Real Estate Invoice Fraud and Anomalies: A 2026 Best Practices Guide for Property Accounting Teams

What is real estate invoice fraud?

Real estate invoice fraud is the submission or manipulation of vendor invoices so that a property, fund or management company pays for goods, services or amounts it does not owe. It matters because real estate pays thousands of vendors across hundreds of legal entities, usually from site-level approvals, and the median occupational fraud loss in real estate is $250,000, among the highest of any industry (ACFE, Occupational Fraud 2026). For property accounting teams, the main problem is not fake invoices. It is real invoices that are wrong in ways only context can catch.

Definition: Real estate invoice fraud means any scheme in which a vendor invoice, real or fabricated, is used to extract a payment a property, entity or management company does not owe. In real estate accounts payable it usually takes one of five forms: vendor impersonation with changed payment details, fictitious vendors, manipulated legitimate invoices (quantities, rates, duplicates), internal collusion between an approver and a vendor, and cost misallocation that shifts an expense to tenants or owners.

One caution on that ACFE figure: it is based on a small number of real estate cases and covers all occupational fraud, not invoice fraud specifically.

This guide covers vendor fraud and payables fraud at real estate operating companies: property owners, operators, third-party property managers, fund administrators and the client accounting teams that pay their bills. It does not cover closing-wire fraud at a home sale, tenant application fraud or mortgage fraud. Those are real problems with their own guides. This one is about the invoice.

A fraudulent invoice does not need to defeat your controls. It only needs to look like a typical day to go around them.

Why is real estate a target for invoice fraud?

Real estate is targeted because its approvals happen at sites far from the owners and tenants who absorb a bad invoice, its entities and client structures vary from one property to the next, its payments are large and predictable, its vendor volume is high and recurring, and who owns and services a building is public record. The ACFE finds billing schemes in 21% of occupational fraud cases, running a median of 14 months before detection (ACFE 2026).

The best evidence is occupational-fraud data and prosecuted cases, not headline cybercrime totals. The prosecuted real estate cases below show vendor-payment schemes running eight to ten years inside the control environment. For cross-industry context, the FBI reports business email compromise at $3.05 billion in 2025 losses, up from $2.4 billion in 2021, and AFP surveys have repeatedly identified accounts payable as the business unit most often targeted by business email compromise (FBI IC3 2025 Annual Report; AFP). One caution on the FBI’s numbers: IC3 tracks real estate as its own category (12,368 complaints, $275 million in 2025), but that category measures investment, rental and timeshare fraud, not vendor payables, so it is not evidence of invoice fraud exposure and is not used that way here. Invoice fraud overlaps with wire fraud and payment-instruction fraud, which is why the same controls appear in title-industry guidance from ALTA and in bank guidance; this guide applies them to the vendor side.

The case that proves scale is no protection: between 2013 and 2015, a Lithuanian national registered a company in Latvia under the name of Quanta Computer, a real Taiwanese hardware supplier to both Google and Facebook, opened bank accounts in that name, and emailed both companies forged invoices, contracts and bank letters asking that money owed to Quanta be wired to the new accounts. The Department of Justice puts the combined loss at more than $120 million; the split reported at the time, about $99 million from Facebook and $23 million from Google, comes from press coverage of a Lithuanian court order rather than the DOJ release. He was sentenced to five years in December 2019 and ordered to forfeit $49.7 million (U.S. Department of Justice; FBI). The scheme did not work by evading scrutiny. It worked by mimicking legitimacy. The vendor was real, the relationship was real, the amounts were plausible, and the invoices arrived the way invoices always arrive.

The real estate version happened in 2025. A New York owner-manager wired PILOT (payment-in-lieu-of-taxes) fees for several Manhattan condominiums, about $19 million, to accounts controlled by scammers impersonating the state authority that collects them. One board was told $3.5 million of its dues had gone, and litigation followed (The Real Deal, August 2025; Habitat, October 2025). Same mechanism, on a predictable real estate payment calendar, with the loss landing on tenants and owners rather than the firm that paid.

Five questions that show whether a door is open

Before the taxonomy, here is the bar to hold any portfolio’s payables process to. If any answer is no, one of the doors below is open.

1. When a vendor requests a banking change, does someone call back a number already in your system of record, never one supplied in the email, and does the new account get validated against the bank’s record of who owns it?
2. Do all invoices, for every property and every client, arrive through governed intake channels that you control, rather than a site office inbox?
3. Is the first invoice from every new vendor verified against a contract or purchase order before payment, and the vendor’s bank account validated before the first payment is released?
4. Could the person who edits your vendor master also approve or release a payment? If yes, segregation of duties exists on paper but not in operation.
5. Could you compare one vendor’s billing across your whole portfolio this afternoon? If not, an anomaly at one property is invisible.

What is the difference between external and internal invoice fraud?

External and internal describe who is behind the invoice, not what they do to it. External invoice fraud comes from someone outside the organization: an impersonator of a vendor you have, or a vendor you have never used. Internal invoice fraud involves an employee, an on-site manager or a real vendor colluding with one of them. The mechanisms overlap.

Both can involve fictitious vendors, changed bank details, fabricated invoices or manipulated legitimate ones; the prosecuted real estate cases below include an insider running friends-and-family vendors on fictitious invoices, which is a fake vendor with an inside sponsor. The difference that matters for control design is where the fraudster sits relative to your approvals. The AFP found 74% of organizations experienced business email compromise in 2025, the external kind (AFP 2026 Payments Fraud and Control Survey). The ACFE found billing schemes, usually the internal kind, in 21% of occupational fraud cases, with a median of 14 months before anyone caught them (ACFE 2026).

Five mechanisms cut across both columns: vendor impersonation, fabricated invoices, manipulated legitimate invoices, internal collusion, and plain erroneous coding that nobody intended. The sections below are organized by perpetrator because that is how the controls divide; the mechanisms appear on both sides.

What does external invoice fraud look like in real estate?

External invoice fraud in real estate almost always arrives with social engineering attached: a sense of rush, or borrowed authority from an institution too big to call. The FBI’s red flags for business email compromise are email-only communication, a refusal to speak by phone or video, and a request to change payment procedures (FBI). The more sophisticated groups have moved past email: voice-cloned callbacks and deepfake video calls are now used to “confirm” a fraudulent change, which is why verification must go out to a number already on file rather than accept any inbound confirmation (J.P. Morgan, Combating Vishing Schemes). Financial loss from these schemes concentrates in a handful of payment requests, so the controls concentrate there too. Each item below carries one red flag and one control.

Spoofed vendor email with new payment details

A criminal impersonates a vendor you pay, often from the vendor’s own compromised email accounts, and asks accounts payable to update bank account information. One successful change redirects every payment that follows until someone notices. In the FBI’s 2025 data, wire transfers and ACH are the dominant transaction types reported in business email compromise complaints (FBI IC3 2025). Red flag: a bank or remit-to change arriving by email, inside an existing thread, with a plausible reason such as a merger or a new bank. Control: no change to payment data by email alone; callback to a number already on file; a second approver; the first payment after any change held or capped.

Hijacked email threads

The attacker plants a forwarding rule on a real vendor’s mailbox, studies the invoice cadence for weeks, and times the request to a large pending payment or a holiday weekend. Red flag: a reply-all thread in which one participant’s domain differs by a character, or a sender’s email address that does not match the signature. Control: train approvers to check the sender domain on every payment-related reply; take anything with bank data out of email and into a vendor portal.

Modified documents

A PDF whose remit-to block, account number or total differs from the vendor master or from the last twelve invoices. Generative AI now produces convincing forged documents, an invoice, a letterhead or a bank letter, in seconds, usually with a demand for immediate payment attached. Red flag: file metadata showing a recent edit; a remit-to that matches no prior invoice. Control: match remit-to and bank fields against the vendor master automatically, and treat any mismatch as a change request, not an invoice.

Fake invoices from a municipality, authority or utility

A property or development has known obligations: permits, assessments, PILOT fees, utility accounts, taxes. Fraudsters send invoices for them with new remittance details, and at a large institution there is no account manager to call back. The Manhattan PILOT case above is this pattern; law firms have issued client alerts on fraudulent municipal invoices sent to real estate development projects. Red flag: a fee, permit, assessment or tax invoice that arrives by email or mail with payment instructions you have not used before. Control: pay public bodies and institutional vendors only through their own portals or the account already on file, never from an instruction received.

Invoices for sold or vacant properties

A vendor keeps billing a property after disposition, or bills services (lawn, pool, cleaning, pest) at a vacant unit. Nobody on site is left to say the work did not happen. The complication is that a sold property keeps generating legitimate invoices for a while: final utility periods, property tax installments, contract closeouts, legal fees, prorations and operating-expense true-ups, and a vacant unit can generate more work, not less, when it is being turned or secured. So the control is an exception path, not a wall. Red flag: any invoice coded to an entity with a disposition date, or recurring services at a unit flagged vacant. Control: property and entity status (owned, under contract, sold, vacant) lives in the property or entity record, which is the system of record for it, not in the vendor master. A disposition date routes new invoices for that entity to an exception queue owned by the asset manager or controller, with a written disposition policy that names the closing date, the final service periods each vendor is paid through, which trailing obligations the seller retains, and who may approve a post-sale invoice. A vacancy flag triggers review of recurring services rather than blocking them.

Ghost vendors and fictitious vendors with no insider

A shell, the classic ghost vendor, sends small invoices for plausible property services, waste hauling, filters, inspections, snow, a few hundred to a few thousand dollars, sized to sit under approval thresholds built for efficiency. Red flag: a first-time vendor with an immediate invoice, round amounts, a P.O. box, no W-9 or TIN match, a generic service description. Control: vendor onboarding with TIN match and insurance on file, and an owner or manager who can name the work before the first invoice is paid.

What do internal fraud schemes look like in real estate? Employee fraud and vendor collusion

Internal invoice fraud usually involves a real vendor and a real approver, and sometimes a vendor the insider created or sponsors. The on-site version: a landscaper at one property is approved for ten mowings in a month that had four, because the site manager approves, the site manager knows the vendor, and nobody above the site sees the frequency. The ACFE reports that more than half of occupational fraud cases involved a lack of internal controls or an override of existing ones, and that cases caught within six months had a median loss of $40,000 while those running more than five years exceeded $1.1 million (ACFE 2026). The ACFE classifies these as asset misappropriation, the most common category of occupational fraud, and the long-running ones are usually hidden with altered bank statements or forged supporting documentation. Two prosecuted real estate cases show the long tail: an internal-audit director at a commercial real estate firm who took $2.7 million over ten years through friends-and-family vendors billing for consulting that never happened, and an accounting director at a property management company who took about $931,000 over eight years by reactivating dormant client accounts and masking payments to herself as vendor payments sized to match other vendors (U.S. Department of Justice, Central District of California).

Several of the patterns below are more often honest errors than schemes. They are here for two reasons: the same comparison catches both, and each one is also how a deliberate scheme hides.

Changed quantities

Recurring service billed more times than the calendar allows: ten mowings in a month, weekly snow removal in August, hours that exceed the contract. Red flag: a recurring vendor whose monthly count moves. Control: compare quantities to the service contract and the calendar, and review any count change above the site.

A worked example [illustrative]: a maintenance contractor holds a $180-per-visit agreement for four monthly visits at a 120-unit garden property, so the expected charge is $720. The October invoice shows six visits, $1,080, approved on site the same day. The anomaly flag reads “visit count above contract and above the vendor’s twelve-month range.” The property accountant pulls the contract, the work-order log and the last twelve invoices: four visits every month until October, no change order on file, two visit dates that fall on a Sunday when the property is closed to vendors. The hold goes to the regional manager, who asks the vendor to walk through the six dates with a contact already on file. If the vendor produces a work order for an emergency call-out, the invoice is released with the documentation attached and the contract gets an emergency-rate line. If not, the two visits are credited, the approver’s recent approvals for this vendor are sampled, and the vendor’s billing at the manager’s other properties is compared for the same pattern. Either way the disposition is recorded against the flag.

Changed amounts and service-contract rate creep

A unit rate that rises faster than the contract escalator or CPI, or a fuel surcharge or materials line that appears mid-term. Red flag: an invoice whose unit rate exceeds the stored contract rate. Control: store the contract rate per vendor and property, flag any invoice above it, and run an annual contract-versus-paid review per vendor.

Duplicates across entities and properties

The same vendor, amount and period, billed to two entities or two property codes, or an invoice number that differs by a suffix. Exact-match duplicate checks inside one entity never see it. The City of Richmond’s auditor ran targeted continuous monitoring over 204 risk-selected invoices and found 50 duplicate payments totaling about $5.76 million. About 98% of that had already been recovered by the time of the review; roughly $152,000 was newly identified and still outstanding, and one duplicate alone was $5.09 million (City of Richmond, Office of the City Auditor, Continuous Monitoring: Duplicate Payments, May 2026). The selection was risk-based, not random, so it says nothing about the population error rate. What it shows is that a $5 million duplicate cleared every preventive control and was caught after payment. Red flag: matching vendor, amount and service period across any two entities in the portfolio. Control: duplicate detection across the whole portfolio, not per entity, with fuzzy matching on vendor, amount and period rather than exact invoice number.

Invoices split under site-level approval limits

Several invoices from one vendor, days apart, each just under the site threshold, for what reads as one job. Red flag: a cluster of invoices from a single vendor and property inside a rolling 30 days that together would have exceeded the threshold. Control: aggregate by vendor and property over 30 days and route the aggregate to the higher approver.

The evergreen purchase order

A purchase order is supposed to be a one-to-one authorization: this vendor, this work, this amount. In practice a site or regional manager gets a $10,000 PO approved, hands the number to several vendors for smaller jobs, and asks for it to be refreshed when it runs down. The PO becomes a discretionary bucket, every invoice that quotes it “matches,” and the match control that was supposed to be preventive now authorizes whatever the manager wants paid. This is how PO matching fails without anyone forging anything, and it is why a matched invoice still needs a separate approver. Red flag: a PO referenced by more than one vendor; a PO replenished more than once in a year; invoices against a PO whose line description does not match the work billed; a PO whose remaining balance never reaches zero. Control: one PO per vendor and scope with a defined close date; a replenishment requires a new PO approved above the site; blanket POs allowed only for named recurring contracts with a stored rate and frequency; and PO-to-vendor and PO-replenishment reports reviewed by the controller.

Tenant-specific work dropped into the CAM pool

A tenant build-out, after-hours HVAC or a single-suite repair coded to common area maintenance, so every other tenant pays a share. This is misallocation first and fraud only sometimes, but tenant auditors find it routinely; the after-hours HVAC paid by one tenant and never deducted from CAM is a textbook finding, and a pattern of it at one property with one approver deserves the same scrutiny as any other scheme. Industry reviews put material errors in roughly 40% of CAM reconciliations, and professional tenant audits recover 15 to 20% of billed charges (PredictAP, February 2026, aggregating Tango Analytics and National Lease Advisors). Red flag: work described as inside a premises with no suite or tenant reference. Control: coding rules that require a suite or tenant reference for any work inside a premises, and a CAM-pool review before reconciliation.

Utility charges that do not fit the meter or the season

Consumption that does not track the meter, the weather or occupancy; two bills for one period after a meter change or an ownership transfer. Red flag: a utility invoice outside the account’s historical and seasonal range. Control: baseline every utility account against its own history and the season, investigate outliers before payment, and close accounts on disposition.

Kickbacks and inflated bids

One vendor wins every job at one property; bids cluster just under the competitive-bid threshold; invoices arrive for work not performed or at inflated prices. In one Connecticut apartment complex, plumbing and other vendors submitted invoices for inflated or non-performed work from 2022 to 2024 with insider help; two defendants pleaded guilty in September 2026 and one agreed to $2.5 million in restitution (IRS Criminal Investigation). Red flag: vendor concentration by property and by approver. Control: vendor-concentration reporting by property and by approver, a competitive-bid policy with documented exceptions for the contracts that cannot rotate (elevator maintenance, utilities, specialist service agreements), and a periodic review of who approved the exceptions.

What is the difference between an invoice anomaly and invoice fraud?

An invoice anomaly is any invoice that does not fit the pattern expected for that vendor, property and period: a rate above contract, a second charge for the same service, a bill for a property that was sold. Fraud is defined by intent and authorization, not by statistical deviation: someone knowingly obtained a payment that was not owed. The two overlap less than people assume. Most anomalies are errors, not fraud, but they cost the same money, and in real estate they also flow through to tenants via CAM and to owners via reporting. And some fraud produces no anomaly at all. A fraudulent invoice can match the vendor’s history perfectly, which is exactly how it gets paid; that is the point of the Quanta case above.

So anomaly detection finds exceptions that warrant review. It does not find all fraud, and it does not prove any. The fraud that looks normal is the job of the other controls: independent verification of payment instructions, vendor onboarding, and segregation of duties. The distinction matters for how you respond. An error gets a phone call and a credit memo. Fraud gets a hold, an investigation, and a call to your bank. The detection method is the same for both, which is the point: a control that only looks for criminals misses the larger dollar pool. The Richmond duplicate-payment review found no fraud at all. It found $5.76 million in duplicates, most of it already clawed back, and a $5 million payment that preventive controls had waved through.

Fraud does not announce itself. It looks like Tuesday. The teams that catch it are the ones equipped to see when Tuesday looks wrong, and the ones whose verification controls do not depend on Tuesday looking wrong.

How does anomaly detection work for real estate invoices?

Anomaly detection compares each incoming invoice against three baselines: the vendor’s own history (amount, frequency, line items), the contract and property it is billed to (rate, scope, status, season, square footage, unit count) and the rest of the portfolio (the same invoice under another entity, the same vendor at another site). Generic accounts payable tools check the first baseline. Real estate needs all three, because an invoice can match a vendor’s history perfectly and still be wrong for this building.

Whether the comparison is done in a spreadsheet or by machine learning models trained on historical data, two things about the flags hold. They are descriptive, not conclusive: “above the usual range,” “matches an invoice already in the system,” never “duplicate” or “overbilled.” A pattern-based flag is a prompt to look, not a finding. And they go to a person. Detection at portfolio scale depends on transaction history consistent enough to compare across properties, which is the part manual processes struggle to maintain; where the history is kept consistently, these anomalies become findable, and where every property keeps it differently, they hide.

How do you prevent invoice fraud with layered controls?

Layered controls mean an invoice must pass several independent checks before payment: the person who onboards a vendor cannot approve its invoices, the person who approves cannot release payment, and the system compares every invoice against the contract, the property’s status and the rest of the portfolio. Each layer is weak alone. Together they catch both the outsider changing where money goes and the insider changing how much. No single control stops both, so a portfolio runs belt and suspenders: preventive layers that stop the known patterns, and detective layers that catch what slipped through. The ACFE’s data associates two detective controls with roughly half the median loss where they are present: management review (55% lower) and proactive data monitoring (53% lower); surprise audits and job rotation or mandatory vacations show a similar association. These are associations across reported cases, not measured reductions from adding a control (ACFE 2026). The AFP found treasury, not accounts payable, discovers actual fraud at 55% of organizations, which says the catch usually happens at a layer other than the one that approved (AFP 2026).

The five questions earlier are the diagnostic. The layers below are the implementation.

Layer 1: Segregation of duties

No single person or system can initiate, approve, pay and record the same transaction. The GAO’s Standards for Internal Control (the Green Book, 2025 revision, Principle 10) and COSO’s 2013 framework both treat segregation as a core control-activity design, and the Center for Audit Quality’s guide to internal control over financial reporting uses “separating approval and payment” as its worked example. Real segregation is operational, not a matter of titles on an org chart. In both prosecuted cases above, the fraudster sat inside the control environment itself.

Small sites often have one person doing three of these. The control is then a compensating one: portfolio-level monitoring plus a second approver above a low threshold. Say so rather than pretend every site can staff full segregation.

Third-party managers paying client funds carry a second layer of this. The manager’s own operating controls (who onboards vendors, who approves, who releases) sit alongside each client’s delegated authority: which client bank accounts the manager may pay from, which vendor masters it maintains for that client, what approval limits the management agreement grants, and what the owner reserves. Write the delegated authority down per client, and keep client vendor masters and bank accounts separate so that a change verified for one client does not propagate to another.

Layer 2: Vendor data

Verify every change to vendor banking, remit-to or payment method two ways before anything is updated: an outbound callback to a number already in your records, and an electronic account validation in which you send the routing and account number to your bank or a validation service and it returns whether the account is open and who the registered owner is, so that the owner name can be compared to the vendor on file. Nacha’s Phixius network and the Afinis Account Validation Plus Name API standard exist for exactly this, and most commercial banks offer it through their treasury portals or an API (Nacha, 2022; Afinis). A callback can be social-engineered; an ownership mismatch cannot be talked away. Some mismatches are legitimate, a vendor paid through a factoring company or a lockbox, or a trade name that differs from the W-9 legal name; treat those as exceptions that need a documented explanation and a second approver, not as a reason to lower the bar. The same two checks apply to every new vendor before the first payment; the same applies to owner distribution instructions, since property owners’ money moves through the same banking information, and to any change in who holds payment authority for an entity. Dual approval on vendor creation and on remittance and distribution changes. Screen new vendor bank details against employee records; it is the classic internal tell. Property and entity status (owned, under contract, sold, vacant) lives in the property or entity record and gates what can be paid, as described above.

Layer 3: Intake and workflow

Governed intake across every property, client and system, so a fake cannot route around review by targeting a site office. A third-party manager may run several client ERP environments (Yardi Voyager with PayScan, MRI, RealPage, Entrata, Bottomline NexusPayables); the control is not one centralized system but a defined channel per client that site offices cannot bypass, with everything that arrives elsewhere forwarded into it. First invoices from new vendors verified against a contract or PO. Approval routing by amount, entity and property, with thresholds that aggregate by vendor over 30 days so splitting does not work. Contract rates and frequencies stored per vendor and property so the system can compare, not just route. An immutable audit trail of who entered, coded, approved, changed, released, and when.

Layer 4: Portfolio-level detection

Duplicates across entities, rate creep, quantity drift, threshold clustering, utility outliers and vendor concentration are invisible from inside one property’s approval queue. They are only visible when each invoice is compared against the three baselines, which is how a portfolio can identify suspicious patterns and detect fraud that no single approver can see. Automated detection belongs here as one of the belts, not the whole outfit; it works only on consistent, comparable history. The Green Book’s 2025 revision explicitly prioritizes preventive over detective controls, which is the case for running the comparison at intake rather than in a quarterly audit. Nacha’s 2026 risk management rules add a regulatory floor on the payment side: non-consumer ACH originators, including a property company paying vendors by ACH, must have a documented, annually reviewed, risk-based process for identifying ACH entries initiated due to fraud, phased in through 2026 with the second phase effective June 22, 2026 (Nacha; Venable). That rule concerns monitoring ACH entries for fraud, not invoice-level anomaly detection; it is a floor for the payment layer, not a substitute for the three baselines.

Budget variance review belongs in this layer too, because it is the detective control real estate already runs. An inflated service contract, a duplicate paid under a second entity, or a vendor billing a sold property shows up as a line-item variance against the approved operating budget at month end, and a controller who asks about a 20% overrun in landscaping is running portfolio-level detection whether or not it is called that. The weakness is timing: variance review finds the problem after the money has moved, and it misses schemes sized to stay inside the budget, which is why it is one of the belts and the three baselines at intake are another.

Layer 5: Payment release and people

Match the bank controls to the payment type. Positive pay (and payee positive pay) for checks, so the bank rejects a check whose number, amount or payee does not match your issue file. ACH debit blocks and filters so no vendor or impostor can pull from an operating or trust account without an authorization on file. Dual authorization and callback on wire release and on ACH credit origination above a threshold, since those are the two rails BEC uses. Train site and regional approvers on the handful of payment scenarios that actually arrive in real estate: a vendor’s “new bank” email mid-thread, a PILOT or tax invoice with new remittance instructions, a lien or disconnection threat demanding same-day payment, an invoice for a property that closed last month, a contractor asking the site to pay a deposit by a different method. A reporting mechanism for suspected fraud and suspicious activity: organizations with one had a median loss of $100,000 against $150,000 without, and caught schemes six months sooner (ACFE 2026). J.P. Morgan’s framing for all of this is the right one: layered controls and verification discipline.

Who should approve an invoice, and should an AI agent ever approve alone?

Our recommendation is that an AI agent should prepare, compare and route invoices, and a person with independent authority should approve and release payments, with segregation of duties between review and approval, and between both of those and vendor maintenance. That is a control-design position, not a regulatory requirement, and it is worth being clear about which is which. There is a tension between speed and safety with payments.

What the standards permit. Segregation of duties is a core control activity under COSO’s framework and the GAO Green Book because an approver who also controls vendor data or payment release can both commit and conceal a loss. Fixed-rule automation inside that framework is accepted. A three-way match within a budget line, a duplicate-invoice block, threshold-based routing: these are automated application controls, and PCAOB Auditing Standard 2201 lets an auditor rely on them without a person reviewing each transaction, and even carry prior-year testing forward under a benchmarking strategy, provided the program is stable and IT general controls over program changes and access are effective (AS 2201, Appendix B, paragraphs B28 to B33). The condition is the whole point. The rule is fixed, testable, and nobody can change it without a logged, approved change. Nothing in AS 2201 prohibits an automated approval; nothing in it contemplates a probabilistic model either.

What professional guidance recommends. The PCAOB has not issued a standard on AI approvals. Its staff Spotlight on generative AI (July 2024) reports what audit firms told staff during outreach, including the view that human involvement remains essential for reviewing generative-AI output, and the Spotlight says itself that it is not a Board rule or policy. The May 2025 Spotlight similarly records audit committee chairs’ views that technology does not replace human oversight of the audit. COSO’s Achieving Effective Internal Control Over Generative AI (February 2026) is guidance, not a new control framework; it recommends a use-case-based, risk-based approach to human oversight, with evidence that the oversight occurred, and Deloitte’s and KPMG’s summaries both read it that way (Deloitte Heads Up; KPMG Defining Issues, April 2026). RSM’s practical reading is the useful one: if you cannot produce a log showing the human review actually happened, you will struggle to show the control exists (RSM, April 2026). None of this authorizes or prohibits an autonomous approver. It points in a direction.

What we recommend, and why. An agent that codes an invoice, checks it against policy and then approves it has collapsed three duties into one, and the auditor question that follows is how you evidence an independent review that did not occur. There is also a fraud reason, separate from the audit reason. Gaming the agent is committing fraud not by breaking an AI system but by learning how it decides and staying inside its rules: stay under the cap, look like the vendor’s usual invoice, inherit the trust the agent learned from a year of approvals. One agent reviewing another, in the same environment under the same admin rights, is two checks, not two independent controls. We make the long-form argument in The New Fraud Risk: Gaming the Agent, and Google DeepMind’s AI Control Roadmap treats internally deployed agents the way security treats insider threats. A July 2026 case in which a hidden comment hijacked a code-review agent shows the mechanism is not theoretical (Eftsure, July 2026).

The trade-off is real. An agent approving routine invoices alone is faster and cheaper. The temptation is to let it approve the small, matched ones: a recurring $400 inspection from a known vendor against an open purchase order. We would not, and the evergreen purchase order above is the reason: a PO match is only as strong as the PO, and a PO that has become a discretionary bucket matches everything. The control is a single person approving, not a single system; for the $400 inspection that person is a site or regional manager, and the agent’s job is to have done the comparison before they look. What you accept at scale with an autonomous approver is loss events that look clean in the system until reconciliation, questions from your auditor about how the approval control was evidenced, and nobody to hold responsible when the agent approves a fraudulent invoice, a liability question the industry has not settled.

How should a change to bank details or payment requests be handled?

The control objectives come first, because small teams will not be able to run the full procedure every time: the change is verified independently of the channel it arrived on; the person who authorizes the master-data change is not the person who received or verified the request; access to edit vendor banking is restricted; and the evidence of who verified what, with whom, is kept. Any request to change bank details, remit-to address or payment method is logged as a change request, regardless of channel, and nobody acts on the request itself. The verification goes out, not in.

The preferred process:

1. Log the request as a change request, whether it arrived by email, portal, phone or letter.
2. A second person, not the one who received it, calls a phone number already on file from the original onboarding, never one in the request, the invoice or the email signature (Nacha, Business Email Compromise Action Plan). An inbound call from the vendor does not count; the callback must be outbound (J.P. Morgan, When Callbacks Go Wrong).
3. The verifier confirms the reason for the change with a known contact and, where that contact has access to it, a detail the impostor would not know, such as the last four digits of the old account or the last invoice number paid. Record who they spoke to.
4. The new routing and account number are run through your bank’s account validation service, and the returned owner name is compared to the vendor’s legal name on the W-9. A mismatch stops the change regardless of what the callback produced.
5. A third person approves the master-data change; the requester and verifier cannot.
6. Based on risk (vendor size, payment size, how the request arrived), the first payment after a change is held for a cooling-off period or capped, and the vendor is told to expect it.
7. For institutional payees with no reachable contact (a utility, a tax authority, a payroll or insurance provider), changes are made only inside that payee’s own portal, never from an instruction received.

Compensating controls for a two-person accounting team: the receiver logs and the second person both verifies and approves, with the controller or owner notified of every banking change and sampling them monthly; vendor banking edit rights limited to that second person; account validation run on every change without exception, since it is the one step that does not need a third set of hands; and a lower cap on the first post-change payment. The U.S. Department of Commerce’s inspector general put the objective in one sentence in July 2026: independently verify every request to change banking or payment information by contacting a known contact through a previously established method.

What should you do when an invoice is flagged?

There are two different situations, and they need different sequences. A flagged invoice that has not been paid is an exception to triage. A payment that has already left, or a change that has already been made to where payments go, is a possible theft in progress, and the bank comes before the vendor.

Path A: the invoice is unpaid.

1. Triage: which baseline tripped, and is there a documented reason (a contract amendment, a one-time project)? If it is a recognized exception, document and release.
2. Hold: stop the payment in the workflow, not by email to treasury.
3. Contact the vendor through a number or portal already on file and ask them to walk you through the invoice, without accusing anyone; most flags resolve as errors.
4. Escalate anything unexplained to the controller, preserve the emails, invoices and logs, treat the vendor record as suspect until verified, and bring in legal counsel before any external statement.
5. Close the loop: record whether the flag was a true catch or a false alarm so the next one is better calibrated.

Path B: money has moved, or payment instructions were changed on a request that now looks suspect.

1. Call your financial institution first and ask for a recall or hold on the payment; the FBI’s guidance is to contact the bank immediately, then file with IC3, because recovery depends on speed. Of the attempted-theft dollars routed through the FBI’s Financial Fraud Kill Chain in 2025, 58% were frozen (FBI IC3 2025).
2. Escalate to treasury and the controller at the same time, and freeze further payments to the affected vendor record and any record sharing its bank details.
3. Preserve evidence: the emails with full headers, the invoice files, the change request, the workflow and bank logs. Do not forward the originals around.
4. Do not contact the vendor, or the employee who handled the request, until the controller and counsel have decided whether either may be involved. A vendor whose mailbox is compromised needs to be told, through a known contact, once the payment is contained; a colluding vendor or employee does not get a warning.
5. Report fraud to the FBI’s IC3 the same day, notify your cyber-insurance carrier if you have one, and cooperate with law enforcement authorities.
6. Re-verify the vendor’s banking from scratch before any further payment, and review every change to that record in the prior twelve months.

Decision path, so it is written down before it is needed: the AP specialist holds the invoice and escalates; the controller decides whether it is Path A or Path B and owns the investigation; treasury contacts the bank; nobody below the controller contacts a vendor on Path B; counsel clears any external statement; and the controller releases, with the disposition recorded against the flag.

Frequently asked questions

What are the most common invoice fraud schemes in property management?

Five recur across prosecuted cases, audits and payments-fraud surveys: business email compromise that changes a vendor’s bank account information; ghost vendors billing for services never performed; the same invoice submitted more than once under different entities; a real vendor’s rates or quantities inflated with an insider’s approval; and tenant-specific costs pushed into the CAM pool. Property managers see the first three from outside and the last two from inside. Which one costs a given portfolio the most depends on its controls, not on an industry ranking.

How can property managers prevent invoice fraud?

Verify independently every change to payment details using a number already on file, route all invoices through governed intake channels, hold the first invoice from any new vendor until a contract or purchase order confirms it, and keep vendor master edits away from anyone who approves or releases payments. Treat any demand for immediate payment as suspicious activity until a known contact confirms it. Those four controls prevent fraud at the point of entry; portfolio-level comparison catches what slips past them.

How can I detect invoice fraud?

Compare every invoice against three baselines before payment: the vendor’s own history, the contract and property it is billed to, and the rest of the portfolio. Fraud and error both tend to show up as deviations: a rate above contract, a frequency the calendar cannot support, a second invoice for the same service under another entity, a bill for a sold property. Some fraud shows no deviation at all, so pair that comparison with callback verification on every banking change and real segregation of duties.

How do I check if an invoice is real or fake?

Start with the vendor master, not the invoice. Does the remit-to and bank account match what is on file? Is there a contract or purchase order? Can an on-site person name the work? Then check the invoice itself: sender domain, invoice number sequence, round amounts, a first invoice from a new vendor, a P.O. box address. A genuine invoice should pass every one of those checks. Treat any failure as a hold until it is explained; the number of failures is not a score.

How do you handle duplicate invoices?

Detect them across the whole portfolio, not one entity at a time, using vendor, amount and service period rather than exact invoice number. When one is found, hold the second payment, contact the vendor through a known channel, and record whether it was a resubmission, an error or something else. If a duplicate was already paid, request a credit memo and reconcile it; the sooner it is found, the more likely it comes back.

Is double invoicing illegal?

Submitting the same invoice twice is not automatically a crime; vendors resend invoices in error all the time. It becomes fraud when it is done knowingly to obtain a second payment, and most prosecuted billing schemes include exactly that. Treat every duplicate as an error first and a fraud indicator second, and keep the record either way.

What happens when duplicate payments occur?

The money leaves twice. Whether it comes back depends on how soon someone looks and whether the vendor is still there to refund it. In the City of Richmond’s 2026 review, about 98% of $5.76 million in duplicates had already been recovered, but one $5.09 million duplicate had to be clawed back after payment and about $152,000 was still outstanding. In real estate the second payment also flows into CAM pools and owner reporting, so the error is passed along before it is found.

What steps can I take if I suspect a vendor is overcharging?

Pull the contract and the last twelve invoices and compare unit rates, quantities and frequency to what was agreed. Ask the vendor to walk you through the specific lines, using a contact already on file. If the explanation does not hold, hold further payments, escalate to the controller, and check whether the same vendor behaves the same way at your other properties.

What are the common types of fraud in accounts payable?

From outside: vendor impersonation with changed remittance instructions, fictitious vendors, modified documents, fake invoices from institutions. From inside: inflated quantities or rates, duplicates across entities, invoices split under approval limits, tenant-specific costs pushed into shared pools, kickbacks and rigged bids, and fictitious vendors with an inside sponsor. The ACFE found billing schemes in 21% of occupational fraud cases with a median loss of $90,000.

What is invoice manipulation fraud?

Altering a legitimate invoice after the fact: changing the remit-to or bank account, the total, the quantity, or the entity it is coded to. Externally it is how business email compromise turns a real vendor relationship into a payment to a criminal; internally it is how a real vendor’s invoice becomes slightly wrong in the approver’s favor.

Who usually commits fraud for property?

Externally, organized groups running business email compromise at scale. Internally, the ACFE’s 2026 study found employees and managers each responsible for 41% of cases and owners or executives 16%, with tenure over ten years producing the highest median losses. In real estate the opportunity concentrates wherever one person can approve in volume without the contract or the rest of the portfolio in view, which is why the controls above focus on site-level approval authority.

How quickly does invoice or wire fraud need to be reported?

Immediately. Contact your bank for a recall first, then file with the FBI’s IC3 as soon as fraud is suspected. Of the attempted-theft dollars routed through the FBI’s Financial Fraud Kill Chain in 2025, 58% were frozen.

How this was verified, and where the author is biased

The statistics and cases above come from the sources listed below: the FBI’s 2025 Internet Crime Report, the AFP’s 2026 Payments Fraud and Control Survey, the ACFE’s Occupational Fraud 2026, the GAO Green Book, COSO, the PCAOB, Nacha, the City of Richmond auditor’s report, and Department of Justice and IRS Criminal Investigation releases for every prosecuted case. Where a figure is quoted from a secondary summary rather than the original study, the text says so. Several of these reports are updated annually; each citation carries the report year, and the IC3, AFP and ACFE figures should be re-checked against the current edition before reuse. No case here involves a current PredictAP customer, and no real estate company is named. The three-baseline framing, the five questions and the disposition and escalation procedures are a practitioner framework, not an audit standard, and nothing here is legal or audit advice.

On bias: I founded and run a company that sells software to real estate accounts payable teams, so I have a commercial interest in this category. That is why this guide says what it says and no more: the preventive controls above need nothing from any vendor, and detection is one layer among several.

David Stifter is Founder and CEO of PredictAP, the AI invoice coding platform that 130+ real estate firms use to process 7 million invoices a year. Before founding PredictAP in 2020, he spent nearly two decades at Colony Capital (now DigitalBridge), where as Managing Director and functional CTO he ran Yardi and finance technology across a $60 billion-plus platform, 12,000 entities, and 500,000 invoices a year. Accountant by background, geek at heart.

See how PredictAP Invoice Integrity holds suspicious invoices before approval  

Sources

• FBI Internet Crime Complaint Center, 2025 Annual Report: https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
• FBI, Business Email Compromise: https://www.fbi.gov/scams-and-safety/common-scams-and-crimes/business-e-mail-compromise
• FBI, Leader of Fraud Ring Sentenced (Google/Facebook case), January 2020: https://www.fbi.gov/news/stories/ringleader-of-business-email-compromise-scheme-sentenced-012820
• U.S. Department of Justice, SDNY, Lithuanian man sentenced to 5 years (December 2019): https://www.justice.gov/usao-sdny/pr/lithuanian-man-sentenced-5-years-prison-theft-over-120-million-fraudulent-business
• U.S. Department of Justice, CDCA, former auditor of a commercial real estate firm sentenced: https://www.justice.gov/usao-cdca/pr/former-auditor-newport-beach-commercial-real-estate-agency-sentenced-nearly-3-years
• U.S. Department of Justice, CDCA, former accounting director of a property management company sentenced: https://www.justice.gov/usao-cdca/pr/former-accounting-director-corona-company-sentenced-nearly-5-years-federal-prison
• IRS Criminal Investigation, Connecticut apartment complex embezzlement conspiracy (September 2026): https://www.irs.gov/compliance/criminal-investigation/two-men-admit-roles-in-success-village-apartments-embezzlement-conspiracy
• The Real Deal, Luxury NYC landlord hit by $19M cyber scam (August 2025): https://therealdeal.com/new-york/2025/08/06/luxury-nyc-landlord-hit-by-19m-cyber-scam
• Habitat, Cyberfraud scam results in $18 million loss for Battery Park City condos (October 2025): https://www.habitatmag.com/layout/set/amphtml/Publication-Content/Legal-Financial/2025/October-2025/condo-cyberfraud-18m-loss
• AFP, 2026 Payments Fraud and Control Survey Report, press release (April 14, 2026): https://www.financialprofessionals.org/about/learn-more/press-releases/Details/over-75-percent-of-us-firms-experienced-payments-fraud-in-2025-while-ai-adoption-for-fraud-mitigation-lags
• ACFE, Occupational Fraud 2026: A Report to the Nations: https://www.acfe.com/about-the-acfe/newsroom-for-media/press-releases/press-release-detail?s=occupational-fraud-2026-a-report-to-the-nations-pr
• GAO, Standards for Internal Control in the Federal Government, 2025 revision (GAO-25-107721): https://www.gao.gov/assets/880/872514.pdf
• Center for Audit Quality, Guide to Internal Control over Financial Reporting: https://thecaq.wpenginepowered.com/wp-content/uploads/2019/05/caq_guide_internal_control_over_financial_reporting_2019-05.pdf
• PCAOB, AS 2201: https://pcaobus.org/oversight/standards/auditing-standards/details/AS2201
• PCAOB staff, Spotlight on generative AI in audits and financial reporting (July 2024): https://pcaobus.org/documents/generative-ai-spotlight.pdf
• PCAOB, Spotlight: 2024 Conversations with Audit Committee Chairs (May 2025): https://assets.pcaobus.org/pcaob-dev/docs/default-source/documents/2024-conversations-with-audit-committee-chairs-spotlight.pdf
• Deloitte Heads Up, COSO Releases Publication on Internal Controls Related to Generative AI (April 3, 2026): https://dart.deloitte.com/USDART/home/publications/deloitte/heads-up/2026/coso-internal-controls-generative-ai
• KPMG Defining Issues, COSO releases roadmap on internal control over generative AI (April 2026): https://kpmg.com/us/en/frv/reference-library/2026/coso-releases-roadmap-internal-control-over-generative-ai.html
• RSM, COSO aligns AI governance with internal control guidance (April 7, 2026): https://rsmus.com/insights/services/risk-fraud-cybersecurity/coso-aligns-ai-governance-with-internal-control-guidance.html
• Nacha, Business Email Compromise Action Plan (2024): https://www.nacha.org/system/files/2024-07/Business%20Email%20Compromise%20Action%20Plan.pdf
• Venable, Nacha Risk Management Rules (March 2026): https://www.venable.com/insights/publications/2026/03/nacha-risk-management-rules
• Nacha, Phixius Account Ownership Verification Application (January 2022): https://nacha.org/news/nachas-phixius-platform-welcomes-participants-its-account-ownership-verification-application
• Nacha / Afinis Interoperability Standards, Account Validation Plus Name API: https://www.nacha.org/news/afinis-interoperability-standards-releases-new-apis-account-ownership-validation-and-payment
• J.P. Morgan, When Callbacks Go Wrong: https://jpmorgan.com/commercial-banking/insights/when-callbacks-go-wrong
• J.P. Morgan, Combating Vishing Schemes: https://www.jpmorgan.com/commercial-banking/insights/combat-vishing-schemes
• J.P. Morgan, Commercial real estate fraud prevention: https://www.jpmorgan.com/insights/real-estate/commercial-term-lending/commercial-real-estate-fraud-prevention
• J.P. Morgan, Trust & Safety fraud education guide and checklist: https://pages.paymentsolutions.jpmorgan.com/rs/984-MQH-261/images/trust_and_safety_fraud_education_guide_and_checklist_1209510.pdf
• U.S. Department of Commerce OIG, Fraud Alert (July 2026): https://www.oig.doc.gov/wp-content/OIGPublications/DOC-OIG-Fraud-Alert-July-2026-Approved.pdf
• City of Richmond, Office of the City Auditor, OCA 2026-09, Continuous Monitoring: Duplicate Payments (May 11, 2026): https://rva.gov/sites/default/files/2026-05/OCA%202026-09%20Continuous%20Monitoring%20-%20Duplicate%20Payments%205.11.26.pdf
• PredictAP, CAM Reconciliations: The $15 Billion Problem Hiding in Plain Sight (February 2026): https://blog.predictap.com/cam-reconciliations-the-15-billion-problem-hiding-in-plain-sight
• David Stifter, The New Fraud Risk: Gaming the Agent (2026): https://blog.predictap.com/gaming-the-agent-why-ai-invoice-approval-still-needs-an-independent-human-control
• Google DeepMind, AI Control Roadmap (2026): https://storage.googleapis.com/deepmind-media/DeepMind.com/Blog/securing-the-future-of-ai-agents/gdm-ai-control-roadmap.pdf
• Eftsure, Can your AI agents be manipulated into sending money to the wrong place? (July 2026): https://www.eftsure.com/blog/industry-news/can-your-ai-agents-be-manipulated-into-sending-money-to-the-wrong-place/
• CliftonLarsonAllen, 7 fraud prevention tips for real estate companies: https://www.claconnect.com/en/resources/blogs/real-estate/7-fraud-prevention-tips-for-real-estate-companies