Two in Five Businesses Hit by Invoice Fraud, New Research Finds — Averaging US$367,000 in Losses

Research commissioned by Ivalua, a source-to-pay software vendor, and conducted by Sapio Research surveyed 800 procurement decision-makers across the US, UK, Germany and France. Published as a press release on 3 September 2026, it found that 40% of respondents' organisations had experienced invoice fraud in the past 12 months. Among the organisations that lost money, the reported average loss was US$367,000.

Fraudulent supplier bank-detail changes were the single biggest concern among affected organisations, cited by 41%. Duplicate invoicing and compromised supplier email accounts followed closely, each cited by 39%, and ghost vendors — invoices from suppliers that don't genuinely exist or no longer trade — concerned 32%.

Only 25% of respondents said their organisation's supplier checks were mostly automated, with standardised workflows and audit trails. The clear majority were still relying on manual review, individual judgement, or processes that vary by team and by supplier.

All four leading concerns in the research — bank-detail changes, duplicate invoices, compromised supplier email and ghost vendors — sit at the same point in the process: the supplier record and what's allowed to change it, not the invoice approval step itself.

Where supplier records live in email threads, spreadsheets and fragmented systems rather than a single controlled source, there's no reliable way to know whether a bank-detail change, a new invoice, or a new 'supplier' altogether is genuine — the business is trusting whoever raised it, not verifying it.

This is a structural gap, not an occasional lapse: with 75% of organisations still relying on manual or inconsistent supplier checks, most businesses are exposed at exactly the moment a fraudster would choose to strike — when a detail changes, not when a new supplier is first approved.

As vendor-sponsored research, these figures should be read as industry findings commissioned by a source-to-pay software provider rather than independent regulatory data — but the underlying pattern they describe is consistent with reporting from Scamwatch, the FBI and other independent sources on the same fraud types.

The common thread across all four concern areas is the absence of a standardised, automated workflow with an audit trail. Manual review depends on a person recognising something is wrong — and duplicate invoices, compromised-but-genuine supplier mailboxes and quietly-added ghost vendors are all built to look unremarkable to a person doing a quick check.

Only a quarter of organisations reported the level of automation and audit-trail discipline needed to catch these patterns systematically rather than by chance — leaving the other three in four dependent on manual vigilance for the exact fraud types survey respondents said were hardest to catch.