Preventing and Detecting Billing Schemes

Why This Topic Matters

Billing schemes are the most common and most costly form of fraudulent disbursement scheme covered in the ACFE's Fraud Examiners Manual. According to ACFE's Report to the Nations, billing schemes consistently appear in roughly 20% of all asset misappropriation cases and carry a median loss well above that of other disbursement frauds. They are dangerous because they exploit the normal accounts payable process: the perpetrator never has to physically touch cash. Instead, the organization's own system writes the check. For a Certified Fraud Examiner, understanding how to prevent and detect these schemes is a core competency tested in the Financial Transactions and Fraud Schemes section of the CFE Exam.

What Is a Billing Scheme?

A billing scheme is a fraudulent disbursement scheme in which an employee causes the employer to issue a payment by submitting invoices for fictitious goods or services, inflated invoices, or invoices for personal purchases. The ACFE classifies billing schemes into three main categories:

1. Shell company schemes – The employee creates a fictitious entity (often with a bank account, a P.O. box, and a business name that sounds legitimate) and submits invoices for goods or services that were never delivered, or that were delivered at inflated prices (pass-through schemes).
2. Non-accomplice vendor schemes – The employee uses a legitimate vendor without the vendor's knowledge. Common variants include pay-and-return schemes (intentionally overpaying or double-paying a vendor, then intercepting the refund check) and overbilling by altering or re-submitting legitimate invoices.
3. Personal purchases with company funds – The employee buys personal items and runs them through the purchasing system, either by falsifying purchase requisitions or by misusing company credit/purchasing cards.

How Billing Schemes Work

Every billing scheme depends on getting a fraudulent invoice approved and paid. The perpetrator typically needs one or more of the following:
• Authority to approve invoices or purchase orders
• Ability to add or modify records in the vendor master file
• Access to blank purchase orders or receiving reports
• A weak or non-existent three-way match (purchase order, receiving report, invoice)
• Collusion with another employee or an unquestioning supervisor

Shell company schemes most often involve services rather than goods, because there is no tangible inventory to receive and reconcile. The fraudster frequently sets the invoice amount just below the approval threshold so a single person can authorize payment. In pass-through schemes, the shell company actually buys real goods from a legitimate supplier and resells them to the employer at a markup.

Prevention: Key Controls

CFE exam questions frequently ask for the most effective control. Know these in order of importance:

• Segregation of duties – The functions of purchasing, receiving, accounts payable (approval), and payment (check signing or disbursement) should be performed by different people. This is the single most frequently tested preventive control.
• Vendor master file controls – Only authorized personnel (not purchasing or AP staff) should be able to add or change vendors. Require verification of new vendors: physical address, phone number, tax identification number, business license, and references. Periodically purge inactive vendors.
• Approved vendor list – Payments should only be made to vendors on a pre-approved list.
• Purchase order system and three-way match – Require a purchase order, independent receiving report, and vendor invoice to agree before payment is released.
• Competitive bidding – Rotation of vendors and sealed bids for large purchases reduce the chance of a favored shell company.
• Approval authority limits – Set meaningful thresholds and require secondary approval; watch for transactions clustered just beneath those limits.
• Purchasing card controls – Set spending limits, block merchant category codes, and require monthly reconciliation with receipts reviewed by someone other than the cardholder.
• Mandatory vacations and job rotation – Billing schemes often collapse when the perpetrator is away.
• Anti-fraud hotline and employee awareness training – Tips remain the number one detection method for all occupational fraud.

Detection: Red Flags and Techniques

Red flags in vendor data:
• Vendor address matches an employee's home address, or is a P.O. box or mail drop
• Vendor has no listed phone number, website, or physical location
• Vendor name is only initials or closely resembles a legitimate vendor's name
• Vendor lacks a taxpayer identification number, or shares one with another vendor
• Vendor was added recently and quickly became a high-volume payee
• Multiple vendors sharing the same address or bank account

Red flags in invoices and payments:
• Invoices with sequential numbers submitted over long periods (suggesting the employer is the vendor's only customer)
• Invoices for round-dollar amounts
• Invoices just below approval thresholds
• Invoices for services or consulting with vague descriptions
• Photocopied invoices or invoices lacking standard details (no fax, no terms, no invoice date)
• Duplicate invoice numbers or amounts
• Payments to a vendor significantly above budget or industry norms
• Unexplained increases in cost of goods sold or specific expense accounts with no corresponding increase in revenue or activity

Detection techniques:
• Analytical review – Compare expenses to prior periods, budget, and industry benchmarks; investigate variances.
• Data analytics – Match vendor master file against employee master file (address, phone, bank account, TIN); test for duplicate payments; use Benford's Law to identify unnatural digit patterns; sort payments by vendor to find those just below thresholds; identify vendors with sequential invoice numbers.
• Site visits and verification – Physically confirm that vendors exist; call phone numbers; check business registrations with the secretary of state.
• Review of cancelled checks and bank records – Examine endorsements and deposit accounts; a check to a vendor deposited into an employee's personal account is strong evidence.
• Budget-to-actual and horizontal analysis – Trend analysis of expense accounts over multiple periods.
• Review of purchasing card statements – Look for personal-type merchants, weekend purchases, and split transactions.

Exam Tips: Answering Questions on Preventing and Detecting Billing Schemes

1. Identify the scheme type first. Read the fact pattern and classify it: shell company, pay-and-return (non-accomplice vendor), or personal purchase. The correct control or red flag usually follows directly from the classification. For example, if an employee intercepts a refund check, think pay-and-return, and the control is independent handling of incoming mail and vendor refunds.

2. When asked for the 'most effective' or 'best' preventive control, segregation of duties is usually the answer – specifically separating purchasing, receiving, approval, and payment. If segregation is not an option, look for independent vendor master file control or the three-way match.

3. Distinguish prevention from detection. Prevention controls stop the scheme before payment (approved vendor lists, PO requirements, authorization limits). Detection methods find it afterwards (analytical review, data matching, site visits, examining cancelled checks). Exam questions often test whether you can tell these apart.

4. Know the classic shell company red flags cold. P.O. box addresses, vendor address matching employee address, sequential invoice numbers, invoices for services only, and vendors added right before a surge in payments are the most frequently tested indicators.

5. Remember why services are preferred by fraudsters. If a question asks why shell company invoices are typically for consulting or services, the answer is that services are intangible and cannot be verified by inventory counts or receiving reports.

6. Watch for 'just below the threshold' language. Any mention of amounts slightly under an approval limit is a signal pointing to a billing scheme and to the control of reviewing payments clustered beneath authorization levels.

7. Tips are the top detection method overall. If asked how most occupational frauds, including billing schemes, are detected, the answer is tips (often via hotline), not audits.

8. Pay-and-return questions test mail handling. The control is ensuring that incoming vendor refund checks are received and logged by someone independent of accounts payable.

9. Eliminate distractors that address other schemes. Controls such as surprise cash counts or register reconciliations relate to skimming or cash larceny, not billing schemes. Check tampering controls (positive pay, bank reconciliations) can overlap, but if the question is about fictitious invoices, choose the AP-related control.

10. Think like a fraud examiner, not an auditor. The CFE exam emphasizes understanding the perpetrator's method. When in doubt, ask yourself what the fraudster needed to make the scheme work, and choose the answer that removes that capability.

Quick Review Summary

• Billing schemes: shell company, non-accomplice vendor (pay-and-return, overbilling), personal purchases
• Best prevention: segregation of duties, controlled vendor master file, three-way match, approved vendor list
• Best detection: analytical review, vendor/employee data matching, Benford's Law, site visits, cancelled check review, hotline tips
• Top red flags: P.O. box vendors, sequential invoices, round amounts, sub-threshold amounts, service-only invoices, employee-vendor address matches

Master these relationships and you will be well prepared for any Preventing and Detecting Billing Schemes question on the CFE Exam.