Fake expense receipts are easier to fake than they used to be
Generative models now produce convincing receipts, logos and vendor details in seconds. That makes simple manual checks less useful than they once were. Fake receipts can mimic fonts, VAT numbers and layout, then add believable totals and line items.
Image quality alone no longer separates real from fake. Attackers strip EXIF data, re-save images or alter metadata to remove obvious traces. Some also reuse genuine supplier templates. Manual review catches some of this, but it is slow and inconsistent. Anything that relies on surface cues alone will miss better forgeries.
Verification needs layers. I mean several independent signals, not one classifier doing all the work. Metadata analysis, invoice fraud rules, file integrity monitoring and bank-record matching all help. Let the low-risk checks run automatically and send the awkward cases to a person.
Metadata analysis
Start with what the file gives you. Extract EXIF, timestamps, creation software and file hashes. Compare the image creation time with the expense date on the receipt. Look for obvious mismatches, such as a receipt dated 2025 with an image creation timestamp in 2018. Check the camera or software maker field too. Some generators leave software identifiers or export tool names behind. Empty or stripped metadata is suspicious, but not proof on its own.
- Capture the file hash, such as SHA-256, at intake and store it with the claim.
- Record the original filename and upload route.
- Extract EXIF and XMP fields for device and creation timestamps.
- Check PDF metadata for producer tools and font embedding.
Give metadata checks a score and flag mid-range results for review. Metadata can be removed, so treat it as one signal among several.
AI detection systems
Add a model that inspects image artefacts, text layout and micro-patterns. Use models trained on genuine receipts and known fake samples. Train on local data where you can, because vendors tend to repeat invoice styles.
- Run detection as a pre-approval gate. Reject only when several signals agree.
- Keep models versioned and logged. Record the model ID, confidence and input hash for audits.
- Combine detection scores with business rules. A high-confidence fake on a high-value claim should block payment automatically.
Do not hide the result behind a black box denial. If the model flags a claim, show the reviewer why: metadata mismatch, impossible font mix, inconsistent VAT calculation. That cuts review time and helps with false positives.
Training staff
Automated tools reduce load, but humans still catch context that models miss. Short, hands-on exercises work better than a long policy document nobody reads. Use examples from your own data.
- Confirm vendor contact details and invoice numbers.
- Match supplier addresses to known records.
- Request proof of payment for unusual claims.
- Spot repeated style artefacts across receipts.
Keep the training practical. Show screenshots of fake receipts, then show the checks that would have caught them.
File integrity monitoring
Treat receipts as files that need integrity checks. Record the ingestion hash as soon as the user uploads the receipt. If the same claim is uploaded again with a different hash, flag it.
- Maintain an append-only log of uploads and edits.
- Alert on hash changes, filename rewrites or metadata edits after ingest.
- Keep the original upload for 90 days at minimum, longer for high-value claims.
That stops someone swapping the file after the first check and gives you a cleaner trail when the claim is questioned later.
Automating expense controls
Automation cuts down on human error and keeps decisions consistent. Build a decision tree that combines:
- Metadata score.
- AI detection confidence.
- File integrity status.
- Payment history with the vendor.
- Bank record match.
If a claim fails several checks, apply a stronger control: ask for the original paper receipt, proof of bank transfer or a vendor confirmation email. For medium-risk claims, send them to a reviewer with a standard checklist. Log every decision and the evidence used.
One example rule:
- If AI confidence > 90% fake and the file hash changed on re-upload, block payment and ask for the vendor invoice and proof of payment.
- If AI confidence is 60–90% or metadata is missing, send it to a reviewer with two checks: confirm the vendor phone number and ask for a bank statement that matches the payment.
Keep the thresholds adjustable. Watch the false positive and false negative rates, then tune them from real outcomes.
Final takeaways
Keep verification layered and measurable. Use metadata analysis, file integrity monitoring and invoice fraud detection together. Run AI detection models, but never let them make the decision alone. Train reviewers on concrete checks and keep an audit trail of hashes, model versions and reviewer decisions. That makes fake expense receipts harder to cash and easier to catch.
