How to catch duplicate and fraudulent vendor invoices before they are paid

The FBI's Internet Crime Complaint Center recorded 24,768 business email compromise complaints in 2025 with $3,046,598,558 in losses, up from $2,770,151,146 in 2024. Its definition names the target plainly: businesses working with suppliers and regularly paying by wire.

The usual move is a real invoice, or a convincing copy, with new bank details.

The Association for Financial Professionals' 2026 survey, published 14 April 2026, found that 76% of US organizations experienced attempted or actual payments fraud in 2025, and that 74% were affected by business email compromise, which AFP calls a significant increase from 2023 and 2024.

There is no public count of duplicate payments we would quote: the figures that circulate are vendors' estimates. What is known is how they happen, and that a duplicate paid by ACH can be reversed by the sending bank only within five banking days of settlement under Nacha's rules.

The supplier emails the invoice to accounts and the manager uploads the same PDF, or the invoice arrives by email and again from the supplier's portal. Two rows, one debt.

INV-007 and inv 7 are one invoice to a person and two to an exact match. So is a number with and without its leading zeros or its year prefix.

A statement or a second notice carries the same amount and a new date, and gets entered as next month's bill.

Somebody paid by card or by transfer to get the goods released, and the bill stayed open, so it is paid again on its due date.

Two people propose the same payment to the same supplier in the same week, each sure the other did not.

An email from the supplier's address, or one a character away from it, says the bank account has changed. The invoice is real; the account is not. The defence is a rule, not a hunch: details change only after a call to the supplier on a number you already had, never on the number in the email.

A plausible name, a plausible amount, sent to someone who pays what reaches them. The defence is that a bill from a sender nobody knows is marked as such, and that a payment to a new payee needs a second person.

An inflated invoice or a repeat, sometimes from inside. The defence is that the person who proposes a payment is never the one who approves it, and, for goods, a three-way match of the order, the receipt and the invoice.

Entering the same supplier and invoice number twice is refused, whichever way each one arrived: typed in, read from a file, mailed to the space's address or sent from another Orla space. When one PDF holds several invoices, an invoice already in the list is not added twice.

A bill does not ask for bank details and never stores them; paying it reads them from the supplier's contact card. Attaching the supplier's own file to a bill changes nothing about where money goes. A bill from a supplier who is not in your contacts is marked unverified.

Before a supplier's bill is paid, the book looks for one it already has: the same number written differently, the same amount from that supplier inside ninety days under a new number, a close number with a rounded amount, and money already sent to that payee for that sum with no bill behind it, on any rail.

Each match says which of those matched and whether the older one is paid. The verdict is yours, in two presses: this is a duplicate, which declines the new bill and keeps both papers, or this is a different bill. A supplier who bills the same amount every month is not a duplicate; the window is ninety days on purpose.

It is being rolled out, so not every space has it yet.

Where the wider check is on, ask the assistant "is this a duplicate" or "did we already pay this". A check on a duplicate bill is always drawn beside the answer, not summarised away.

A line under a payment says when it does not look like what this book usually does: a payee paid far more than usual, a large first payment to a payee never paid before, or the same amount to the same payee twice within a week, including when two people proposed it. It explains and never blocks.

A payment Orla sends or drafts to a payee you have paid before, on details they were never paid on, is held even with all its signatures until someone confirms the new details, and the person who proposed the payment cannot be the one who confirms unless they are the space's only signer.

If the details change after a payment through a connected bank was signed and before it leaves, it goes back to pending and the signatures given before the change no longer count.

Instead of copying details from an email, send the supplier a link where they type their own. It works once and for seven days, never shows the details you already have, and the first payment to what they send waits for confirmation like any new details.

When the bank charge that paid a bill is in the ledger with the same amount to the cent, the same currency and a payee that looks like the supplier, the bill closes on it by itself, so a bill paid outside Orla is not paid again on its due date.