Tuesday, October 13, 2026

How to detect expense fraud: the red flags in employee claims

Procapy Team

An internal auditor at a distribution company in Surabaya pulls twenty expense claims for a routine sample. One is a taxi claim for Rp 96,000 with no receipt, which the policy allows: receipts are only required above Rp 100,000. Out of curiosity, the auditor pulls the same sales supervisor’s other claims for the year.

There are 212 taxi claims for Rp 19.4 million in total, every one between Rp 85,000 and Rp 99,000 and none with a receipt. The same manager approved all of them, usually on the day they were submitted. On 11 of those days, the HR system shows the supervisor on annual leave.

Each claim passed every rule in the policy. The problem only showed when someone looked at all of them together. Expense fraud is rarely one large claim. It’s small amounts, repeated and shaped to pass the checks a company actually runs. This guide covers the common types, the red flags, a worked example, what to do when you find something and the controls that make it hard to begin with.

What is expense fraud?

Expense fraud, also called reimbursement fraud, is an employee deliberately claiming money from the company that they aren’t entitled to. It covers expenses that never happened, real expenses claimed for more than they cost, the same expense claimed twice and personal spending presented as business.

“Deliberately” is the important word. Most wrong claims are mistakes: a digit typed wrong, a receipt attached to the wrong line, a rule nobody explained. A good expense policy makes those easy to avoid and easy to fix. Fraud is the smaller group of claims built to get past it. From a single claim you often can’t tell the two apart, which is why the right response to a red flag is a question, not an accusation.

It’s a close relative of duplicate payments in AP, and some of the controls are the same. The difference is that the people on the other side are your own employees, and the amounts are small enough that nobody looks twice.

The four common types of expense fraud

Fictitious expenses. Claims for spending that never happened: a receipt for a meal someone else paid for, a blank receipt filled in by the employee, an edited e-receipt or, as in Surabaya, small claims with no receipt at all.
Inflated expenses. The spending happened, but the claim is bigger: a fare rounded up, a receipt amount changed, a merchant persuaded to write a higher figure or mileage for a longer route than the one driven.
Duplicate and split claims. The same receipt claimed in two reports, by two colleagues who shared the meal, or on the corporate card and again as a reimbursement. Or one purchase split into two claims to stay under the receipt or approval threshold.
Personal spending as business. A family dinner coded as client entertainment, a weekend added to a conference hotel stay, groceries claimed as office supplies or fuel in a week with no travel.

Red flags on a single claim

Some warning signs are visible in one claim, provided the approver has the receipt in front of them:

The claimed amount doesn’t match the receipt. The most common red flag, and the easiest to check.
Round numbers where receipts aren’t round. A taxi meter or a restaurant bill rarely lands on exactly Rp 200,000, though fuel bought by value can.
A receipt that doesn’t look original. A screenshot instead of the e-receipt itself, figures in a different font from the rest of the receipt or a handwritten receipt from a merchant that normally prints one.
Dates and places that don’t fit. Weekends, public holidays, days on leave or a restaurant in Jakarta during a trip to Medan.
The wrong number of people at the table. A client dinner with no attendees listed, or six guests named on a bill that fed two, which keeps the amount per head under the cap.
Merchants with no obvious business reason, such as supermarkets, clothing shops and pharmacies, and no explanation on the claim.

Red flags across many claims

Other signs only appear when you look at one employee’s claims together, over months:

Amounts bunched just under a threshold, like the taxi claims in Surabaya.
Receipt numbers in sequence from the same merchant, weeks apart. A busy restaurant issues hundreds of receipts a week, so consecutive numbers suggest a receipt book rather than a series of meals.
The same handwriting on receipts from different merchants.
Claims that stand out from the employee’s own history, or from their peers. Spending that doubles from one quarter to the next, or twice as much as colleagues in the same role and region.
Missing-receipt declarations from the same person, again and again.
The same approver, approving fast. Every claim from one employee approved by one manager within minutes, and never queried.

A worked example: one month, five lines

A regional sales manager submits their September expense report. The approver sees a total of Rp 4,036,000, within the monthly budget, and approves it. Here is the same report with each line compared with its receipt:

Line (Rp ’000)	Receipt	Claimed	Difference
Taxi to client, 1 Sep	86	86	0
Hotel in Malang, 2 nights	1,700	1,700	0
Lunch, 3 Sep	180	810	630
Client dinner, 5 Sep	1,240	1,240	0
Taxi to airport, 11 Sep	162	200	38
Total	3,368	4,036	668

Three lines deserve a question:

Lunch, Rp 630,000 over. 180 typed as 810 is a classic transposition and may well be a typo. Only the receipt shows it. Ask for a correction, and note whether it happens again.
Taxi to airport, Rp 38,000 over. A round Rp 200,000 claimed against a receipt for Rp 162,000. Small, but worth asking about the first time, before it becomes a habit.
Client dinner, nothing over. The amount matches, but 5 September was a Saturday and the claim lists no attendees. Ask who was there and why.

Two of the five lines are over their receipts, by Rp 668,000 in total: almost a fifth more than the receipts support. None of this proves fraud. It proves that nobody compared the claim with the receipts before approving it. One report like this is a conversation. Twelve months of them is a pattern.

Expense fraud in Indonesia

A few local points shape where fraud hides and how you deal with it:

Handwritten kuitansi and nota. Small merchants, workshops and drivers often write receipts by hand, and some will hand over a blank one or write a higher figure on request. Accept handwritten receipts only up to a set amount, ask for the merchant’s stamp or phone number and treat a steady run of them from one employee as a red flag of its own.
The e-receipt, not a screenshot. Receipts from ride-hailing apps, airlines and online shops arrive by email or in the app. A screenshot is easy to edit; the forwarded email or downloaded PDF is much harder.
Client entertainment needs a guest list anyway. To deduct entertainment costs for corporate income tax, companies generally need a daftar nominatif with the names, positions and companies of the guests, plus the business purpose. Asking for attendees on every client meal serves the tax return and makes a personal dinner harder to pass off.
Follow your company regulations. The peraturan perusahaan or collective labour agreement (perjanjian kerja bersama, PKB) usually defines serious misconduct and the steps for discipline. A case handled outside that procedure can fall apart later.
Investigations involve personal data. An employee’s claims, travel and leave records are personal data under the personal data protection law (UU PDP). Limit who sees the file, and use it only for the investigation.

How to look into a suspected case

Start with a question. Ask the employee to check the line, as you would for any error. Many red flags end there, with a correction.
Preserve the evidence. Export the claims, receipt images and approval history before you go further, so nothing is changed or deleted while you look.
Widen the window. Review 12 to 24 months of the employee’s claims and compare them with colleagues in similar roles. Is this a one-off or a pattern?
Involve HR before any formal conversation, and legal where needed. Agree what the evidence shows, which procedure applies and who will be in the room.
Recover the money and fix the control. Agree how the amount is repaid, in line with your employment rules, and note which check failed so the fix goes where the gap was.

Signs your process lets expense fraud through

You probably need to look at your process if any of these sound familiar:

Approvers see a total, not the receipts behind it.
Nobody compares the amount typed with the amount on the receipt.
Claims just under the receipt threshold are common, and nobody counts them.
Corporate card spend and reimbursements are reviewed separately.
Directors’ claims are approved by people who report to them, or not reviewed at all.
A warning can be dismissed without a reason.
Nobody has ever looked at a year of one employee’s claims in one view.

Most expense fraud isn’t hidden inside a claim. It’s hidden in the fact that nobody reads two claims side by side.

How to prevent expense fraud

Put the receipt beside the number. Approvers should see the receipt image next to each claimed amount, and the two should be compared before approval, not in an audit.
Check for splits, not just thresholds. Claims from the same employee, at the same merchant, on the same or consecutive days should be reviewed as one.
Ask for context where fraud hides. Attendees and purpose for meals, trip dates and destination for travel and the original e-receipt rather than a screenshot.
Review card spend and reimbursements together, in one view per employee, so the same dinner can’t appear in both.
Compare people with themselves and their peers. Look each month at every employee’s claims against their own history and their role.
Separate who claims from who approves. Nobody approves their own claim, and directors’ claims go to another director or the finance director, not to someone who reports to them. Write this into your approval matrix.
Make dismissing a warning cost a sentence. Require a written reason, keep it on the claim and review overrides by approver every month.
Tell people the checks exist. Much expense fraud starts with a check nobody runs. When employees know every receipt is read and compared, few try.

How Procapy helps

Capy Expense checks every claim as it arrives, so the approver sees the question before approving. ProcAI reads the merchant, date, amount, currency and tax from the receipt image and compares each with what the employee typed, so a receipt for 180 claimed as 810 is flagged on the line. Duplicate receipts are caught across employees, reports and card feeds. Client meals require attendees and a purpose, with per-head caps, and travel claims are checked against the trip dates and destination on the request.

Across claims, ProcAI looks for claims split to stay under thresholds, repeated round-number amounts, the same merchant on consecutive days, weekend and out-of-hours spend and frequency that departs from the employee’s own history. Flagged claims wait in an exceptions queue, separate from bulk approvals, so they can’t be waved through with everything else. A flag can be overridden only with a written justification, stored on the claim with the name of the person who made it, and nobody can approve their own claim.

Most teams are live in under two weeks. Book a walkthrough, bring a month of expense claims, and we’ll run them through the duplicate, mismatch and policy checks live. The fraud and risk page shows the checks that also run on vendor invoices.

Back to blog