Expense Report Fraud Detection: Beyond Deepfakes to Shallowfakes

Expense report fraud detection is focused on the wrong threat, Medius chief financial officer Chris Wilmot said, after the company’s August survey found 87% of 2,386 senior finance professionals had ignored a claim they suspected was fraudulent.

Wilmot’s argument is that “shallowfakes”, Medius’s term for small, low-tech expense dishonesty such as inflated mileage or partly personal spending, get less scrutiny than AI-generated deepfakes. “Costly deepfake fraud gets all the headlines,” he said in the company’s release.

The point matters to finance teams because most expense controls were built to catch volume and value, not intent. A claim that sits under an approval threshold usually passes, and the survey suggests the people reviewing it often know.

The source is a vendor survey. Medius sells accounts payable automation, and the controls it recommends are the kind it sells, so the figures are best read as one company’s research rather than neutral evidence. They are worth testing against independent data, which is set out below.

What the Medius census says about expense report fraud detection

Medius published its 2026 Financial Census on August 25, 2026. It surveyed senior finance professionals in the US, UK, Sweden and France.

The headline figure is that 87% had ignored a small expense, reimbursement or claim they believed was fraudulent. Another 74% said minor frauds with small losses are already common in their workplaces.

The behavioural findings are blunter. Some 67% said they would be likely to make a minor dishonest expense claim if colleagues commonly did, and 57% would round up an expense or mileage claim if they thought nobody would notice. A further 64% said they would feel justified in a small dishonest act if they felt underpaid or undervalued.

On deepfakes, 93% said they were concerned about AI-generated fraud over the next 12 months. US organisations reported average annual losses of about $168,000 from invoice fraud, with roughly one successful attempt a month.

The census page gives no detail on sampling method, fieldwork dates or margin of error. The sample size is 2,386, although some coverage describes it as more than 2,000.

Wilmot on why small claims need a response

Wilmot said finance teams should challenge suspected fraud regardless of the amount. “Even if the fraud is quite minor, it’s still bad behavior,” he said.

His case rests on signalling. A questionable claim that is paid without comment tells staff that dishonesty is tolerated, and the survey’s 67% figure on copycat behaviour is the evidence Medius offers for that.

He also argued that small amounts accumulate into large losses over time. The census does not put a figure on that aggregate, so the claim is an argument rather than a measured result.

Medius’s accompanying infographic recommends clear, enforced expense policies with zero-tolerance thresholds, and a culture in which reporting suspicious activity is safe and encouraged. The census page describes the challenge for finance leaders as “both technological and cultural”. Wilmot did not set out a specific control framework.

Independent data on expense fraud rates

The Association of Certified Fraud Examiners gives a longer-run benchmark. Its Occupational Fraud 2024: A Report to the Nations analysed 1,921 cases and put the overall median loss at $145,000.

Asset misappropriation, the category that includes expense reimbursement schemes, accounted for 89% of cases, with a median loss of $120,000. Expense reimbursement schemes made up about 13% of cases, with a median loss of $50,000.

Those numbers cut both ways for Wilmot’s thesis. A $50,000 median is far below the median for financial statement fraud, which the ACFE put at $766,000 across 5% of cases. But expense schemes are common, and a median of that size is not a rounding error for a mid-sized company.

The ACFE data covers schemes serious enough to be investigated, not the habitual padding of a mileage claim that the Medius survey describes. The two sources measure different things. Neither shows how much routine overclaiming costs a typical employer.

The ACFE also found that tips detected 43% of frauds, more than three times the next most common method. That supports the reporting-culture half of the Medius advice, since a staff member who sees a doctored receipt is more likely to catch it than a threshold rule.

Why expense report fraud detection misses doctored receipts

A shallowfake needs no software. It can be a photographed receipt with a changed total, a personal meal added to a client dinner, or a claim submitted twice in different months.

Controls aimed at synthetic media do little against these. Image forensics tuned to detect generated documents will not flag an authentic receipt that has been legitimately altered, or a genuine one used for the wrong purpose.

The practical defences are older and more mundane. Spend controls that tie card transactions to receipts, category limits and per-diem rules narrow the room for rounding up. Duplicate payment detection catches the resubmitted claim, and anomaly detection against role-based spending baselines surfaces the employee whose mileage is consistently above peers.

None of that works if reviewers wave through what they have flagged. The census finding that 87% have done exactly that points to a process problem before a technology one. Approvers who are not expected to document why they rejected or accepted a doubtful claim have little reason to challenge it.

What finance teams can check now

Auditors reviewing payment fraud prevention will often ask whether a control is designed, operating and evidenced. For expenses, the third test is where small claims fail. A policy that sets a threshold but keeps no record of exceptions cannot show the control worked.

Firms documenting this can start with an internal controls register that lists the expense approval step, the person responsible and the evidence retained. Where the register shows a manager approving their own team’s claims without a second review, the gap is visible before an investigator finds it.

Three questions are a reasonable starting point:

• Does the policy say what happens when an approver suspects a claim is padded, and who is told?
• Are rejected or amended claims logged, so repeat patterns can be seen by employee and by approver?
• Is there a safe channel for staff to report a colleague, given the ACFE’s finding on tips?

The cost of acting on every small claim is also real. Challenging a $12 mileage discrepancy takes a manager’s time, and the survey does not say at what point the effort outweighs the recovery. Wilmot’s zero-tolerance position is a policy choice, not a proven optimum.

Where the evidence goes next

The census supplies the behavioural data and the ACFE the loss data, but nothing yet links the two. A study that tracked actual small-claim overstatement against detection effort would settle whether Wilmot’s cumulative-loss argument holds.

The ACFE has since published a 14th edition of its report, with 2,402 cases, and its expense reimbursement figures will show whether the 2024 median of $50,000 has moved. Finance teams building a case for tighter expense controls will want that number before their next budget round.