# Duplicate Payment Fraud: When Repeats Are Deliberate

- Author: PreciseBankFlow (https://www.precisebankflow.com)
- Published: 2026-07-30
- Updated: 2026-07-30
- Category: Embezzlement and fraud schemes
- Canonical: https://www.precisebankflow.com/blog/duplicate-payment-fraud

> How duplicate payment fraud works when an insider pays an invoice twice and diverts the refund, and the tests that separate it from honest duplicates.
Duplicate payment fraud is an insider paying the same supplier invoice twice on purpose, then taking the money that comes back. The second payment goes to the real vendor, who refunds it or holds it as a credit, and the insider diverts that refund. It differs from an honest duplicate by its disguise, its approver and where the refund went.

## What is duplicate payment fraud?

Duplicate payment fraud is a deliberate repeat of a valid payment, made so that the excess can be recovered by the person who caused it. The first payment settles a real invoice. The second creates an overpayment that the supplier will usually return, and the scheme is about capturing that return.

The appeal for the fraudster is that every document is genuine. The supplier is real, the invoice is real and the goods arrived. An overpayment is a common, believable error in any payables team, so a single repeat raises little suspicion even when someone notices it.

Honest duplicates are frequent. A supplier sends a reminder that gets entered as a new invoice, or a payment run is released twice. The difference is in what happens next. With an honest duplicate, the supplier's refund lands back in the company's bank account or the credit is used against the next invoice. With a fraudulent one, the refund goes somewhere else, or the credit quietly disappears.

## How does an insider profit from paying an invoice twice?

An insider profits from paying an invoice twice by taking the supplier's refund, using the supplier credit for personal purchases, or splitting the overpayment with someone at the supplier. Each route needs the insider to control one more step after the payment, such as opening the mail, asking for the refund or posting credits.

### Intercepting the refund check

The insider phones the supplier, reports the overpayment and asks for a refund check. When the check arrives, the insider takes it from the mail, then deposits it to an account they control, sometimes after altering the payee. If the books never recorded the overpayment as a receivable, nothing shows as missing.

### Redirecting the refund

A bolder version asks the supplier to send the refund by transfer to "our new account". The supplier, keen to help a customer, does so. The redirect looks like an ordinary admin request from the customer's side.

### Using the credit

Some suppliers prefer to keep an overpayment as a credit on account. An insider who can order from that supplier then uses the credit to buy goods for personal use, delivered to a home address.

### Splitting with the supplier

Where a person at the supplier is involved, the supplier keeps the overpayment and passes part back to the insider. That is a form of the arrangement described in [vendor kickbacks and how they show in payment patterns](/blog/vendor-kickbacks), and the bank trace is on the supplier's side rather than yours.

## Altered invoice numbers that hide a duplicate payment

Altered invoice numbers hide a duplicate payment from the accounting system's own duplicate check. Most systems refuse an invoice number already entered for that supplier, so the fraudster changes it slightly: adds a letter, a dash, a leading zero, or swaps two digits. Amounts can be nudged by a few cents for the same reason.

Common disguises include:

- **Suffixes and prefixes:** INV-4471 entered again as INV-4471A or 04471.
- **Transposed digits:** 4471 entered as 4417.
- **A second vendor record:** the same supplier set up twice under slightly different names, so the system sees two vendors with one invoice each.
- **Statement instead of invoice:** a supplier statement, showing the same balance, entered and paid as if it were a new bill.
- **Copied invoices:** a scan of the paid invoice resubmitted with a new date.

Each of these leaves something to find. Strip invoice numbers to their digits and compare them. Compare supplier records by bank account and tax number, not name. Look for payments whose amount matches an earlier one to the same supplier within a few weeks.

## Tests that separate honest duplicates from duplicate payment fraud

The tests that separate honest duplicates from duplicate payment fraud look at disguise, approval and outcome. An honest duplicate usually carries the same invoice number and is caught by a supplier statement. A deliberate one carries an altered reference, was approved by the person who entered it, and its refund never reached the company's bank account.

The table below is an example of five flagged pairs from one year's payables, with made-up figures.

| Pair | Invoice refs | Amount | Days apart | Entered and approved by | Refund trail | Assessment |
| --- | --- | ---: | ---: | --- | --- | --- |
| 1 | 2210 / 2210 | 3,480.00 | 0 | Batch run released twice | Refund deposited to operating account 9 days later | Honest: system error, recovered |
| 2 | 7781 / 7781-R | 1,215.50 | 21 | Clerk A, approved by manager | Credit used on next invoice | Honest: reminder entered as new bill |
| 3 | 5032 / 05032 | 8,900.00 | 34 | Clerk B entered and approved | No deposit; supplier says refund check issued | Suspicious: altered ref, self-approved, refund missing |
| 4 | 1190 / 1109 | 4,620.00 | 18 | Clerk B entered and approved | Supplier says refund sent by transfer to "new account" | Suspicious: transposed ref, redirected refund |
| 5 | 6644 / 6644 | 642.10 | 3 | Clerk A, approved by manager | Still on supplier's books as credit | Open: recover the credit |

Pairs 3 and 4 share three features: a changed reference, one person doing both steps and a refund that did not come home. That combination, not the duplicate itself, is the lead. Pair 5 is not fraud but is still money owed back, and it belongs on the recovery list.

Finding the pairs is the slow part. [PreciseBankFlow](/) flags possible duplicates on the bank statement by payee, amount and close dates, and lists each one in an exception report with the lines that support it, so the review starts from the candidates instead of the whole ledger.

## Tracing the vendor refund after a duplicate payment

Tracing the vendor refund after a duplicate payment means asking the supplier how and when they returned the money, then finding that receipt in your own bank statements. If the supplier says they paid it back and your statements show no matching deposit, the refund was diverted, and the supplier's records will show where it went.

Ask the supplier for:

1. The date and method of the refund, and the amount.
2. A copy of the refund check, front and back, if one was issued. The endorsement shows where it was deposited.
3. The bank details used, if it was a transfer, and the email or letter that supplied them.
4. The name of the person at your company who asked for the refund.

Then search your statements for a deposit of that amount in the weeks after the refund date. Look in every account, including small ones. A missing refund deposit with a check endorsed into an unfamiliar account is strong evidence.

A refund that was asked for but never recorded can also be part of a wider pattern of false credits and returns. The customer-side version of that scheme is covered in [fraudulent refunds and how they hide in sales returns](/blog/fraudulent-refunds).

## Duplicate payment fraud in client trust accounts

Duplicate payment fraud in a client trust account is more serious than in operating funds, because the money belongs to clients. A law firm or other fiduciary that pays a settlement or a third-party bill twice from a trust account has reduced a client's balance. If the overpayment is then diverted, the firm has taken client money.

The same tests apply, with two additions. First, each disbursement must be matched to a specific client ledger, so a duplicate shows as one client's balance going down twice for one obligation. Second, the monthly three-way reconciliation between the bank, the trust journal and the client ledgers should show any overpayment as a shortfall on that client's ledger until it is recovered.

Spreadsheets struggle with this when a firm has many clients. Purpose-built tools are designed to keep client ledgers and the bank in step, and the options are compared in [trust accounting software for law firms](/blog/trust-accounting-software-for-law-firms). Whatever the tool, a duplicate from trust should be reported to the responsible partner the day it is found.

## Accounts payable controls against duplicate payment fraud

Accounts payable controls against duplicate payment fraud separate who enters invoices, who approves them, who talks to suppliers about refunds and who opens the mail. They also require every overpayment to be recorded as a receivable when it is found, so the refund has a place to land and its absence is visible.

A practical set:

- **Record overpayments as receivables.** When a duplicate is found, post it to a receivable from the supplier. The refund clears it. An old balance that never clears is the warning.
- **Refunds only to the company's account on file.** Tell suppliers in writing that refunds go by transfer to the account they already pay from, never to a new one by email.
- **One person cannot enter and approve.** The approval screen should show the invoice image and any earlier payment of the same amount to the same supplier.
- **Normalize invoice numbers** before the duplicate check, by stripping letters, dashes and leading zeros.
- **One vendor record per supplier,** checked by bank account and tax number.
- **Quarterly supplier statement review** by someone outside payables, looking for credits on account and refunds issued.

These controls make an honest mistake cheaper to fix, too. Most duplicates are errors, and recording them properly recovers money either way.