Start with what actually happens

Fraud in small and medium businesses is rarely dramatic. It is usually one of a small number of patterns:

• Fake or altered supplier invoices, paid because nobody checked them against a receipt
• Payment redirection — a real supplier impersonated, asking for new bank details
• Duplicate payments, sometimes accidental and sometimes not
• Expense claims that are inflated, duplicated or personal
• Ghost suppliers — a vendor record created that belongs to somebody inside the company
• Unauthorised discounts or credit notes given to a customer with a relationship

Notice what these have in common. None of them require sophisticated detection to prevent. They require somebody checking, and controls that make checking practical.

That is the frame for everything below.

What anomaly detection does

It learns what your transactions normally look like, and flags what does not fit.

What it catches well:

Duplicate bills. Same vendor, similar amount, close dates. Simple and effective.

Amounts outside the usual range. A vendor who normally bills a few hundred suddenly billing tens of thousands.

Changed supplier bank details. This is the highest-value single flag in the list. Payment redirection fraud is common, expensive, and almost always visible as a bank detail change on an existing supplier.

Unusual timing. Transactions posted at odd hours, or backdated into closed periods.

New vendors paid quickly. A vendor created and paid within days, with no prior history.

Round-number patterns. Amounts that avoid an approval threshold — several bills at just under the limit.

What it does not do

Four honest limits.

It does not find fraud that looks normal. A slightly inflated price from a real supplier, consistently, over years, does not stand out. That is caught by comparing against a market price, not by anomaly detection.

It does not know intent. A flag says unusual, not dishonest. Most flags are errors or legitimate exceptions.

It produces false positives, especially early. That is unavoidable and it is the learning period.

It does not replace controls. This is the important one, and it deserves its own section.

The controls that matter more

Segregation of duties does more to prevent fraud than any detection system.

The principle is simple: the person who can create a supplier should not be the person who can pay one. The person who approves a purchase should not be the person who receives the goods.

Where one person can do the whole cycle, fraud is easy and detection is your only defence. Where duties are separated, most of these schemes require two people to cooperate — which is a much higher bar.

In a small company perfect separation is not always possible. Even partial separation helps significantly, and knowing where the gap is matters.

Four other controls, all mundane and all effective:

Verify bank detail changes by phone, using a number you already had, not one on the email requesting the change.

Approval limits that are actually enforced, not worked around when someone is in a hurry.

Deactivate leavers promptly. Access that outlives employment is a genuine risk and it is extremely common.

Individual logins. Shared accounts destroy every audit trail your system keeps. You can see what was done and not who did it.

Three-way matching, again

It appears in every purchasing article for a reason. It is the single strongest control available.

Comparing what was ordered, what was received and what was billed catches invoices for goods that never arrived, prices different from the agreement, and quantities inflated after delivery.

And it only works if somebody counts the receipt. A receipt validated at the ordered quantity without counting makes the whole match meaningless — you are comparing an assumption against itself.

This is not a technology point. It is a habit that has to be trained and occasionally checked.

Expenses

The area where small fraud is most common, because amounts are small enough not to attract attention.

What helps:

Reading receipts automatically, so the claimed amount is compared against the document rather than typed by the claimant. Flagging duplicate claims. Flagging claims without a receipt attached. Comparing claim patterns between people in similar roles.

What helps more: a manager who actually looks. Automated flags surface candidates; somebody still has to look at them and be willing to ask.

Handling a flag

Worth planning before you switch anything on.

Most flags are not fraud. They are errors, unusual but legitimate transactions, or the system still learning.

Investigate quietly. Check the document, the order and the receipt before speaking to anyone. A wrong accusation causes lasting damage and is very hard to undo.

Have a defined route. Who investigates, who is told, what happens if something is genuinely wrong. Deciding this in the moment, under pressure, goes badly.

Keep records. Both of what was found and of what turned out to be nothing.

What to set up

1. Separate duties as far as your headcount allows. Write down where you cannot, and accept that those points need more monitoring.

2. Enable duplicate bill detection. Simple and it recovers real money.

3. Flag supplier bank detail changes and verify every one by phone.

4. Enforce three-way matching, and train counting as a habit.

5. Require receipts on expense claims and read them automatically.

6. Review access quarterly — who has admin, who left, who changed role.

7. Add anomaly detection last, and tolerate the early false positives.

The short version

Anomaly detection is a useful second line. It catches duplicates, unusual amounts, and — most valuably — changed supplier bank details.

The first line is dull and it is what actually prevents loss: separated duties, verified bank changes, enforced approval limits, receipts counted, and access reviewed.

A company with good controls and no anomaly detection is in much better shape than one with anomaly detection and one person who can create a supplier and pay them.