AP fraud rarely announces itself. Instead, it looks like a duplicate invoice slipping through during a busy week. A vendor bank account change no one circled back to verify. A purchase order, matched to a receipt, that on closer inspection was never actually fulfilled. By the time the pattern becomes obvious, the payment has already cleared, and your money is gone.
According to the 2026 Report on Occupational Fraud from the Association of Certified Fraud Examiners, asset misappropriation schemes account for 90% of occupational fraud cases. Billing schemes—the category living squarely inside accounts payable—are the second most common and costly variant, with a median loss of $90,000 per incident. And yet the controls most finance teams rely on to catch them are still running on spreadsheets, email threads, and after-the-fact reconciliation.
If your team is performing 3-way match manually, in batches, or only on invoices above a certain dollar threshold, you have blind spots.
What 3-way match is supposed to do
Three-way match is one of the foundational controls in accounts payable. The idea is straightforward: before a vendor invoice gets approved for payment, you verify that three documents align.
The purchase order confirms the goods or services were formally requested and authorized. The receiving report confirms that what was ordered was actually delivered. The vendor invoice confirms what the vendor says is owed.
When all three match within acceptable tolerances, the invoice moves forward. When they don’t, it gets flagged for review. In theory, this process stops fraudulent or erroneous payments before they go out the door.
In practice, most implementations have gaps that fraudsters have learned to exploit.
Where traditional 3-way match breaks down
The four AP fraud patterns that most commonly slip past manual or batch-based matching processes share a common trait: they stay within the seams of whatever process you have, not outside it.
Duplicate billing is the simplest scheme. The same invoice is submitted twice, sometimes with minor variation in the invoice number, date, or amount. If your matching process runs in batches at the end of a period, or if invoices are matched by AP staff reviewing them individually, a second submission can land in a different batch or reach a different reviewer. Neither flags it.
Shell vendor fraud exploits the vendor onboarding process, not the match itself. A fictitious vendor is created in the system, invoices are submitted against real or fabricated POs, and payments are issued. If vendor onboarding controls are weak and approval workflows don’t include cross-checks for duplicate tax IDs, addresses, or bank account numbers, shell vendors can persist for years.
Quantity inflation manipulates the receiving record rather than the invoice. An employee with access to the receiving function records a larger quantity than was actually delivered. The invoice matches the inflated receipt. The match clears. The overpayment is made.
PO and receipt manipulation is a more coordinated version of the same idea. Someone with access to both the PO creation and receiving functions can create a PO, approve a receipt against it, and submit an invoice that matches both, without any actual goods or services changing hands.
The common thread: these schemes don’t beat 3-way match by circumventing it. They work because the match logic is too narrow, the tolerances are too loose, or the control points are siloed enough that no one sees the full picture at once.
What a real-time, exception-based matching model actually looks like
Modern 3-way match isn’t just a faster process—it’s structurally different. Instead of matching as a post-save batch process or a periodic reconciliation, validation happens the moment the vendor bill is entered, at the line level, against live PO and receipt data already inside NetSuite.
A few characteristics separate a real-time model from a batch-based one:
- Line-level validation, not header-level. Every invoice line is compared against the corresponding PO line and receipt record. Quantity variances, price differences, and unauthorized line additions get flagged individually, as opposed to absorbed into a header total that looks “close enough.”
- Tolerances configured to your control environment. A real-time engine should let you set tolerances at multiple levels—global, subsidiary, vendor, and item—by amount, percentage, or quantity. Strict enforcement for high-risk vendors, looser tolerances for trusted relationships, and the ability to calculate PO overages across all related bills rather than evaluating each invoice in isolation.
- Exceptions routed with full context. When a variance exceeds tolerance, the bill should route directly into an approval workflow with the discrepancy details attached. Approvers add justification comments that become a permanent part of the audit trail, closing the loop without a side conversation in email (that remains outside of your audit trail).
- Matched invoices that flow straight through. On perfect PO matches, the bill should move into approval (or, with Touchless Invoice Processing, be created automatically). Your team’s attention belongs on exceptions, not confirming what already lines up.
Charted Real-Time 3-Way Match is built on this exact model, validating every line against the PO and receipt the moment the vendor bill is entered, with results displayed on the bill itself. Because matching runs against PO and receipt data already living in NetSuite, there’s no sync delay, no risk of validating against stale records pulled from an external system, and no separate exceptions to hunt down.
Go deeper on three-way matching and join our upcoming webinar
If you want to see exactly where AP fraud hides in batch-based matching processes (and what a modern, NetSuite-native alternative looks like) join us for a 45-minute working session for finance and AP leaders. We’ll walk through:
- The four most common AP fraud patterns that bypass traditional 3-way match controls, and the specific data signals that expose each one.
- How to evaluate your current matching process against a real-time, exception-based model, including which tolerances, match criteria, and audit trails matter most.
- Where vendor onboarding fits into fraud prevention, and why bank account verification, duplicate vendor detection, and segregation of duties at setup are as important as the match itself.
- A practical framework for moving from batch-based reconciliation to continuous, NetSuite-native 3-way match without adding headcount or another system.
Save your seat for the webinar here:
