Fraud and anomaly detection is an automation that watches your money moving, AP payments, expenses, payroll changes, refunds, and bank activity, learns what normal looks like for your business, and flags the odd ones for a person before or right after they clear. It does not block anything on its own. A human decides on every flag. Most teams are live in two to three weeks.
The problem
Money leaves your business through a lot of doors, and no one watches all of them. AP payments go out through a bill-pay tool, expenses come in through cards and reimbursements, payroll runs on its own schedule, refunds get issued from support, and the bank feed ties it all together after the fact. Each channel looks fine on its own. The odd ones hide in the gaps: a vendor whose bank details changed the week before a big payment, a duplicate that clears because two people paid it, an expense that is a little too round and a little too frequent, a payment sized just under the amount that would need a second signature.
Put a number on it. The ACFE's Occupational Fraud 2024: A Report to the Nations reports that fraud examiners estimate organizations lose 5% of revenue to fraud each year. Applied to a B2B company doing about $8 million in revenue, that estimate works out to roughly $400,000 a year, and the report calls the 5% figure conservative because so much fraud goes undetected. Most of it is not a dramatic heist. It is small, patient, and it clears because nobody was looking at that particular transaction on that particular day.
The hours are not the real cost here. The real cost is the payment that went to a spoofed bank account and cannot be clawed back, the duplicate nobody caught until the vendor mentioned it, the expense pattern that ran for a year before anyone added it up. By the time these show up in a reconciliation or an audit, the money is gone. A person cannot eyeball every transaction, so the ones that matter slip through with all the ones that are fine.
How the automation works
It watches every channel money moves through.
It connects to your accounting system, bill-pay tool, expense and card platform, payroll, and bank feed, and reads each transaction as it happens: who, how much, to what account, against what pattern.
It learns your normal and checks against it.
It builds a picture of what usual looks like for you, this vendor, this amount range, this frequency, this approver, and checks each new transaction against it. It catches the specific odd ones: a vendor bank-detail change, a duplicate payment, an out-of-pattern expense, a payment sized just under an approval threshold, a payroll edit nobody expected.
It flags the odd ones for a person.
Anything that looks off goes to a named person with the reason attached: this vendor's bank account changed three days ago, this is the second identical payment this week, this expense is four times the usual. The clean majority pass through untouched. A human reviews each flag and decides.
The pieces are proven: connectors into finance and payroll systems, pattern learning, rules for the known fraud shapes, and an alert queue a person works. The real work is the wiring, and it is a genuine tuning problem. Set the system too sensitive and it cries wolf on every slightly-unusual payment until people tune it out and stop reading the alerts, which is worse than no system at all. Set it too loose and it misses the one that mattered. The hard part is learning your actual normal so flags stay rare and real, which takes a tuning window against your real transaction history, and building it so a person always makes the call rather than the software quietly acting on its own. That is what gets set up, tested, and handed over during implementation.
What this looks like in practice
Payments through a bill-pay tool, books in QuickBooks, cards and expenses on a card platform, one finance lead and a part-time controller.
- Nobody reviews individual payments before they go out; the finance lead spots-checks the batch and trusts the approval flow for the rest.
- A vendor emails updated bank details, the change is entered, and a $28,000 payment goes out to the new account before anyone verifies it was really the vendor asking.
- Duplicates, out-of-pattern expenses, and just-under-threshold payments only surface at reconciliation, weeks later, if at all.
- The vendor bank-detail change is flagged the moment it happens, before the $28,000 payment is released, and held until the finance lead confirms it with the vendor by phone. It turns out the request came from a spoofed email, and the payment never goes out.
- Duplicate and just-under-threshold payments are flagged the day they appear, not discovered at close.
- The finance lead reviews a short list of real flags each week instead of trusting that nothing slipped through.
Typical impact
Typical ranges for this pattern, not client claims. Your numbers get modeled in the audit.
Systems it connects
Plus most tools with an API. The audit maps your exact stack.
Who this fits
- Enough money moving across enough channels that no one reviews every transaction, AP, expenses, payroll, and refunds
- 10 or more employees, with a finance lead or controller who would own the flags
- Payments going out through more than one path (bill-pay, cards, payroll, bank), so a single approval flow does not see everything
- You want a person to decide on every flag, not a system that blocks payments on its own