Learn how accounts receivable fraud happens, including lapping and fictitious credits, the red flags to watch, and controls that prevent it.
Shyam Agarwal
Accounts receivable fraud is the theft or manipulation of customer payments or receivable records, either by employees who handle receivables or by outside criminals who trick customers into paying the wrong account. Common schemes include lapping, skimming payments, issuing fictitious credit memos or write-offs to hide theft, and redirecting customer payments through fake bank detail changes.
Accounts receivable fraud is any intentional act that steals money owed to a company or falsifies receivable records. It falls into two broad types: asset misappropriation, where cash from customers is stolen, and financial statement fraud, where receivables are overstated to inflate revenue or assets.
The Association of Certified Fraud Examiners identifies asset misappropriation as the most common form of occupational fraud, and receivables are an attractive target because customer payments flow through the AR function every day.
Most accounts receivable fraud follows a small number of well-known patterns.
Lapping is a scheme in which an employee steals a payment from one customer and hides the theft by applying a later payment from a second customer to the first customer's account. The second customer's shortfall is then covered with a payment from a third customer, and so on.
Lapping requires constant attention to keep the shortfall moving, which is why it is often discovered when the employee takes leave or a customer questions a statement.
Skimming is theft of a customer payment before it is recorded in the accounting system. Because the payment is never recorded, the invoice remains open, and the fraudster may later hide it with a credit memo or write-off. Skimming is most common where checks are received by mail and handled by one person.
Fictitious credit memos and write-offs are used to remove the receivable for a payment that has been stolen. The customer paid, the payment was taken, and the open invoice is cleared with an unapproved credit or written off as bad debt so no one chases it. Requiring approval for every credit memo and reviewing write-offs of accounts receivable by user prevents this.
Fictitious sales create receivables for customers or transactions that do not exist, usually to meet revenue targets or earn commissions. The receivables are later written off, credited, or left to age. Unusual customer addresses, new accounts with no payment history, and invoices with no delivery records are warning signs.
Payment redirection fraud happens when a criminal impersonates the seller, often from a compromised or look-alike email address, and tells customers that bank details have changed. Customers then pay the criminal's account instead of the seller's. The seller's receivable stays open, and the customer believes it has paid.
This is a form of business email compromise. It is prevented by never changing remittance details by email alone, telling customers to verify any bank detail change by phone using a known number, and investigating quickly when a customer says it paid but no cash arrived.
Receivables can be overstated deliberately through practices such as recording sales before goods are delivered, bill-and-hold arrangements without a valid business reason, or keeping an allowance for doubtful accounts that is too low. These schemes inflate revenue and assets rather than steal cash.
The most common warning signs of accounts receivable fraud are customer complaints about payments not being credited, a growing balance of unapplied cash, frequent credit memos or write-offs approved by the same person, receivables growing faster than sales, reconciliation differences that persist, and an employee who refuses to take vacation or share duties.
Other red flags include:
Growing unapplied cash deserves special attention, because lapping and misapplication often show up there first.
Internal accounts receivable fraud is usually committed by employees who have access to both customer payments and the ability to change customer balances, such as AR clerks, cashiers, or bookkeepers in small finance teams. External fraud is committed by criminals who impersonate the seller to redirect customer payments.
Opportunity is the common factor. The accounts receivable internal controls that remove that opportunity, especially segregation of duties, are the most effective defense against both internal and external schemes.
Preventing accounts receivable fraud depends on separating cash handling from record keeping, requiring approval for credit memos and write-offs, applying payments using remittance data, protecting customer master data, and reconciling the AR subledger to the general ledger every month.
The person who receives or applies payments should not approve credits, write-offs, or reconciliations.
Fewer mailed checks mean fewer chances to skim.
Matching each payment to the invoices named in the remittance advice makes misapplication visible.
Require a reason, supporting evidence, and a second approver.
Changes to addresses and remittance details should require approval and verification.
A reviewed accounts receivable reconciliation exposes unexplained differences.
Statements sent by someone outside the cash function let customers spot missing credits.
Schemes like lapping are hard to maintain when someone else does the work.
Data analysis detects accounts receivable fraud by looking for patterns that normal reviews miss. Useful tests include listing credit memos and write-offs by user and by size, matching customer addresses and bank details against employee records, flagging payments applied to a different customer than the remitter, and comparing the timing of credit memos with payment dates.
Running these tests regularly turns them into continuous monitoring rather than a one-time review. Auditors use many of the same techniques during an audit of accounts receivable.
When accounts receivable fraud is suspected, the company should preserve records, restrict the suspected person's system access, avoid confronting them before evidence is secured, involve legal counsel and, where appropriate, forensic accountants, and notify its insurer if it has crime or fidelity coverage. Customers affected by payment redirection should be contacted promptly to stop further payments to the wrong account.
After the investigation, the control gap that allowed the fraud should be fixed and the fix tested.
Technology reduces accounts receivable fraud risk by enforcing approvals, recording every change, and making exceptions easy to see. Systems that keep a full history of payments, credits, and disputes are much harder to manipulate quietly than spreadsheets or shared mailboxes.
In Quick Receivable, cash application records trace each applied amount back to the original cash receipt, disputes keep their owner, reason, and resolution history, and receivables data follows Salesforce's role-based permissions. Automated cash application matches payments to invoices using remittance information, which makes payments applied to the wrong account easier to spot.
40%
DSO reduction70%
less manual work95%
cash match accuracyFind out exactly how much time and money your AR team can save with Quick Receivable. No commitment, no setup required.
AI-powered Accounts Receivable Automation on Salesforce, built to accelerate collections, automate workflows, and improve cash flow.