Expense fraud is one of the most common forms of employee fraud we investigate, and consistently one of the most underestimated. Organisations that would respond swiftly to a suspected payroll manipulation or vendor scheme often let expense fraud run for months — sometimes years — because the amounts involved seem small, the process of checking claims feels disproportionate, and there is a general reluctance to imply that a trusted colleague is being dishonest about a taxi receipt.
That reluctance is understandable. It is also expensive. According to the Association of Certified Fraud Examiners, expense reimbursement fraud accounts for around 21% of all occupational fraud cases. The median loss per case sits at approximately $26,000, but in the cases we handle at the senior end — where the perpetrator has seniority, a corporate card, and limited oversight — the figures are frequently much higher.
This article explains what expense fraud looks like in practice, how we investigate it, and what organisations can do to make themselves a harder target.
What Is Expense Fraud?
Expense fraud is the deliberate submission of false or inflated expense claims by an employee in order to obtain reimbursement they are not entitled to. It sits within the broader category of asset misappropriation and, in England and Wales, can constitute an offence under the Fraud Act 2006 and the Theft Act 1968 depending on the nature and value of the conduct.
What makes it distinct from other forms of employee fraud is its accessibility. Almost every employee with a business travel or entertainment budget has the means to commit it. The controls that exist — receipts, approval workflows, expense policies — are often perfunctory in practice, particularly for senior staff who have built up a degree of trust and whose claims are rarely scrutinised in detail.
I have investigated expense fraud committed by people at every level of an organisation, from junior sales staff padding mileage claims to finance directors running personal expenditure through corporate accounts over a period of years. The mechanics change with seniority and access. The underlying dynamic — an individual exploiting a process that is not being properly supervised — is consistent throughout.
Common Expense Fraud Schemes
Expense fraud rarely takes a single form. In most investigations, we find a combination of methods operating simultaneously — some systematic, some opportunistic. Understanding how each works helps explain both why they persist and how they get uncovered.
Duplicate Claims
Submitting the same expense twice — against different cost codes, in different periods, or through different approval routes — is one of the most straightforward forms of expense fraud and one of the easiest to miss without systematic data analysis. In organisations where expenses are processed manually, or where approval sits with a line manager rather than a central finance function, duplicates can pass through repeatedly before anyone notices the pattern.
The volume can be significant. I have seen cases where an individual had submitted the same set of client entertainment receipts multiple times across a twelve-month period, each time through a slightly different route, accumulating tens of thousands of pounds in reimbursements that should never have been paid. When we ran the data, the duplication was obvious within minutes. No one had looked at it systematically before.
Falsified Receipts
Altered or fabricated receipts are a step up in sophistication from duplicate claims but remain surprisingly common. The most basic version involves editing a genuine receipt — changing the amount, the date, or the vendor — using tools that are freely available and require no particular technical skill. More elaborate versions involve the creation of entirely fictitious receipts, sometimes supported by fake vendor details or correspondence.
Digital receipts have introduced new forensic possibilities here. Metadata embedded in image files can reveal when a document was created or modified, and by what device or application. I have worked on cases where an employee was submitting what appeared to be legitimate restaurant receipts, but metadata analysis showed the files had been created on their home computer several days after the date printed on the receipt. That kind of discrepancy is not something a manual approvals process would ever surface.
Physical receipts present different challenges but are not beyond analysis. Paper stock, print quality, font consistency, and formatting details can all be examined where the volume of suspicious claims warrants it.
Personal Expenses Submitted as Business
Coding personal expenditure as a legitimate business expense is the most prevalent form of expense fraud we encounter, and the hardest to detect without detailed scrutiny. At one end of the spectrum it involves small, individually unremarkable items: a personal meal submitted as a client dinner, a domestic fuel cost claimed as a business journey. At the other end it can involve substantial and systematic abuse — holidays submitted as conference travel, home improvement costs submitted as client-facing property expenses, family members’ costs bundled into entertainment claims.
The common thread is plausibility. These claims pass approval because they look like legitimate business expenses at first glance, and because the approver either lacks the context to question them or is disinclined to do so. Seniority provides significant cover here. In my experience, the claims of senior employees are subjected to far less scrutiny than those of junior staff, even though the values involved are typically much higher and the discretionary authority greater.
Red Flags That Should Prompt Closer Examination
No single indicator confirms expense fraud. But the following patterns, drawn from the cases we investigate, are consistently worth attention:
- Claims submitted consistently just below approval thresholds — a pattern that suggests deliberate structuring rather than coincidence.
- A high volume of cash claims in an environment where card payments are the norm, particularly where receipts are hand-written or from unfamiliar vendors.
- Client entertainment claims that cannot be cross-referenced against CRM records, meeting logs, or client-side confirmation.
- Mileage claims that, when mapped, do not correspond to the business destinations stated — or that exceed what the journeys could plausibly involve.
- Expense submissions that spike around the same dates each month or period, suggesting fabrication rather than genuine business activity.
- Claims from an individual who resists switching to a company card, insisting on cash reimbursement despite a card being available.
- A pattern of claims from a small number of vendors that cannot be independently verified as legitimate businesses.
- An employee who handles their own expense approvals, or whose manager approves claims with apparent regularity but no substantive review.
The challenge with expense fraud is that these patterns often only become visible when someone looks at the data as a whole rather than claim by claim. The approvals process is typically designed to review individual submissions, not to identify trends across an individual’s claims over time. That structural gap is what most expense fraud exploits.
How Investigators Uncover Expense Fraud
When we are brought in to investigate suspected expense fraud, the starting point is almost always data. Before any interviews take place, before anyone is confronted, I want to understand what the numbers actually show — across the full history of the individual’s claims, not just the period that initially raised concern.
A structured data review typically covers:
- The full claims history for the individual under review, mapped against approval records, payment dates, and cost codes.
- Duplicate detection — identifying the same or near-identical amounts submitted across different periods, categories, or approval routes.
- Vendor verification — checking that suppliers named in claims correspond to registered businesses with a legitimate trading history.
- Geographic and temporal analysis of mileage and travel claims — mapping stated journeys against actual distances and cross-referencing against diary records, access logs, or other corroborating data.
- Receipt examination, including metadata analysis for digital submissions and forensic review of physical documents where the volume or value warrants it.
- Comparison of expense patterns against the individual’s role, client-facing activity, and any available corroborating records such as meeting logs or travel bookings.
What the data review typically produces is not proof in itself, but a defined set of claims that require explanation — and a clear picture of the scale and pattern of the suspected conduct. That picture shapes the interview strategy.
Interviews in expense fraud investigations tend to follow a specific sequence. Supporting witnesses — finance staff, administrators, colleagues who may have observed relevant behaviour — are interviewed before the subject. By the time we sit down with the individual under investigation, we know which claims we cannot reconcile and why, and we can ask precise questions about specific transactions rather than relying on general allegations.
In cases where the suspected fraud involves fabricated receipts or falsified documentation, we may instruct a forensic document examiner or engage digital forensics specialists to provide independent analysis that can be presented as expert evidence if proceedings follow.
Preventing Expense Fraud
Investigation addresses fraud after the fact. Prevention is the more efficient response, and most organisations have more room to improve here than they realise. The controls that exist on paper are often not the controls that operate in practice, and the gap between the two is where fraud takes root.
The measures I most consistently recommend to clients after an expense fraud investigation are:
- Implement automated duplicate detection as a standard feature of the expenses process. This is not technically complex and removes one of the most reliably exploited gaps in manual approval workflows.
- Require corporate card use for business expenditure wherever possible, and treat persistent cash reimbursement requests as a flag for review.
- Apply the same level of scrutiny to senior employees’ claims as to junior ones. The instinct to trust seniority is understandable; in an expense context it is also a structural vulnerability.
- Conduct periodic data-driven reviews of expense patterns across individuals and teams, rather than relying solely on point-of-submission approval.
- Ensure that no individual approves their own expenses, and that approval chains are not so compressed that a manager is effectively reviewing their own team’s claims without oversight.
- Make it clear, through policy and practice, that expense claims are subject to audit. The knowledge that claims may be scrutinised retrospectively has a measurable deterrent effect.
- Provide a genuinely confidential reporting mechanism. In the ACFE’s research, tip-offs from colleagues are the most common detection route for all forms of occupational fraud, including expense fraud. People will only use that mechanism if they trust it.
None of these measures is sufficient on its own. What matters is the combination — and the signal it sends that expense claims are taken seriously and reviewed with genuine attention. Most expense fraud operates in the space between a policy that exists and a culture that does not enforce it.
A Real Investigation: What It Looked Like in Practice
A few years ago we were engaged by the board of a mid-sized professional services firm who had been alerted to a concern by their incoming finance director. A review of the departing FD’s expense history — prompted by a routine handover — had produced several anomalies that the new appointee could not reconcile.
The initial concern was relatively narrow: a set of client entertainment claims that did not correspond to any clients the new FD could identify in the firm’s records. What our data review revealed was considerably wider. Over a period of approximately three years, the individual had submitted claims totalling just under £180,000, a significant proportion of which could not be supported by legitimate business activity.
The fraud operated across several methods simultaneously. Duplicate claims had been submitted through different cost codes in different periods. A number of receipts had been digitally altered to increase the amounts. Personal expenditure — including family holidays, home furnishings, and private vehicle costs — had been systematically coded as business expenses, supported in some cases by receipts from businesses the individual had a personal connection to.
The investigation produced a detailed findings report covering all identified claims, the evidence supporting each finding, and a reconstruction of the total loss. That report was used to support a civil recovery claim, which was settled before proceedings were issued. A separate referral was made to the relevant professional body. The firm also implemented a series of control improvements as part of the post-investigation remediation.
What stayed with me from that case was how straightforwardly the fraud had been concealed. Not through sophisticated technical means, but simply through the assumption that a senior person’s expenses would not be looked at closely. That assumption had held for three years. It took a new finance director asking basic questions for it to unravel.
Concerned about expense fraud in your organisation? Find out how our corporate fraud investigation service can help.
Related Services
For organisations dealing with broader internal fraud concerns, the following services may be relevant:
- Corporate Fraud Investigations
- Internal Fraud Investigations
- Workplace Investigations