Most invoice fraud in SMEs does not come from sophisticated hackers. It comes from gaps in everyday processes: one person who can create a supplier, enter a bill and approve it, or a duplicate invoice that slips through because nobody checked.
The quickest way to reduce that risk is to separate who creates, approves and pays, and to have a system that flags anything unusual before money leaves your bank account. Xero handles your accounting records well. ApprovalMax adds the approval controls and fraud detection that Xero does not provide on its own.
This guide explains the three invoice fraud scenarios we see most often in SMEs, where the gaps usually are, and how to set up Xero and ApprovalMax to close them.
Quick answer: 6 controls that reduce invoice fraud in Xero
- Restrict who can create and edit suppliers in Xero.
- Route every bill through a multi-step approval based on amount and supplier.
- Approve new suppliers before anyone can bill against them.
- Flag duplicate bills before they are approved or paid.
- Get alerts when a bill is changed after approval or approved outside the workflow.
- Approve batch payments separately from bill approval.
What Is Invoice Fraud?
Invoice fraud is any scheme where a business pays for goods or services it did not receive, paid for already, or never authorised. It can be committed by an outside party, an employee, or both working together.
This article focuses on three internal schemes that approval controls are well suited to stop.
Ghost or fake suppliers
A staff member sets up a supplier that does not exist, or a real supplier with their own bank account attached. They then submit invoices for services that were never delivered. Common signs include vague descriptions such as “consulting” or “admin services”, round amounts and a supplier nobody else in the company has dealt with.
Duplicate and inflated invoices
The same invoice is entered twice, sometimes with a slightly different date or reference number. Inflated invoices charge more than the agreed price or quantity. Both can be honest mistakes, but they are also an easy way to move money if nobody checks against a purchase order.
Unauthorised internal payments
A user approves their own bill, edits the amount after a manager has approved it, or approves a bill directly in Xero to skip the usual sign-off. This is the scheme that most often depends on weak user permissions.
| Scheme | How it usually works | Warning signs |
|---|---|---|
| Ghost supplier | Fake supplier created, invoices raised for services never delivered | New supplier, vague descriptions, one staff member as sole contact |
| Duplicate invoice | Same invoice entered twice with a changed date or reference | Same supplier and amount within a short period |
| Inflated invoice | Price or quantity higher than agreed | Bill does not match the PO or contract |
| Unauthorised payment | Self-approval, edits after approval, bypassing the workflow | Same person enters and approves; bill changed after sign-off |
Why SMEs Are More Exposed to Invoice Fraud
The Association of Certified Fraud Examiners (ACFE) published Occupational Fraud 2026: A Report to the Nations, based on 2,402 cases across 143 countries. It estimates that a typical organisation loses about 5% of revenue to fraud each year, and the median scheme ran for 12 months before it was detected.
In the previous 2024 edition, billing schemes were among the most common forms of asset misappropriation, appearing in 22% of cases with a median loss of USD 100,000. The ACFE has also noted that smaller organisations tend to lose more as a percentage of revenue.
In practice, the reason is simple. In a team of three or four people, the same person often enters bills, chases approvals over WhatsApp and prepares the payment file. That is efficient, but it removes the checks that would catch a fake or repeated invoice.
Where Xero Alone Leaves Gaps
Xero is a strong accounting platform, and it does give you user roles, bill statuses (Draft, Awaiting Approval, Awaiting Payment) and a history log on each transaction. The gaps appear when you need tighter control over who approves what.
- Broad user roles. Many Xero roles that allow a user to enter bills also allow them to approve bills. Separating the two cleanly can be difficult depending on your role setup.
- No conditional routing. Xero does not natively send a SGD 500 bill to one approver and a SGD 50,000 bill through three approvers.
- Supplier creation is open. Users with the right access can add a new contact and bank details without anyone reviewing them.
- No proactive alerts. Changes to an approved bill are recorded in its history, but nobody is notified at the time it happens.
Xero has indicated on its product ideas forum that a native bill approval workflow is in development. Until it is released and proven, most growing businesses that need multi-step approvals use a dedicated app such as ApprovalMax.
How ApprovalMax Strengthens Invoice Controls in Xero
ApprovalMax connects to Xero with a two-way sync. Bills, purchase orders, contacts and credit notes move between the two systems, and once a bill is fully approved in ApprovalMax it is updated in Xero and ready for payment. Here are the features that matter most for fraud prevention.
Multi-step approval workflows
You can build approval rules based on amount, supplier, tracking category (such as department or project) or account code. A bill can require a department head, then the finance manager, then a director, depending on its value. Every action is logged with the approver’s name and timestamp.
Supplier (contact) approval
ApprovalMax offers a separate workflow for approving new contacts. A new supplier created in ApprovalMax only syncs to Xero once every approver has signed off. You can also hide bank details from purchase order requesters when they create a supplier.
This directly targets ghost supplier fraud, because nobody can quietly add a supplier and bill against it the same day. Note that this workflow applies to new contacts created in ApprovalMax, so you still need to limit who can create contacts directly in Xero.
Bill duplication control
ApprovalMax checks each bill for potential duplicates and warns the requester, reviewers and approvers. For Xero, it compares supplier, date and exact amount and currency, or supplier and reference. It checks against bills that are awaiting approval, approved or already paid.
The warning does not block the bill automatically. It puts the decision in front of the approver, which is where it belongs.
Bill-to-PO matching
For purchases that start with a purchase order, ApprovalMax can match the incoming bill against the approved PO. This makes inflated prices or quantities much easier to spot before approval.
Fraud detection alerts
ApprovalMax has two fraud detection settings that are especially useful:
- Bypassing the approval workflow. If someone creates and approves a bill directly in Xero without going through ApprovalMax, the bill is pulled into ApprovalMax and administrators are notified.
- Changes made after approval. If a bill is edited in Xero after it was approved in ApprovalMax, administrators are alerted. You can choose which changes to track, such as amount, supplier or account.
Batch payment approval
Batch payment runs created in Xero can be routed through ApprovalMax for approval before they are executed. This adds a final check at the point where money actually leaves the business.
Matching Controls to Each Fraud Scenario
| Fraud scenario | Xero control | ApprovalMax control |
|---|---|---|
| Ghost supplier | Limit who can create contacts | Contact approval workflow; hide bank details from requesters |
| Duplicate invoice | Bill history and reference field | Bill duplication control across awaiting, approved and paid bills |
| Inflated invoice | Purchase orders | Bill-to-PO matching; amount-based approval steps |
| Self-approval | User roles | Separate requester and approver steps, so the person entering a bill is not its approver |
| Edits after approval | Transaction history | Alerts on changes after approval |
| Bypassing approval | User roles | Alerts when bills are approved directly in Xero |
How to Set Up Fraud Controls in Xero and ApprovalMax
This is the sequence we recommend for most SMEs. The order matters, because workflows are only as strong as the user permissions underneath them.
- Review Xero user roles. Remove access for former staff and give each person the minimum role they need. Limit who can create contacts and edit bank details.
- Write down your approval limits. Agree on thresholds before you build anything. For example, bills up to SGD 2,000 approved by a department head, SGD 2,001 to SGD 20,000 also by the finance manager, and above SGD 20,000 also by a director. These figures are illustrative; set limits that fit your business.
- Connect ApprovalMax and build the bill workflow. Mirror your approval limits using amount, supplier and tracking category conditions.
- Turn on contact approval. Require finance to approve every new supplier, including a check of bank details against an official document such as the supplier’s letterhead or bank confirmation.
- Enable both fraud detection settings. Turn on alerts for bypassing the workflow and for changes after approval.
- Use purchase orders for regular spend. Set up a PO workflow for recurring categories such as inventory or subcontractors, and use bill-to-PO matching.
- Approve batch payments. Route payment runs through a separate approval so the person who prepares a payment is not the only one who releases it.
- Review monthly. Check bypass alerts, post-approval changes, new suppliers and any duplicate warnings that were overridden.
Common Mistakes to Avoid
- The approver is also the payer. If one person approves bills and releases payments, most of the protection is lost.
- Switching on bypass alerts without checking integrations. ApprovalMax warns that if bills are normally created and approved in Xero by another system, such as an order management app, administrators may be flooded with notifications. Map your integrations first.
- Approval limits that invite invoice splitting. If anything under SGD 2,000 needs only one approver, watch for the same supplier submitting several bills just below that limit.
- Treating duplicate warnings as noise. Recurring bills such as rent will trigger genuine matches. Review them instead of dismissing them by habit.
- Forgetting contacts created in Xero. Contact approval only covers suppliers created in ApprovalMax, so Xero permissions still matter.
Singapore Considerations
All Singapore companies must keep accounting records that allow true and fair financial statements to be prepared, under section 199(1) of the Companies Act. Section 199(2A) goes further and requires public companies and their subsidiaries to maintain internal accounting controls that give reasonable assurance that assets are protected from unauthorised use and that transactions are properly authorised.
Private SMEs are not bound by section 199(2A), but the same standard is good practice, and directors still have a general duty to act with reasonable diligence. Auditors, banks and investors will also look at how payments are approved.
Two further points are worth noting:
- Record keeping. IRAS requires businesses to keep their records for at least five years. An ApprovalMax audit trail gives you a clear record of who approved each bill and when.
- GST. For GST-registered businesses, input tax can only be claimed on valid tax invoices for genuine business purchases. A fake or duplicated supplier invoice can lead to an incorrect GST claim as well as a cash loss.
Need Help Tightening Your Approval Controls?
361DC helps Singapore SMEs set up Xero and ApprovalMax with approval workflows that match how their business actually runs. We review your user roles, design approval limits and configure fraud detection so your team gets fewer surprises and clearer accountability.
Speak to our team at 6515 7906 or email enquiry@361dc.com to review your current accounts payable process.
FAQs
No. ApprovalMax sits alongside Xero and handles approvals. Your bills, suppliers and payments remain in Xero, and the two systems sync in both directions.
It flags potential duplicates to the requester and every approver, but the final decision stays with the approver. This avoids blocking genuine recurring bills while still making duplicates hard to miss.
If you enable the bypass detection setting, ApprovalMax pulls that bill in during the next sync, marks it as approved outside the workflow and notifies administrators.
Its contact approval workflow requires new suppliers created in ApprovalMax to be approved before they sync to Xero. You should pair this with restricted contact permissions in Xero, since the workflow does not cover contacts created directly there.
Most SMEs work well with two to three steps tied to amount. The key rule is that the person who requests or enters a bill should never be the only approver.
Yes. ApprovalMax is listed on the Xero App Store for Singapore and supports Singapore Xero organisations.
Connecting ApprovalMax to Xero takes only minutes. Designing workflows, cleaning up user roles and training approvers usually takes longer, depending on how many entities and approvers you have.
