Where does accounts payable actually leak money?

Accounts payable leaks money in six places, and they share one cause: nobody compares every invoice against what was agreed and what was received. Duplicates, price and quantity drift, unapplied credit notes, expired early-payment discounts, changed supplier bank details, and contract prices that drifted since the contract was signed. Most of it is error rather than fraud, and all of it survives approval workflows that look sound on paper.

The reason these leaks persist is arithmetic, not negligence: checking every invoice properly costs more human time than finance departments have. A comparison layer that runs on 100% of invoices changes that constraint. Here is what leaks, why existing controls miss it, and how to measure your own exposure before spending anything.

The six leaks

• Duplicate payments. The same invoice arrives twice — resent by the supplier, re-entered after a query, or submitted once as a PDF and once as a scan with a different reference. Both get approved because each one looks fine on its own.
• Price and quantity drift. The invoice is a few percent above the agreed price, or bills for more than was delivered. Individually small, systematically expensive, and invisible unless something compares every line to the order.
• Credit notes and rebates that are never applied. Money you are owed, sitting in an email thread, forgotten by the time the next invoice is paid.
• Early-payment discounts lost to slow approval. The discount exists in the contract and expires while the invoice waits for someone to open it.
• Supplier bank-detail changes. An email announces new payment details for a real supplier and a real invoice. This is the leak with the largest single loss, and the one no approval workflow catches, because the approver is checking the amount, not the IBAN.
• Contract-price drift over time. A rate agreed two years ago quietly became a different rate, and nobody re-reads the contract when the invoice arrives.

Five of the six are recoverable in principle and rarely recovered in practice, because finding them after the fact costs more than the amounts involved. The sixth — a payment sent to the wrong bank account — is usually gone.

Why do controls that look fine on paper miss these?

Five structural reasons, none of which is about people being careless:

• Sampling. Most manual verification is spot checks. Anything that passes the sample passes forever.
• Approval is about budget, not content. The person who signs off knows whether they ordered something; they rarely know the agreed unit price or what was actually received.
• Four-eyes on the payment, not on the document. Two people confirming a payment run confirm each other's assumption that the invoices were checked upstream.
• Month-end pressure. Controls that survive a normal week collapse in the last three days of the month, which is when the volume arrives.
• The supplier is trusted. Long relationships get the benefit of the doubt, and long relationships are where price drift accumulates.

Add these up and the pattern is clear: the controls that exist verify authority, and the leaks live in content.

Which checks can a machine run on every invoice?

Anything that is a comparison. These six run on 100% of volume without adding headcount:

• Duplicate detection across supplier, amount, date window, references and document content — not just the invoice number field.
• Line-level comparison of price and quantity against the order and the goods receipt, within tolerances finance sets.
• Bank details on every invoice checked against the supplier master record, with any change treated as an exception by default.
• Credit notes matched to the invoices they belong to, so they are applied rather than filed.
• Payment-terms and discount deadlines tracked per invoice, so a discount is a scheduling problem instead of a lost one.
• New suppliers and first invoices flagged for a human look, because the first transaction is where impersonation lives.

What stays human is judgment: whether a service was worth what was agreed, whether to enforce a penalty, whether a long-standing supplier gets a pass this quarter. The system prepares those decisions with evidence attached; it does not make them.

The bank-detail check is worth more than the rest combined

Payment-redirection fraud does not look like fraud. The supplier is real, the invoice is real, the amount matches an order you placed. Only the account number changed, announced in a plausible email from a plausible address.

A machine check is trivially simple here and almost never implemented: compare the bank details on every incoming invoice against the master record, and treat any difference as an exception requiring out-of-band confirmation. One rule, applied without exception, on the leak with the worst single-event cost.

How do you size your own leak before investing?

Pull twelve months of paid invoices and run three queries: duplicates by supplier, amount and a two-week window; invoices whose unit prices exceed the agreed price list; credit notes issued but never applied. It is an afternoon of work in a spreadsheet and it produces a number. If that number is small, you have saved yourself a project. If it is not, you know what the control is worth.

What this costs, and when it is not worth it

The price is set by the package, not the vertical. A comparison layer that reads invoices and flags exceptions — output to a queue or a sheet, never writing into your ERP — can start as a Spinner: from €2,500 / $2,900 for the build, plus a €200–300/month maintenance fee on top. Extraction plus reconciliation with an integration to build — the shape of the system that processed 10,000+ invoices in production and found fraud that spot-checking had missed — is typically a Bottlenose: from €5,000 / $5,900 plus a €300–700/month fee, with the critical steps supervised. Which one fits your flow is what the free 30-minute intro call establishes.

It is not worth it at low volume, or where suppliers are few and contracts are simple enough that one person genuinely does check everything. We say so when that is the case, before anyone commits a budget — the ROI arithmetic is not complicated, and it is better run before a build than after one.

Do you know what your AP leaks?

Run the three queries above. If the number surprises you, we should talk. The fastest first step is the free AI Audit — five minutes and you will know whether your document flows are ready to automate — and then book a call. The mechanics are in how three-way matching works.