similar to a legitimate vendor (e.g., ABC Supply vs. ABC Supplies Inc.).
• Vendor was added to the master file recently, by a single person, with no approval documentation.
• Vendor bills only for services or vaguely described items.
• Vendor payments are approved by only one person, always the same person.
Invoice-related red flags:
• Invoices are consecutively numbered over long periods (suggesting the company is the vendor's only customer).
• Round-dollar amounts, amounts just below approval thresholds, or unusually frequent invoicing.
• Invoices lack detail, folds, staple marks, or other signs of normal mailing; or appear photocopied.
• Invoices with no purchase order or receiving report.
• Duplicate invoice numbers or duplicate amounts to the same vendor.
Behavioral and analytical red flags:
• Unexplained increases in cost of goods sold or expense lines without matching increases in revenue or activity.
• An employee living beyond his or her means, or refusing to take vacation.
• Unusually close relationship between a buyer and a vendor.
• Rising spend concentrated with a single vendor.

5. Detection Techniques
• Vendor master file analysis – match vendor addresses, phone numbers, bank accounts, and tax IDs against employee records; search for P.O. boxes; identify vendors added and used only once.
• Data analytics on payments – sort payments by vendor and look for round numbers, amounts just under approval limits, sequential invoice numbers, duplicate payments, and payments on weekends or holidays. Benford's Law analysis can highlight fabricated amounts.
• Three-way match testing – verify that invoice, purchase order, and receiving report agree; isolate invoices paid without all three.
• Site visits and phone verification of suspicious vendors.
• Review of approval patterns – identify managers who approve a disproportionate share of a vendor's invoices.
• Analysis of refund and credit activity for pay-and-return indicators.
• P-card statement review for personal merchants (retail, travel, home improvement).
• Horizontal and vertical analysis of expense accounts to spot unexplained growth.

6. Prevention and Controls
• Segregation of duties – separate purchasing, receiving, accounts payable, and vendor master file maintenance. The person who approves a vendor should not be the person who approves payments to it.
• Formal vendor approval process – independent verification of new vendors (physical address, tax ID, references) before they are added to the master file; periodic purge of inactive vendors.
• Mandatory three-way match before payment, with competitive bidding for larger purchases.
• Approval limits with escalating authorization and review of transactions clustered just below thresholds.
• Rotation of duties and mandatory vacations for purchasing and AP staff.
• Independent review of P-card statements and hotline/whistleblower channels (tips remain the leading detection method).
• Positive pay and electronic payment controls so bank payees match the approved vendor list.

7. Exam Tips: Answering Questions on Billing Schemes

Tip 1 – Know the Fraud Tree placement cold. Billing schemes are fraudulent disbursements, which are cash schemes under asset misappropriation. If a question describes an employee causing the company to pay a false invoice, it is a billing scheme, not larceny, skimming, or a check tampering scheme. The key discriminator: the company issues the payment believing it is legitimate.

Tip 2 – Memorize the three sub-types and their defining features. Shell company = fictitious vendor controlled by the fraudster. Non-accomplice vendor = real, innocent vendor whose invoices or refunds are manipulated (think pay-and-return). Personal purchases = real goods/services, but for the employee's benefit. Many exam questions present a scenario and ask which sub-type it is.

Tip 3 – Distinguish billing schemes from neighboring schemes.
• Check tampering – the fraudster physically prepares, forges, alters, or intercepts a check. In a billing scheme, the check is legitimately produced by the AP system.
• Expense reimbursement – the employee claims personal money back through an expense report; a billing scheme uses an invoice/purchase through AP.
• Inventory larceny – stealing goods the company already owns; buying goods through a false requisition and taking them is a billing scheme (personal purchases).
• Payroll – false payments to a ghost employee, not a vendor.
• Corruption/kickbacks – involves a real, colluding vendor paying the employee; if the vendor is complicit in overbilling, the ACFE treats it as corruption (billing schemes with a vendor accomplice fall under kickbacks). A non-accomplice vendor scheme is a billing scheme.

Tip 4 – Remember why services are preferred. If asked why shell companies tend to bill for services rather than goods, the answer is that services are intangible, leave no receiving report or inventory shortage, and are harder to verify.

Tip 5 – Understand pass-through schemes. A pass-through scheme is a shell company scheme in which real goods are purchased and resold at a markup. It is typically perpetrated by someone with purchasing authority. Do not confuse it with a kickback, which requires a colluding outside vendor.

Tip 6 – Pay-and-return is the signature non-accomplice vendor scheme. Any scenario involving an intentional overpayment or double payment followed by interception of the refund points to pay-and-return.

Tip 7 – Red flag questions reward specificity. The most frequently tested red flags are: vendor address matching an employee address, P.O. box addresses, sequential invoice numbers, invoices lacking detail or for services only, round-dollar amounts, amounts just under approval thresholds, and payments approved by a single individual.

Tip 8 – Control questions reward segregation of duties. When asked for the best preventive control, favor answers involving separation of purchasing, receiving, payables, and vendor-file maintenance, or independent vendor verification. When asked for the best detective technique, favor matching the vendor master file to employee records or analyzing payment data.

Tip 9 – Read for who controls the vendor and who benefits. Ask yourself: Is the vendor real? Is the vendor aware? Did the employee personally receive the goods? Those three questions resolve almost every classification question.

Tip 10 – Watch qualifiers. The CFE exam uses phrases like most likely, best, least likely, and NOT. Eliminate choices that describe check tampering, expense reimbursement, or corruption when the stem clearly describes payment through accounts payable for a false or inflated invoice.

8. Quick Recap
• Billing schemes = fraudulent disbursements via the AP system; most common and costly fraudulent disbursement type.
• Three types: shell company (including pass-through), non-accomplice vendor (pay-and-return, overbilling), personal purchases (including P-card abuse).
• Key enabler: ability to approve invoices or weak approval/vendor setup controls.
• Key red flags: suspicious vendor data, sequential or vague invoices, round or threshold-level amounts, single approver.
• Key controls: segregation of duties, independent vendor verification, three-way match, data analytics, hotlines.
Master these points and you will be well prepared for any billing scheme question on the CFE exam.