Fraud detection from bank statements means reading genuine statements for patterns that honest activity rarely produces: payments to payees that appeared recently, round amounts just under approval limits, money cycling between accounts, and personal spending in a business account. A pattern is a lead, not a verdict. Test it, then explain it.
Which frauds leave traces in bank statements?
Frauds that move cash leave traces, because every dollar that leaves or enters an account is printed on a statement. Schemes that only touch the books, such as an invented journal entry, may leave none. The statement shows where money actually went, which is why reviewers start there.
Four families show up most often:
- Embezzlement and fictitious vendors. Money leaves to a payee who does no work for the business, or to an employee's own account.
- Check kiting. Funds move between two accounts so that each covers the other while the checks are still in transit.
- Personal expenses charged to the business. An owner or employee pays for private costs from a company account.
- Skimming and lapping. Receipts are diverted before they are deposited, or later deposits are used to cover earlier ones. The trace here is in deposit timing and amounts.
What statements cannot show
A statement shows the payee text and the amount. It does not show whether the goods arrived, whether an approval existed, or who initiated the payment. A payment to a real supplier at an inflated price looks identical to a fair one. Statements find the lead; invoices, approvals and interviews decide it.
Genuine or fake statement first
Everything below assumes the statements are real. If the file came from the person under suspicion, confirm it first with the tests in how to detect fake bank statements before you rely on them, because a forger controls what the patterns show.
Embezzlement red flags: new payees and round amounts
Embezzlement red flags are payment patterns that suggest money leaving for a purpose the business cannot document. Two of the most useful are payees that appear for the first time in the middle of a period and amounts that look chosen rather than invoiced.
New payees
List every payee and the date of its first payment. Sort by that date. A vendor that first appears this quarter is not suspicious by itself, because businesses add suppliers. Ask who approved it, whether anyone can name a contact there, and whether the bank text matches a company that exists. Watch for payees whose names are close to a known vendor, such as a trading name with one word changed, since a copy of a real supplier's name passes a casual read.
Round amounts and amounts near a limit
Invoices carry odd cents because they come from quantities and prices. Payments in whole thousands, repeated, are worth a look. So are payments clustered just below an approval limit. If a manager can approve up to 5,000.00 alone, a run of payments at 4,900.00 to 4,995.00 to one payee asks a question. The test is simple: count payments in a band just under each limit and compare it with the count just over it.
Payments to employees and shared details
Compare payee names and account details against the payroll list. A vendor that shares an address or a bank account with an employee is a classic fictitious-vendor trace, but statements show only what the bank prints, so you need the vendor file for this match. Repeated payments to a single person outside payroll, labelled as reimbursement, are another lead.
Growth in a payee's total
Total each payee by month. A payee whose payments climb steadily with no growth in the business is a pattern that survives even when each payment looks fine alone.
Check kiting and transfer patterns between accounts
Check kiting is moving money between two accounts, by check or transfer, so each account appears to hold funds that are really still in transit. The trace is a pair of accounts that pay each other in matching amounts, again and again, with little other activity.
How kiting looks across two statements
Put the two statements side by side. A check written from account A is deposited into account B on day one. Before it clears, a check from B is deposited into A to cover the first. The amounts grow, the cycle repeats, and the balance on each statement is propped up by the other. Here is an example, with made-up figures.
| Date | Account A | Account B |
|---|---|---|
| Mar 2 | Check out 8,000.00 | Deposit in 8,000.00 |
| Mar 4 | Deposit in 9,500.00 | Check out 9,500.00 |
| Mar 7 | Check out 11,000.00 | Deposit in 11,000.00 |
| Mar 9 | Deposit in 12,500.00 | Check out 12,500.00 |
Each amount is larger than the last, and each leg mirrors one in the other account. Real businesses move money between accounts too, so the test is the combination: matching amounts, alternating direction, steady growth and no business reason.
Related transfer patterns
Watch for large transfers out and back within days, which can hide a shortfall at a month end. Look for round transfers to an account that is not in the books. Match every transfer on one statement to its counterpart on the other, and list the ones with no partner. A transfer that leaves with no matching receipt anywhere is a lead in its own right.
Why you need all the accounts
Kiting is invisible on one statement, since each side looks like an ordinary deposit or payment. Ask for every account the business and its owners use before you test for it.
Personal expenses run through business bank statements
Personal expenses in a business account are private costs paid with company money: groceries, school fees, a family phone plan, a holiday. Statements show them through payee text and timing, and they range from sloppy bookkeeping to deliberate fraud, so the same test applies to both.
What to search for
Scan descriptions for payee types with no business link: supermarkets, restaurants on weekends, travel, schools, gyms, streaming services, jewellers, and utilities for an address that is not the premises. Look at timing. A run of charges on a Saturday or during a holiday is a prompt. Look at card-payment lines for the cardholder if the bank prints it.
Cash withdrawals and transfers to individuals
Regular cash withdrawals in round sums, or transfers to a person's own account labelled loan or advance, are common. Check them against the loan records and the owner's draw account. Money an owner takes and records as a draw is a matter of policy, while the same money coded as supplies is a misstatement.
Small cash funds
Petty cash gets its own control because small amounts get less scrutiny. If the business keeps a float, compare statement withdrawals that fund it with the count described in a petty cash reconciliation form. A fund that is replenished far more often than the receipts justify is a lead.
When a bank statement red flag has an innocent explanation
A red flag on a statement can have an ordinary cause. A pattern is a reason to ask, and a reviewer who treats every flag as fraud wastes the client's time and damages trust. A reviewer who dismisses every flag misses the real one. The skill is in testing the explanation.
Common innocent causes:
- A new payee is a new supplier the owner added without telling the bookkeeper.
- Round amounts are retainers, rent, loan installments or fixed-price contracts.
- Payments just under a limit reflect a vendor whose standard invoice happens to sit there.
- Transfers between accounts are sweeps between operating and savings accounts or payroll funding.
- Personal-looking charges are legitimate meals, travel or client gifts.
- Matching transfers in two accounts are intercompany funding between entities the same owner controls.
How to test an explanation
An innocent explanation can be checked, and a fraudulent one often cannot. Ask for the contract, the invoice, the approval email, the vendor's registration details or the loan agreement. A real explanation can be backed by a document. A vague one that changes as you ask is information.
Count the false positives
Keep a tally of flags raised and flags cleared. If most flags clear, tighten the test, for example by raising the round-amount threshold. If none clear, the data may be telling you something.
What should you do after bank statement fraud red flags appear?
After a red flag appears, preserve the evidence, limit who knows, and widen the review in a controlled way. Do not confront the person, change access without advice, or edit the books. Your first duty is to keep the record intact so the facts can be established later.
Preserve the evidence
Save the original statement files exactly as received, with a note of who supplied each and when. Work on copies. Export your tests to a dated file so you can show what you ran and what it returned. Edits to extracted data should leave a log, since someone may later ask what changed.
Limit the circle
Tell only the people who need to know: the engagement partner, the client's owner or audit committee, and counsel. The person under suspicion may be the person who gave you the statements, so route the conversation with care. Check your engagement terms and professional rules on reporting before you say anything outside the circle.
Widen the review
Move from the flagged item to its context. Pull the vendor file, the approvals and the other accounts. For the structured approach, read how forensic accountants analyze bank statements to trace where money went, and for statistical screens such as first-digit testing see Benford's law tests and when they apply.
Do not conclude from the statements alone
Statements point at a payee, an amount and a date. Establishing intent needs documents and interviews, and deciding on a legal step needs counsel. Write up what you found and what you did not test.
A red-flag table: pattern, the fraud it suggests and the test to run
Use this table as a working checklist when you read a set of statements. Each row pairs a pattern with the scheme it can suggest and a test you can run on the data. The patterns are leads, not proof, and every one has an innocent version.
| # | Pattern on the statements | Fraud it suggests | Test to run |
|---|---|---|---|
| 1 | Payee first appears mid-period | Fictitious vendor | List first-payment dates; trace approval and vendor file |
| 2 | Repeated round-thousand payments | Invented invoices | Count round payments per payee against invoices |
| 3 | Payments clustered below an approval limit | Splitting to avoid review | Count payments in the band under each limit |
| 4 | Payee shares details with an employee | Employee-controlled vendor | Match vendor and payroll records |
| 5 | Two accounts paying each other in growing amounts | Check kiting | Pair transfers across accounts by date and amount |
| 6 | Transfers out with no matching receipt | Diverted funds | List unmatched transfers on both statements |
| 7 | Supermarket, travel or school charges | Personal expenses | Search descriptions; check weekends and holidays |
| 8 | Duplicate payment, same payee and amount | Double payment or fraud | Run a duplicate rule on payee, amount and date |
Row 8 is the most mechanical test. PreciseBankFlow flags same-payee, same-amount lines on close dates for you to confirm and lists check-number gaps, each with its evidence in an exception report; it does not judge a payee's purpose, and firms can ask for a place through the get-started page.