Quick example: during a proactive compliance review this morning, we flagged 12 sub-$5,000 invoices split across three newly onboarded vendors with sequential invoice numbers — a clear attempt to bypass approval thresholds. From a books-and-records standpoint (SOX/FCPA), that’s a hard stop; what high-signal, defensible first-pass tests are you using — Benford, vendor clustering, duplicate bank routing — to surface this early?
Quick example: we catch these by rolling 30-day spend per requester + GL + commodity and flagging runs that hover 85–100% of the $5k limit across ‘different’ vendors; the tell last month was a shared remit address and identical PDF hashes. First pass, lean on deterministic links — tax ID, bank account, remit address, email domain — and a submitter fingerprint (creator ID or upload IP); Benford’s fine, but with small n it’s noisy. Think of it as speed bumps right before the $5k line.
I’ve had best luck minhashing cleaned line descriptions + project code and flagging ≥3 sub-threshold invoices across ‘different’ vendors within 14 days that route to the same approver — much higher signal than Benford on small n, @r_kingsley58. Small caveat: suppress when the PO explicitly has milestone billing, and if you’ve got a portal, bind clusters to the uploader account ID.
Building on @irwin90, my highest-signal first pass is bank/ACH collision and PDF fingerprinting: flag ostensibly separate suppliers that share routing+last4 (or IBAN) and hash lightly normalized invoice PDFs (strip dates/amounts) to catch template reuse within 30 days — two vendors wearing the same shoes. Caveat: shared payment processors or factoring can trip this, so whitelist known platforms before escalating; are you seeing many of those?
I look at “time-to-first-invoice” for newly onboarded vendors and auto-flag anything under 7 days that posts 3+ sub-$5k entries inside 14 days, especially when invoice numbers look sequential. Then I collision-check normalized phone numbers and email domains against requesters/approvers and other suppliers; that’s nailed two shell clusters for us this quarter. Caveat: shared MSP helpdesk emails can false-positive, so we whitelist known group vendors and lean on EIN/TIN where available (404).
Score vendor email domain age; ‘newly onboarded’ + domain <45 days + sub-$5k clustering = stop; occasional false positives.
Quick example: I’ve had high hit rates by clustering newly added suppliers on W‑9 TIN/EIN and remit address/phone — if “different” vendors share a TIN or suite and the same AP poster touches them, that’s an immediate review. As @irwin90 noted on signal, I also check user overlap, but “TINs don’t lie”; just watch for legitimate shared-service centers across brand families and map parents/subs to avoid noise.
Building on @hwright76: I hash ACH routing+account (or IBAN last 8) and auto-flag when multiple vendors resolve to the same payee, especially if you’re seeing “sequential invoice numbers” just under $5k. It’s a simple, defensible match under SOX/FCPA and has caught split-invoice rings that rotate names. Caveat: payroll/factoring platforms can legitimately share settlement accounts, so I tag those after a quick confirm.
Short example: I roll up spend per requester and cost center on a 7–14 day window and flag when the combined total just under the approval limit crosses the threshold across “different” vendors. Alongside @hwright76, I also SHA‑256 the first attachment (quote/SOW) and key line‑item text; matching hashes or >0.95 text similarity across vendors within the same hour is a hard stop — same costume, new hat. I whitelist true blanket POs and maintenance contracts to avoid obvious false positives.
One thing that’s paid off is fingerprinting invoice PDFs: hash the text order and pull fields like Author/Producer, creation time, and embedded font subsets to see if those “sequential” invoices from new suppliers were generated by the same workstation — like catching the same typewriter ribbon. I pair it with a simple n‑gram cosine match on line-item descriptions over 7–10 days to spot chopped scopes just under the cap; caveat, shared billing platforms can blur this, so whitelist known processors or hosted AP portals.