Accounts receivable write off fraud is stealing a customer's payment and then writing off that customer's balance so nobody chases it. The write-off makes the books look settled. It is found by reviewing write-offs for unusual size, timing or approval, tracing them to bank deposits and confirming balances directly with the customers involved.
How does a write-off conceal a stolen receivable payment?
A write-off conceals a stolen payment by removing the debt the payment was meant to settle. The customer has paid, so they never complain. The money went to the employee, so the bank never sees it. The write-off closes the open balance, so the aged receivables report stops showing an overdue account.
The scheme usually follows the same sequence:
- The customer pays, by check, cash or transfer, for an invoice that is genuinely owed.
- An employee intercepts the payment, for example by depositing a check into their own account or pocketing cash.
- The invoice stays open for a while, ageing on the receivables report.
- The employee writes the balance off, as a bad debt, a discount, a credit memo or a "small balance" adjustment.
- The customer's account shows zero, and the trail ends unless someone looks at why.
Write-off fraud is a concealment step, not a theft method on its own. The theft happens at step 2. What makes this scheme dangerous is that the concealment uses an ordinary accounting entry that most businesses make every month. Bad debts are real, and nobody is surprised to see some.
Where the stolen money goes next is a separate question. Some of it ends up spent on personal costs paid through the company's own accounts, a pattern described in the post on personal expenses run through a business account.
Bad debt write-offs and credit memos used as cover
Several entry types can clear a receivable, and fraudsters choose whichever gets the least review. Bad debt write-offs are the obvious one, but credit memos, sales returns, early payment discounts and small-balance adjustments all reduce what a customer owes. Credit memos are often the hardest to spot because they look like routine customer service.
The common forms of cover:
- Bad debt write-off. The balance is declared uncollectable. This usually needs some approval, which is why it is not always the first choice.
- Credit memo. A credit is issued for a claimed pricing error, damage or return. No goods come back, and no customer asked for it.
- Sales discount. A discount is applied after the fact, so the invoice appears paid at a lower amount.
- Small-balance adjustment. Many systems allow balances under a set amount to be cleared without approval. Splitting a stolen payment across several invoices can keep each write-off under that limit.
Each of these leaves a record in the accounting system: who posted it, when and with what reason code. The reason codes are worth reading. A credit memo for "returned goods" with no matching return in inventory is a contradiction the system will not flag on its own.
Which receivable write-offs deserve a second look?
Receivable write-offs deserve a second look when they break the business's usual pattern: unusually large, unusually frequent, written off soon after the invoice date, for customers who normally pay, or posted and approved by the same person. A write-off for a customer whose other invoices were paid on time is the strongest single sign.
Real bad debts have a shape. The customer stopped paying across several invoices, collection letters went out, and the balance aged past several months before it was written off. A fraudulent write-off often lacks that shape, because the customer paid and nobody chased them.
An example write-off review table
The table below is an example of a reviewer's sheet for six write-offs in one quarter. Customers, amounts and outcomes are illustrative.
| Write-off | Customer | Amount | Invoice age at write-off | Posted and approved by | Customer deposits since | Outcome |
|---|---|---|---|---|---|---|
| W-01 | Customer A | 4,200.00 | 210 days | Clerk, approved by controller | None | Clear: collections file exists |
| W-02 | Customer B | 1,850.00 | 45 days | Clerk, self-approved | Three payments on other invoices | Investigate |
| W-03 | Customer C | 96.00 | 30 days | Clerk, under limit | Regular payer | Investigate with W-04 |
| W-04 | Customer C | 98.50 | 30 days | Clerk, under limit | Regular payer | Investigate with W-03 |
| W-05 | Customer D | 620.00 | 160 days | Clerk, approved by controller | None; business closed | Clear |
| W-06 | Customer B | 1,200.00 | 40 days | Clerk, self-approved | Payments continued | Investigate |
Customer B is the clearest lead. The customer kept paying other invoices, yet two balances were written off quickly by the person who posted them. Customer C shows the split pattern: two write-offs just under a small-balance limit for a customer who pays on time.
Patterns to filter for
- Write-offs posted within 90 days of the invoice date.
- Write-offs for customers with payments recorded in the same or later months.
- Several write-offs just under an approval or small-balance limit.
- Write-offs posted and approved by one user.
- Credit memos with no matching return, complaint or sales approval.
Tracing written-off receivables to bank deposits
Tracing a written-off receivable to the bank tests whether the customer's money ever arrived. For each suspicious write-off, look at the bank statements for payments from that customer around the time of the invoice. If the customer's other payments reached the bank but the written-off one did not, the payment may have gone somewhere else.
The tracing work runs in a few steps:
- List the customer's invoices for the year with their status: paid, open or written off.
- Find each recorded payment on the bank statement, by amount, date and payer name.
- Look for the missing payment. Ask whether the customer paid by a method the business cannot see, such as a check endorsed to someone else.
- Request the check image from the customer's bank through the customer, or ask the customer for proof of payment.
When a customer pays by bank transfer, the money can only be stolen if the remittance details were changed. That can happen through an inside change to the business's bank details on invoices, or an outside request to the customer to pay a new account. The post on direct deposit fraud covers how changed account details redirect payments that were meant for the right person.
Bank statements are the evidence that matters here, so they need to be complete and accurate. When they come as PDFs, PreciseBankFlow reads each deposit line, checks that every statement foots from opening to closing balance and reports gaps and possible duplicates, which gives you a reliable list of what actually arrived.
Confirming receivable balances directly with customers
A customer confirmation is a request, sent by someone outside the receivables team, asking the customer to agree the balance the business shows for them. When the customer replies that they already paid an invoice the business wrote off, the confirmation has exposed the theft. It is one of the few tests that reaches outside the books entirely.
Step list for customer confirmations
- Select the customers: those with write-offs or credit memos in the period, plus a sample of others so the request looks routine.
- Prepare a statement of each customer's invoices and balance, including any written-off items as zero balances.
- Get contact details independently, from contracts or the customer's own website, not from the receivables clerk's records.
- Send the request from someone outside receivables, asking the customer to reply to that person.
- Ask the customer to list any payment they made that does not appear, with date, method and amount.
- Follow up on every difference, and request proof of payment for any invoice the customer says they paid.
The independence of the sender is the whole point. A confirmation sent by the clerk who wrote off the balances can be intercepted, and the reply can be changed.
Confirmations do not need to be formal audit letters. A friendly email from the finance manager, attaching a statement and asking for a quick check, will often get a reply within days.
Write-off fraud in small teams with no approval step
In small teams, one person often bills customers, records payments and writes off balances, with no approval step anywhere. That person can run write-off fraud without breaking any rule, because no rule exists. A write-off review only helps if someone other than that person does it, and it may not be enough on its own.
Small teams can still add checks that do not need extra staff:
- The owner approves every write-off and credit memo, however small, and reads the reason.
- Customer statements go out monthly, sent from a system the clerk cannot edit, or by the owner.
- Bank statements go to the owner first, so payments that should appear can be compared with what arrived.
- A quarterly look at write-offs by customer, filtered for customers who still pay.
When a write-off review is not enough
A write-off review cannot find thefts that were never written off. Some fraudsters move a stolen payment's balance onto another customer's account, or apply a later payment from one customer to an earlier invoice for another, which is lapping. Others leave the balance open on a customer who has gone out of business. If the review finds nothing but the receivables ledger still feels wrong, customer confirmations across a wider sample are the next step.
Property managers face the same risk with tenant receivables: rent collected in cash and then a tenant balance written off as uncollectable. The post on reconciliation software for property management covers how tenant ledgers are tied to deposits.