Most credit professionals focus on external fraud, fake customers, forged documents, payment scams. But internal fraud poses equal risk and often goes undetected longer. An employee with accounts receivable access can manipulate records, redirect payments, or write off legitimate balances. Prevention requires understanding common schemes and implementing appropriate controls.
Common Internal AR Fraud Schemes
Lapping: An employee steals a customer payment, then applies the next customer’s payment to the first customer’s account, creating a rolling pattern of theft. This continues until the employee either returns the money or is discovered.
Fictitious Write-Offs: Balances are written off as uncollectible when they’re actually legitimate debts. The employee either pockets the subsequent payment or colludes with the customer to split recovered funds.
Payment Diversion: Customer payments are redirected to accounts controlled by the employee. This requires access to payment processing or the ability to update customer banking information.
Ghost Customers: Fake customer accounts are created, invoices generated, and payments recorde, with funds ultimately flowing to the fraudster’s accounts.
Unauthorized Credits: Credits or adjustments are applied to customer accounts, reducing their balances. The customer makes a payment based on the adjusted balance, and the difference is stolen.
Red Flags to Monitor
Certain patterns should trigger investigation:
Reluctance to Take Time Off: Fraud often requires continuous manipulation. Employees who never take vacation may be maintaining schemes that would unravel during their absence.
Excessive Overtime: An employee working unusual hours may be using off-hours access to manipulate records without oversight.
Customer Complaints About Payments: When customers claim they’ve paid but your system shows otherwise, investigate thoroughly. This could indicate payment diversion.
Write-Off Patterns: One employee writing off significantly more accounts than peers, or write-offs concentrated on specific account types, warrants scrutiny.
Living Beyond Means: While not conclusive, employees suddenly displaying wealth inconsistent with their compensation might signal problems.
Prevention Through Controls
Segregation of Duties: No single person should handle both payment processing and account reconciliation. The person who opens mail shouldn’t also post payments. The person who authorizes write-offs shouldn’t process them.
Mandatory Vacation: Require all AR staff to take days off periodically. Assign their duties to others during absence. Many fraud schemes unravel when the perpetrator cannot maintain them.
Regular Account Reconciliation: Monthly reconciliation of AR subledgers to general ledger by someone outside the AR team catches discrepancies early.
Write-Off Approval Limits: Establish clear approval hierarchies for write-offs. No individual should have unlimited authority. Require documentation justifying each write-off.
Payment Confirmations: Periodically send payment confirmation statements to customers showing posted payments. Customers will flag discrepancies if their payments aren’t properly recorded.
System Access Controls: Limit system access to job requirements. Not everyone in credit needs write-off authority or the ability to modify customer banking information.
Detection Methods
Exception Reports: Generate monthly reports showing:
- Credits over specific thresholds
- Write-offs by employee
- Account adjustments by type and frequency
- Payments posted to unusual accounts
Random Audits: Periodically select random customer accounts for detailed review. Verify payments match bank records and account adjustments have proper documentation.
Data Analytics: Modern systems can flag unusual patterns, payments to accounts opened recently, write-offs followed by subsequent payments, or adjustments clustering around specific employees.
Response Protocol
When fraud is suspected:
Document Everything: Preserve all records, system logs, and evidence. Don’t confront the suspected employee until you’ve secured documentation.
Involve Appropriate Parties: Contact legal counsel, internal audit, and HR before taking action. Improper handling creates legal exposure.
Assess Scope: Determine how long the fraud occurred and total loss. This often requires forensic accounting expertise.
Review Controls: Understand how the fraud happened and what control failures enabled it. Prevention of future incidents depends on addressing root causes.
Cultural Considerations
The best control is culture. Organizations where employees feel valued, fairly compensated, and ethically led experience less internal fraud. When people believe the company treats them well, they’re less likely to justify theft.
Regular ethics training, clear policies, and consequences for violations reinforce expectations. The goal isn’t to assume everyone is dishonest, it’s to remove temptation and opportunity.
The Reality
Internal fraud damages more than finances. It destroys trust within teams, creates suspicion of innocent employees, and forces implementation of controls that make legitimate work more cumbersome.
Prevention is always preferable to detection. Strong controls, appropriate segregation of duties, and regular monitoring create environments where fraud is difficult to initiate and impossible to sustain long-term.
Your AR team handles significant money. Protecting it requires the same diligence you apply to external credit risk—appropriate controls, regular monitoring, and response protocols that trigger before small problems become catastrophic losses.
Internal controls are just one aspect of credit governance. For more risk management insights, follow our Fraud Friday series, or explore Chapter 15 of The Head of Credit & Collections Handbook for comprehensive coverage of credit control’s role in corporate governance and compliance.
